Function at 0x180003930
Capabilities:
Create thread
Encode data using xor
Get file size

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r15d, dword [rsp + 0x90]
lea edi, [r8 - 0x117c]
add r15d, 0xfffff742
lea ebp, [r9 + 0x558]
mov eax, edi
mov dword [rsp + 0x90], r15d
mov r14d, ecx
lea esi, [r9 + 0x907]
xor eax, 0xf6e
lea r13d, [r8 - 0xb38]
xor r14d, 0x644
mov rbx, rdx
cmp ebp, eax
jl 0x1800039b7
add r15d, 0x172
add esi, 0xfffff771
mov dword [rsp + 0x90], r15d
xor esi, 0x3e0
jmp 0x180003a95
mov eax, dword [rdx + 0x104]
mov r12d, dword [0x180026084]
and eax, 0xc87
sub eax, 0xb5d
cmp r12d, eax
jb 0x180003a2c
mov rax, qword [section..data]
mov ecx, dword [rbx + 0x110]
mov edx, dword [rax + 0x110]
mov eax, edi
xor rdx, rax
mov eax, dword [rbx + 0x28]
xor rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov eax, dword [0x180026044]
add r12d, 3
and eax, r14d
imul edi, eax
mov eax, dword [0x180026058]
sub eax, edi
sub eax, 0xab3
imul edi, eax
mov eax, dword [rbx + 0x104]
and eax, 0xc87
sub eax, 0xb5d
cmp r12d, eax
jae 0x1800039d3
mov rcx, qword [section..data]
mov r9d, r14d
mov r10d, dword [0x1800260a0]
and r9d, 0xc87
mov r8d, dword [0x180026050]
add r10d, 0x150d
movsxd r11, r13d
add r8d, 0xffffe7d4
mov eax, dword [rcx + 0x9c]
xor r11, 0x10e0
mov edx, dword [rcx + 0x70]
xor r9, rax
mov ecx, dword [rbx + 0xa8]
mov eax, esi
sub ecx, 0x129c
xor rdx, rax
mov qword [rsp + 0x28], r11
mov eax, edi
or rdx, rax
mov dword [rsp + 0x20], r10d
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [r13 + 0xa9c]
cmp edi, eax
je 0x180003c52
lea edx, [r15 + 0x74c]
xor r14d, 0x1104
lea eax, [r15 - 0x62d]
mov r9, rbx
mov dword [rsp + 0x28], eax
lea r8d, [rbp - 0x9d5]
mov dword [rsp + 0x20], edx
lea ecx, [r13 + 0x2ce]
mov edx, r14d
call fcn.180002670
mov r14d, eax
lea r8d, [r15 + 0x57c]
xor eax, 0x5dd
lea rdx, [0x180026010]
sub esi, 0x120
mov dword [rsp + 0x20], eax
mov ecx, r14d
lea r9d, [rsi - 0x574]
call fcn.1800020f0
mov ebp, eax
xor r9d, r9d
nop
mov rcx, qword [section..data]
mov rax, qword [rcx + 0xb8]
mov r8d, dword [rax + r9]
mov eax, 0x88cbd
imul r8d, dword [rcx + 0x68]
add r9, 4
sub eax, dword [rbx + 0xe0]
mov ecx, 0x13db13
add dword [rbx + 0x94], eax
sub ecx, dword [rbx + 0x98]
sub ecx, dword [rbx]
mov rax, qword [section..data]
mov edx, r8d
shr edx, 0x10
add dword [rax], ecx
mov eax, dword [0x18002603c]
mov ecx, dword [rbx + 0x98]
add eax, 0xffe9059d
add ecx, dword [rbx + 0xdc]
add ecx, eax
mov dword [0x18002603c], ecx
movsxd rcx, dword [rbx + 0x6c]
mov rax, qword [rbx + 0xc0]
mov byte [rcx + rax], dl
mov edx, r8d
inc dword [rbx + 0x6c]
mov rcx, qword [section..data]
mov eax, dword [0x180026010]
shr edx, 8
xor dword [rcx + 0x2c], eax
mov eax, dword [0x1800260a4]
mov ecx, dword [rbx + 0x28]
add eax, 0xfff412aa
add ecx, eax
mov rax, qword [0x1800260d0]
mov dword [0x1800260a4], ecx
movsxd rcx, dword [0x18002607c]
mov byte [rcx + rax], dl
inc dword [0x18002607c]
mov rax, qword [section..data]
mov ecx, dword [rax + 0xe0]
add ecx, dword [rbx + 0x48]
xor ecx, 0x136097
sub dword [rbx + 0x28], ecx
mov eax, dword [0x1800260a4]
add eax, 0xffe32e44
add dword [0x180026058], eax
movsxd rcx, dword [rbx + 0x6c]
mov rax, qword [rbx + 0xc0]
mov byte [rcx + rax], r8b
mov eax, 0x88cbd
mov ecx, dword [rbx + 0xe0]
xor ecx, dword [rbx + 0x9c]
inc dword [rbx + 0x6c]
sub eax, ecx
add dword [0x180026060], eax
mov eax, 0x14e0c2
sub eax, dword [rbx + 0x88]
add dword [rbx + 0xe0], eax
mov eax, 0x31f50
sub eax, dword [0x1800260ec]
add dword [rbx + 0x60], eax
cmp r9, 0x6cf0
jl 0x180003b10
sub ebp, 0x9b1
mov eax, r15d
xor eax, 0x4ce
cmp edi, eax
jge 0x180003cce
xor ebp, 0x1470
lea eax, [rbp - 0xe03]
cmp edi, eax
je 0x180003cce
lea eax, [r14 + 0x155]
cmp edi, eax
jge 0x180003cf1
mov rax, qword [section..data]
lea edx, [rsi - 0x301]
mov r8d, esi
xor edi, 0xc36
xor r8d, 0x78
mov dword [rsp + 0x28], edi
mov r9d, esi
mov dword [rsp + 0x20], r8d
mov ecx, dword [rax + 0xdc]
xor r9d, 0x471
add ecx, 0xfffcf8b7
add ecx, dword [rbx + 0x110]
mov dword [rbx + 0x68], ecx
lea ecx, [r14 + 0x651]
mov r8, qword [section..data]
call fcn.1800028c0
mov eax, r15d
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ecx, edi
or ecx, ebp
cmp esi, ecx
jge 0x180003cce
lea eax, [r14 + r13]
mov r12d, r13d
imul r12d, ebp
mov r14d, r13d
and r14d, ebp
imul r14d, r13d
sub r12d, r15d
imul r15d, eax, 0x105a
imul eax, edi, 0x129c
sub ecx, esi
mov edi, ecx
movsxd r13, eax
nop word [rax + rax]
mov r9d, dword [0x1800260a4]
mov ecx, ebp
sub ecx, dword [rbx + 0xe0]
sub r9d, esi
add ecx, dword [rbx + 8]
mov r8d, r15d
mov edx, dword [rbx + 0xa8]
imul r9d, dword [rbx + 0x98]
add edx, ebp
mov qword [rsp + 0x30], rcx
or edx, esi
mov dword [rsp + 0x28], r12d
mov rcx, r13
mov dword [rsp + 0x20], edx
mov edx, r14d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
sub rdi, 1
jne 0x180003d30
mov eax, dword [rsp + 0x90]
jmp 0x180003cd1