Function at 0x1400fba70
Capabilities:
Create thread
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rbx, r8
mov r14, rdx
mov rdi, rcx
mov eax, dword [0x140224658]
sub eax, dword [0x14022465c]
mov ecx, eax
not ecx
mov edx, eax
and edx, 0x94ed64c9
and ecx, 0x6b129b36
imul ecx, edx
mov edx, eax
and edx, 0x6b129b36
or eax, 0x6b129b36
imul eax, edx
add eax, ecx
add eax, 0x488adc64
imul rax, rax, 0x628977b7
shr rax, 0x3e
cmp eax, 0xb7862c61
jne 0x1400fbaf0
movzx eax, byte [0x14022cb78]
mov edx, 0x10
xor ecx, ecx
call fcn.140107940
nop word cs:[rax + rax]
mov eax, dword [0x140224664]
add eax, dword [0x140224660]
mov ecx, eax
and ecx, 0x39124796
add ecx, ecx
sub eax, ecx
add eax, 0xb9124796
mov ecx, eax
and ecx, 0x748900e0
xor eax, 0x748900e0
lea ebp, [rax + rcx*2]
xor ebp, 0xb9e148b6
movzx eax, byte [0x14022cb78]
mov edx, 0x10
xor ecx, ecx
call fcn.14014ee50
cmp ebp, 0xd065c449
je 0x1400fbaf0
mov rsi, rax
nop word cs:[rax + rax]
mov eax, dword [0x140224668]
mov ecx, dword [0x14022466c]
mov edx, eax
not edx
and edx, ecx
mov r8d, ecx
not r8d
and r8d, eax
imul r8d, edx
mov edx, eax
and edx, ecx
or eax, ecx
imul eax, edx
add eax, r8d
imul rax, rax, 0x7250bbb5
shr rax, 0x3b
add eax, 0xd05d77e1
mov ecx, eax
xor ecx, 0xd0500434
and ecx, eax
cmp ecx, 0x54c7287e
je 0x1400fbb50
test rsi, rsi
je 0x1400fbbd9
mov qword [rsi], r14
mov qword [rsi + 8], rbx
mov eax, dword [0x140224670]
xor edx, edx
div dword [0x140224674]
mov ecx, eax
not ecx
and ecx, 0x19083894
and eax, 0x6f7c76b
sub eax, ecx
or eax, 0xe7b82560
cmp eax, 0x3ec60484
jne 0x1400fbc13
jmp 0x1400fbca2
ud2
mov eax, dword [0x140224678]
xor edx, edx
div dword [0x14022467c]
mov ebx, eax
or eax, 0xca587451
mov ecx, ebx
not ecx
and ecx, 0x25a40128
mov edx, eax
and edx, 0x1053aac7
imul edx, ecx
and eax, 0xefac5538
or ebx, 0xeffc7579
imul ebx, eax
add ebx, edx
mov eax, ebx
not eax
mov ecx, ebx
and ecx, 0x25bf0570
and eax, 0xda40fa8d
imul eax, ecx
mov ecx, ebx
and ecx, 0xda40fa88
or ebx, 0xda40fa8d
imul ebx, ecx
add ebx, eax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x1400fd3c0]
xor ecx, ecx
mov rdx, rdi
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp ebx, 0x4b208346
jae 0x1400fbccc
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x1400fd3c0]
xor ecx, ecx
mov rdx, rdi
mov r9, rsi
call fcn.140150b30
jmp 0x1400fbc13
mov rcx, rax
nop
mov eax, dword [0x140224680]
xor edx, edx
div dword [0x140224684]
mov edx, eax
and edx, 0xc4d04bc5
and eax, 0x4804240
add eax, eax
sub edx, eax
lea eax, [rdx + 0xfa9e258]
mov r8d, eax
and r8d, 0x431f44c5
xor eax, 0xbce0bb3a
add eax, edx
add eax, 0xfa9e258
sub eax, r8d
cmp eax, 0xdc15a616
ja 0x1400fbcd0
test rcx, rcx
je 0x1400fbd30
xor eax, eax
jmp 0x1400fc18a
mov eax, dword [0x140224690]
or eax, dword [0x140224694]
imul eax, eax, 0xdde170cf
and eax, 0xb09fda17
cmp eax, 0xe0623fa4
je 0x1400fbd30
mov rdi, qword [rsi]
mov eax, dword [0x140224698]
xor edx, edx
div dword [0x14022469c]
nop
mov eax, dword [0x1402246a0]
add eax, dword [0x1402246a4]
mov ecx, eax
or ecx, 0x90041000
not eax
and eax, 0x22038478
and ecx, 0x95141902
or ecx, eax
mov eax, ecx
xor eax, 0xb9084529
xor ecx, 0x9648b9df
add ecx, eax
and eax, 0x1f0109
sub ecx, eax
cmp ecx, 0xded72152
je 0x1400fbd60
mov rbx, qword [rsi + 8]
mov rax, qword [rbx]
test rax, rax
je 0x1400fbe06
mov rcx, rdi
call rax
nop word cs:[rax + rax]
mov eax, dword [0x1402246a8]
mov ecx, dword [0x1402246ac]
mov edx, eax
and edx, ecx
add edx, edx
add eax, ecx
sub eax, edx
imul eax, eax, 0xece3d323
mov ecx, eax
not ecx
or eax, 0xdcfdc174
or ecx, 0x23023e8b
and ecx, eax
mov eax, ecx
not eax
and eax, 0xf62c848a
and ecx, 0x9d37b75
sub ecx, eax
cmp ecx, 0x238b5b72
jb 0x1400fbdc0
cmp qword [rbx + 8], 0
je 0x1400fc018
mov rax, qword [rbx + 0x10]
mov ecx, 0x97398b93
nop word [rax + rax]
mov edx, dword [0x1402246b0]
sub edx, dword [0x1402246b4]
mov r8d, edx
not r8d
mov r9d, edx
and r9d, 0x757da2c6
and r8d, 0x8a825d39
imul r8d, r9d
mov r9d, edx
and r9d, 0x8a825d39
or edx, 0x8a825d39
imul edx, r9d
add edx, r8d
or edx, 0x6271401d
imul rdx, rcx
shr rdx, 0x3d
cmp edx, 0x2c494941
je 0x1400fbe20
cmp rax, 0x11
jb 0x1400fbf72
nop
mov ecx, dword [0x1402246b8]
mov edx, dword [0x1402246bc]
mov eax, ecx
not eax
mov r8d, edx
not r8d
mov r9d, eax
and r9d, 0x634a3be
and ecx, 0xf9cb5c41
or ecx, r9d
or eax, r8d
and r8d, 0x634a3be
and edx, 0xf9cb5c41
or edx, r8d
xor edx, ecx
not eax
or eax, edx
add eax, 0xd56a67d5
mov ecx, eax
or ecx, 0xc2884c4d
mov edx, eax
not edx
and edx, 0x3c56a130
mov r8d, ecx
and r8d, 0xc1a952ce
imul r8d, edx
and ecx, 0x3e56ad31
or eax, 0xfedeed7d
imul eax, ecx
add eax, r8d
cmp eax, 0x5958c8ae
ja 0x1400fbe80
mov eax, dword [0x1402246c0]
xor edx, edx
div dword [0x1402246c4]
nop dword [rax]
mov eax, dword [0x1402246c8]
or eax, dword [0x1402246cc]
mov ecx, eax
xor ecx, 0xab55e4dc
add ecx, eax
and eax, 0x54aa1b23
sub ecx, eax
mov eax, ecx
xor eax, 0xa0114045
xor ecx, 0x1cac8eba
or eax, 0x5b623320
and eax, ecx
cmp eax, 0x1ae603c7
je 0x1400fbf10
mov rdi, qword [rdi - 8]
nop dword [rax]
mov eax, dword [0x1402246d0]
xor eax, dword [0x1402246d4]
and eax, 0x5123c1d5
add eax, 0x70956537
and eax, 0xa1b4a3d5
cmp eax, 0x6e8cb081
jb 0x1400fbf50
mov eax, dword [0x1402246d8]
xor eax, dword [0x1402246dc]
imul eax, eax, 0x6080a6cf
mov ecx, eax
not ecx
mov edx, eax
and edx, 0xe68b921b
and ecx, 0x19746de4
imul ecx, edx
mov edx, eax
and edx, 0x19746de4
or eax, 0x19746de4
imul eax, edx
add eax, ecx
imul eax, eax, 0xb97a813d
cmp eax, 0xec6b0679
jbe 0x1400fbfc9
mov rcx, qword [0x14022cb48]
xor edx, edx
mov r8, rdi
call fcn.14014eed0
mov ebx, 0xa6f7d03b
mov r14, qword [sym.imp.KERNEL32.dll_HeapFree]
nop word cs:[rax + rax]
mov eax, dword [0x1402246e4]
add eax, dword [0x1402246e0]
xor eax, 0x4fcee10e
imul r15d, eax, 0xb80288e7
imul r15, rbx
shr r15, 0x3e
mov rcx, qword [0x14022cb48]
xor edx, edx
mov r8, rdi
call r14
cmp r15d, 0x5e3e2a2b
ja 0x1400fbfe0
mov eax, dword [0x1402246e8]
sub eax, dword [0x1402246ec]
mov ecx, eax
not ecx
mov edx, eax
or edx, 0xa15db58c
mov r8d, edx
and r8d, 0xe74bad37
and ecx, 0x18a04240
imul ecx, r8d
and edx, 0x18b452c8
or eax, 0xb9fdf7cc
imul eax, edx
add eax, ecx
cmp eax, 0x32ce019b
je 0x1400fc0e0
mov edi, dword [0x1402246f0]
and edi, dword [0x1402246f4]
mov eax, edi
not eax
mov ecx, edi
and ecx, 0x97a390f7
and eax, 0x685c6f08
imul eax, ecx
mov ecx, edi
and ecx, 0x685c6f08
or edi, 0x685c6f08
imul edi, ecx
add edi, eax
mov eax, edi
and eax, 0x7287008
xor edi, 0x728700e
or edi, eax
mov eax, edi
not eax
and eax, 0xea922081
mov ecx, edi
and ecx, 0x156ddf7e
imul ecx, eax
mov eax, edi
and eax, 0xea922080
or edi, 0xea922081
imul edi, eax
add edi, ecx
mov rcx, qword [0x14022cb48]
xor edx, edx
mov r8, rsi
call fcn.14014eed0
cmp edi, 0xdca0d0fc
jbe 0x1400fc0f7
mov rcx, qword [0x14022cb48]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1400fc05f
mov eax, dword [0x1402246f8]
xor edx, edx
div dword [0x1402246fc]
or eax, 0x7e8838b5
imul eax, eax, 0x7406332c
mov ecx, eax
not ecx
and ecx, 0x6871e913
and eax, 0x978e16e8
sub eax, ecx
cmp eax, 0xada9cd74
je 0x1400fc172
mov eax, dword [0x140224700]
mov esi, dword [0x140224704]
not eax
not esi
or esi, eax
mov eax, esi
not eax
or eax, 0x31b62bf9
or esi, 0xe22f619a
and esi, eax
and esi, 0xf3bf6bfb
mov eax, esi
not eax
xor esi, 0xcd4e6caa
add esi, eax
and eax, 0xcd484c22
sub esi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, 0x7fef3079
jbe 0x1400fc17a
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400fc128
movsxd rcx, eax
shl rcx, 0x20
or rcx, 2
mov eax, 1
mov rdx, rcx
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret