Function at 0x1400b87b0
Capabilities:
Create thread
Encode data using base64
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rbx, r8
mov r14, rdx
mov rdi, rcx
movzx eax, byte [0x141ddb278]
mov eax, dword [0x141dd4108]
or eax, dword [0x141dd410c]
add eax, 0xbf52f8ee
xor eax, 0x9f8a3ff
imul eax, eax, 0xacbd540f
cmp eax, 0x586a4ab5
je 0x1400b8836
mov r15d, dword [0x141dd4110]
imul r15d, dword [0x141dd4114]
xor r15d, 0xdb60678c
imul rax, r15, 0x299272f7
shr rax, 0x20
sub r15d, eax
shr r15d, 1
add r15d, eax
shr r15d, 0x1e
and r15d, 1
mov edx, 0x10
xor ecx, ecx
call fcn.1400c0180
cmp r15d, 0x367d269b
jne 0x1400b8844
mov edx, 0x10
xor ecx, ecx
call fcn.1400c0180
jmp 0x1400b87ef
mov rsi, rax
nop word [rax + rax]
mov eax, dword [0x141dd4118]
imul eax, dword [0x141dd411c]
or eax, 0xebfe5fdc
and eax, 0xefffffdf
cmp eax, 0xe7d12505
jb 0x1400b8850
test rsi, rsi
je 0x1400b8a9c
mov qword [rsi], r14
mov qword [rsi + 8], rbx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x1400b9380]
xor ecx, ecx
mov rdx, rdi
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
nop word [rax + rax]
mov eax, dword [0x141dd4120]
sub eax, dword [0x141dd4124]
and eax, 0x210060
cmp eax, 0xf83648ff
je 0x1400b88b0
nop dword [rax + rax]
mov eax, dword [0x141dd4128]
and eax, dword [0x141dd412c]
add eax, 0x81b4f727
xor eax, 0x9a188c1c
cmp eax, 0xe2a33726
ja 0x1400b88d0
test rcx, rcx
je 0x1400b88fa
xor r8d, r8d
jmp 0x1400b8b30
mov rdi, qword [rsi]
mov rbx, qword [rsi + 8]
mov eax, dword [0x141dd4130]
xor edx, edx
div dword [0x141dd4134]
nop
mov eax, dword [0x141dd4138]
sub eax, dword [0x141dd413c]
xor eax, 0x94e6915a
imul rax, rax, 0x3821fe33
shr rax, 0x3d
add eax, 0x6fab1acf
cmp eax, 0x74ffebdc
ja 0x1400b8910
mov rax, qword [rbx]
test rax, rax
je 0x1400b8945
mov rcx, rdi
call rax
mov r8, qword [rbx + 8]
mov rcx, qword [rbx + 0x10]
mov r9d, 0x9f897c31
nop word cs:[rax + rax]
mov eax, dword [0x141dd4140]
xor edx, edx
div dword [0x141dd4144]
imul eax, eax, 0x195cb84c
add eax, 0x902721dc
imul rax, r9
shr rax, 0x3f
cmp eax, 0xe8f79aba
ja 0x1400b8960
test r8, r8
je 0x1400b8a94
nop word cs:[rax + rax]
mov eax, dword [0x141dd4148]
add eax, dword [0x141dd414c]
and eax, 0x1008030
cmp eax, 0xe4fdedb3
ja 0x1400b89a0
nop dword [rax + rax]
mov eax, dword [0x141dd4150]
add eax, dword [0x141dd4154]
or eax, 0x4466e1be
cmp eax, 0x35389966
je 0x1400b89c0
cmp rcx, 0x11
jb 0x1400b8a13
mov rdi, qword [rdi - 8]
nop word cs:[rax + rax]
mov eax, dword [0x141dd4158]
xor eax, dword [0x141dd415c]
imul eax, eax, 0x5d5e211b
add eax, 0xeb1cc01d
and eax, 0xe7bb7d1f
cmp eax, 0x7316174b
je 0x1400b89f0
mov eax, dword [0x141dd4160]
xor edx, edx
div dword [0x141dd4164]
xor eax, 0x6702eb2a
add eax, 0x15b3c0f1
imul rax, rax, 0x1a910a79
shr rax, 0x3c
cmp eax, 0x1ac7f839
jne 0x1400b8a4f
mov rcx, qword [0x141ddb260]
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [sym.imp.KERNEL32.dll_HeapFree]
nop word cs:[rax + rax]
mov eax, dword [0x141dd4168]
xor eax, dword [0x141dd416c]
imul ebp, eax, 0x3c6f7e30
add ebp, 0x4c0fcdb0
or ebp, 0x57f95756
mov rcx, qword [0x141ddb260]
xor edx, edx
mov r8, rdi
call rbx
cmp ebp, 0x2d8abd18
je 0x1400b8a60
xor eax, eax
test al, al
je 0x1400b8a9e
jmp 0x1400b8ad0
ud2
mov edi, dword [0x141dd4170]
xor edi, dword [0x141dd4174]
add edi, 0x1b3a7e3a
or edi, 0xaebd1fee
mov rcx, qword [0x141ddb260]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp edi, 0xcf40d6d1
jne 0x1400b8ae4
mov rcx, qword [0x141ddb260]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1400b8a9e
call qword [sym.imp.KERNEL32.dll_GetLastError]
movsxd rcx, eax
shl rcx, 0x20
or rcx, 2
nop word cs:[rax + rax]
mov eax, dword [0x141dd4178]
or eax, dword [0x141dd417c]
imul eax, eax, 0x8a408eb8
add eax, 0x43dc2479
xor eax, 0x558d2f78
cmp eax, 0xa9ea16fc
ja 0x1400b8b00
mov r8d, 1
nop dword [rax]
mov eax, dword [0x141dd4180]
xor edx, edx
div dword [0x141dd4184]
imul eax, eax, 0xcff650b9
cmp eax, 0x410900e8
je 0x1400b8b30
mov rax, r8
mov rdx, rcx
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret