Function at 0x1800161b0
Capabilities:
Accept command line arguments
Create thread
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x198]
sub rsp, 0x280
mov rax, qword [0x18004a010]
xor rax, rsp
mov qword [rbp + 0x170], rax
lea rcx, [0x180178dd8]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x180178d88]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x180178db0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x38], 8
mov qword [0x180178e00], rax
mov dword [rsp + 0x3c], 5
call qword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
call sym.mi.dll_BT_InstallSehFilter
xor edi, edi
lea rcx, [rsp + 0x60]
xor edx, edx
mov dword [0x180178e08], edi
mov r8d, 0x208
call fcn.180023140
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [rsp + 0x30], 2
mov rbx, rax
jne 0x180016401
mov r8d, 0x104
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x180016401
xor eax, eax
mov dword [rsp + 0x40], 0xddc3dddf
mov word [rsp + 0x58], ax
mov edx, edi
mov dword [rsp + 0x44], 0xddd1ddcc
mov esi, 0x2246
mov dword [rsp + 0x48], 0xddcdddd1
mov dword [rsp + 0x4c], 0xddb3dda5
mov dword [rsp + 0x50], 0xdda6ddec
mov dword [rsp + 0x54], 0xdda0ddbc
movsxd rcx, edx
movzx eax, dx
sub ax, si
inc edx
xor word [rsp + rcx*2 + 0x40], ax
cmp edx, 0xc
jb 0x1800162da
lea rax, [rsp + 0x60]
mov word [rsp + 0x58], di
lea r8, [rsp + 0x40]
sub r8, rax
movzx ecx, word [rax]
movzx edx, word [rax + r8]
sub ecx, edx
jne 0x180016315
add rax, 2
test edx, edx
jne 0x180016301
test ecx, ecx
je 0x180016401
mov dword [rsp + 0x40], 0xddc8ddcd
mov edx, edi
mov dword [rsp + 0x44], 0xddcdddd1
mov dword [rsp + 0x48], 0xddd0ddcc
mov dword [rsp + 0x4c], 0xdda9ddb6
mov dword [rsp + 0x50], 0xddb0ddad
mov dword [rsp + 0x54], 0xddebddb0
mov dword [rsp + 0x58], 0xddbfdda3
mov dword [rsp + 0x5c], 0xddad
movsxd rcx, edx
movzx eax, dx
sub ax, si
inc edx
xor word [rsp + rcx*2 + 0x40], ax
cmp edx, 0xf
jb 0x18001635f
lea rdx, [rsp + 0x40]
mov word [rsp + 0x5e], di
lea rcx, [rsp + 0x60]
call fcn.180022e60
test rax, rax
je 0x180016401
mov dword [rsp + 0x40], 0xddd6dddf
mov edx, edi
mov dword [rsp + 0x44], 0xddd8ddde
mov dword [rsp + 0x48], 0xdddbddda
mov dword [rsp + 0x4c], 0xddafdda9
mov dword [rsp + 0x50], 0xdda5
movsxd rcx, edx
movzx eax, dx
sub ax, si
inc edx
xor word [rsp + rcx*2 + 0x40], ax
cmp edx, 9
jb 0x1800163b7
mov rcx, qword [rbx + 8]
lea rdx, [rsp + 0x40]
mov word [rsp + 0x52], di
call fcn.180022e60
test rax, rax
je 0x180016401
mov qword [rsp + 0x28], rdi
lea r8, [0x1800155fc]
xor r9d, r9d
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.180021cb0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret