Function at 0x14019c0b0
Capabilities:
Create thread
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov rbx, r8
mov r14, rdx
mov rdi, rcx
mov eax, dword [0x1415a2dd0]
mov ecx, dword [0x1415a2dd4]
mov edx, eax
xor edx, ecx
not ecx
and ecx, eax
add ecx, ecx
sub ecx, edx
add ecx, 0x646fdcae
or ecx, 0xa7b6a531
cmp ecx, 0x60ffa76c
jae 0x14019c100
movzx eax, byte [0x1415acbd0]
nop word cs:[rax + rax]
mov eax, dword [0x1415a2dd8]
add eax, dword [0x1415a2ddc]
imul rax, rax, 0x4b2f1f69
shr rax, 0x3c
mov ecx, eax
and ecx, 0xfffffffd
add ecx, ecx
neg ecx
add eax, ecx
add eax, 0xbf4c48e5
or eax, 0xe563d6cd
movzx ecx, byte [0x1415acbd0]
cmp eax, 0x88395670
je 0x14019c100
mov edx, 0x10
xor ecx, ecx
call fcn.14020ae90
mov rsi, rax
mov eax, dword [0x1415a2de0]
xor edx, edx
div dword [0x1415a2de4]
nop word [rax + rax]
mov eax, dword [0x1415a2de8]
add eax, dword [0x1415a2dec]
or eax, 0xeee70f87
imul eax, eax, 0x58e603e9
and eax, 0xfffffffc
xor eax, 0x6c084840
cmp eax, 0x5dedd642
je 0x14019c160
test rsi, rsi
je 0x14019c1dd
mov eax, dword [0x1415a2df0]
mov ecx, dword [0x1415a2df4]
mov edx, eax
not edx
and edx, ecx
not edx
not ecx
and ecx, eax
not ecx
and ecx, edx
not ecx
mov eax, ecx
and eax, 0x2ae7ae07
add eax, eax
sub ecx, eax
imul eax, ecx, 0x4a5499da
add eax, 0x209860f6
mov ecx, 0x9115ab41
imul rcx, rax
shr rcx, 0x3c
cmp ecx, 0x88a44782
jne 0x14019c2ac
jmp 0x14019c2ed
mov eax, dword [0x1415a2e10]
sub eax, dword [0x1415a2e14]
or eax, 0xfec3b963
imul rax, rax, 0x4352e10b
shr rax, 0x3e
add eax, 0xd3f4e25f
cmp eax, 0xca59134a
jae 0x14019c210
ud2
mov eax, dword [0x1415a2e18]
xor eax, dword [0x1415a2e1c]
add eax, 0x9c162b10
mov ecx, eax
not ecx
and ecx, 0x6d6fee27
mov edx, eax
and edx, 0x929011d8
imul edx, ecx
mov ecx, eax
and ecx, 0x6d6fee27
or eax, 0x6d6fee27
imul eax, ecx
add eax, edx
ud2
mov eax, dword [0x1415a2df8]
mov ecx, dword [0x1415a2dfc]
mov edx, ecx
not edx
mov r8d, eax
and r8d, edx
or edx, eax
not edx
imul edx, r8d
mov r8d, eax
and r8d, ecx
or eax, ecx
imul eax, r8d
add eax, edx
imul eax, eax, 0xf45d0c11
add eax, 0xdfc6a0c4
mov qword [rsi], r14
cmp eax, 0xafebd14c
jae 0x14019c2f2
mov qword [rsi], r14
jmp 0x14019c2ac
mov qword [rsi + 8], rbx
mov eax, dword [0x1415a2e00]
sub eax, dword [0x1415a2e04]
mov ecx, 0xa3ccc743
imul rcx, rax
shr rcx, 0x3e
mov eax, ecx
not eax
and eax, 0x7e21d1bd
mov edx, ecx
and edx, 0xfffffffe
imul edx, eax
mov eax, ecx
and eax, 1
or ecx, 0x7e21d1bd
imul ecx, eax
add ecx, edx
mov eax, 0xaede7151
imul rax, rcx
shr rax, 0x3f
cmp eax, 0x2cd609fb
jbe 0x14019c36a
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x1401a0460]
xor ecx, ecx
mov rdx, rdi
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rbx, [0x1401a0460]
mov r14, qword [sym.imp.KERNEL32.dll_CreateThread]
nop dword [rax + rax]
mov eax, dword [0x1415a2e08]
xor edx, edx
div dword [0x1415a2e0c]
mov ebp, eax
xor ebp, 0xd720a20
xor eax, 0x4f72efa2
and ebp, 0x1dff1a78
add ebp, ebp
sub ebp, eax
mov eax, ebp
not eax
and eax, 0x391e77cf
mov ecx, ebp
and ecx, 0xc6e18830
imul ecx, eax
mov eax, ebp
and eax, 0x391e77cf
or ebp, 0x391e77cf
imul ebp, eax
add ebp, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
xor ecx, ecx
mov rdx, rdi
mov r8, rbx
mov r9, rsi
call r14
cmp ebp, 0x861b2d3f
jb 0x14019c380
mov rcx, rax
test rax, rax
je 0x14019c410
xor eax, eax
jmp 0x14019c7f0
mov eax, dword [0x1415a2e28]
mov ecx, dword [0x1415a2e2c]
add eax, ecx
add eax, 0xdc67bef9
xor eax, 0x57d48606
cmp eax, 0x1e7be9b6
je 0x14019c410
mov rdi, qword [rsi]
nop word cs:[rax + rax]
mov eax, dword [0x1415a2e30]
xor edx, edx
div dword [0x1415a2e34]
or eax, 0x87bcd74f
mov ecx, eax
and ecx, 0x2aee655
add ecx, ecx
sub eax, ecx
cmp eax, 0xa81335ab
je 0x14019c440
mov rbx, qword [rsi + 8]
nop word [rax + rax]
mov eax, dword [0x1415a2e38]
xor edx, edx
div dword [0x1415a2e3c]
not eax
or eax, 0xe94fa798
cmp eax, 0x8efb9a94
je 0x14019c470
mov r14, qword [rbx]
test r14, r14
je 0x14019c555
mov eax, dword [0x1415a2e40]
or eax, dword [0x1415a2e44]
or eax, 0xfcb4c818
mov ecx, 0x8ce71651
imul rcx, rax
shr rcx, 0x3f
imul eax, ecx, 0x6dc86b16
cmp eax, 0xd5a3fef0
je 0x14019c4fe
mov eax, dword [0x1415a2e48]
sub eax, dword [0x1415a2e4c]
mov ecx, eax
and ecx, 0x386c37c8
add ecx, ecx
neg ecx
lea ebp, [rax + rcx]
add ebp, 0xb86c37c8
xor ebp, 0x45703007
or ebp, 0xaa8bc6f8
mov rcx, rdi
call r14
cmp ebp, 0x26ba516e
jae 0x14019c506
mov rcx, rdi
call r14
jmp 0x14019c4c3
mov eax, 0xf0f4b539
nop dword [rax + rax]
mov ecx, dword [0x1415a2e50]
mov edx, dword [0x1415a2e54]
mov r8d, ecx
not r8d
and ecx, edx
not edx
or edx, r8d
not ecx
and ecx, edx
not ecx
imul rcx, rax
shr rcx, 0x3e
add ecx, 0x6ac3e076
mov edx, ecx
xor edx, 0xdec5fbad
or ecx, 0x20020052
and ecx, edx
cmp ecx, 0xf67282ba
ja 0x14019c510
mov eax, 0x88d63a13
nop word [rax + rax]
mov ecx, dword [0x1415a2e5c]
mov edx, ecx
xor edx, edx
not edx
and edx, dword [0x1415a2e58]
xor edx, ecx
add edx, 0xb41b5cba
or edx, 0xece20cd
imul rdx, rax
shr rdx, 0x3e
cmp edx, 0x4f01ec65
ja 0x14019c560
mov eax, dword [0x1415a2e60]
mov ecx, dword [0x1415a2e64]
mov edx, ecx
not edx
mov r8d, eax
and r8d, edx
or edx, eax
not edx
imul edx, r8d
mov r8d, eax
and r8d, ecx
or eax, ecx
imul eax, r8d
add eax, edx
cmp eax, 0x744592a0
je 0x14019c590
mov rax, qword [rbx + 8]
nop word [rax + rax]
mov ecx, dword [0x1415a2e68]
mov edx, dword [0x1415a2e6c]
mov r8d, edx
not r8d
and r8d, ecx
xor edx, ecx
add edx, ecx
sub edx, r8d
mov ecx, edx
and ecx, 0x23abd0b
xor ecx, 0x21abc0a
and edx, 0x21abc0a
or edx, ecx
add edx, 0x85e9182c
cmp edx, 0x519e045a
jb 0x14019c5d0
test rax, rax
je 0x14019c707
mov rax, qword [rbx + 0x10]
nop dword [rax]
mov ecx, dword [0x1415a2e70]
mov edx, dword [0x1415a2e74]
mov r8d, ecx
xor r8d, edx
not r8d
or ecx, edx
and ecx, r8d
add ecx, 0xa677c933
mov edx, ecx
xor edx, 0xe6ce5fdd
xor ecx, 0x19302000
or ecx, 0x620f9f6f
add ecx, edx
inc ecx
cmp ecx, 0x40c96870
ja 0x14019c620
cmp rax, 0x11
jb 0x14019c69e
mov rdi, qword [rdi - 8]
nop word [rax + rax]
mov eax, dword [0x1415a2e78]
mov ecx, dword [0x1415a2e7c]
not eax
not ecx
or ecx, eax
not ecx
or ecx, 0x73ef31b2
add ecx, 0x1a243475
or ecx, 0x823ff9ba
cmp ecx, 0x83b5b17c
jb 0x14019c670
mov eax, dword [0x1415a2e80]
imul eax, dword [0x1415a2e84]
or eax, 0xe2597a84
cmp eax, 0xdd85e009
je 0x14019c6f3
mov eax, dword [0x1415a2e88]
xor edx, edx
div dword [0x1415a2e8c]
shr eax, 7
imul rax, rax, 0x104e9f7
shr rax, 0x31
imul ebx, eax, 0x4d827a6c
mov rcx, qword [0x1415acb98]
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp ebx, 0x4f679a68
jne 0x14019c707
mov rcx, qword [0x1415acb98]
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x14019c6b7
mov rcx, qword [0x1415acb98]
xor edx, edx
mov r8, rsi
call fcn.14020ae70
call fcn.14020b260
mov ecx, eax
mov eax, dword [0x1415a2e90]
xor edx, edx
div dword [0x1415a2e94]
shl rcx, 0x20
nop word cs:[rax + rax]
mov eax, dword [0x1415a2e98]
and eax, dword [0x1415a2e9c]
add eax, 0x7d9be09d
mov edx, eax
not edx
and edx, 0x9b257386
and eax, 0x64da8c79
sub eax, edx
mov edx, eax
xor edx, 0xabd0f77
and edx, eax
cmp edx, 0x4f251b82
je 0x14019c740
or rcx, 2
nop dword [rax + rax]
mov eax, dword [0x1415a2ea0]
mov edx, eax
not edx
or edx, dword [0x1415a2ea4]
add eax, edx
inc eax
mov edx, eax
not edx
and edx, 0x2ab495b0
mov r8d, eax
and r8d, 0xd54b6a4f
imul r8d, edx
mov edx, eax
and edx, 0x2ab495b0
or eax, 0x2ab495b0
imul eax, edx
add eax, r8d
mov edx, eax
not edx
or edx, 0x90594ca
and edx, 0xc995bcea
and eax, 0x20004010
or eax, edx
cmp eax, 0xe3b64fb2
ja 0x14019c780
mov eax, 1
nop word cs:[rax + rax]
mov edx, dword [0x1415a2ea8]
xor edx, dword [0x1415a2eac]
imul edx, edx, 0x9e422156
add edx, 0xd974c0b9
cmp edx, 0xcc106794
jb 0x14019c7f0
mov rdx, rcx
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret