Function at 0x180003390
Capabilities:
Create thread
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbp
push r14
lea rbp, [rax - 0x28]
sub rsp, 0x118
mov r14, rcx
cmp edx, 1
jne 0x180003701
mov rcx, qword [0x18008e5e8]
mov qword [rax + 0x10], rbx
mov qword [rax - 0x18], rsi
mov qword [rax - 0x20], rdi
test rcx, rcx
jne 0x180003568
mov qword [rax - 0x28], r12
movabs rsi, 0x7764417e5141f194
mov qword [rax - 0x30], r13
movabs rbx, 0x1212280d342995f5
mov qword [rax - 0x38], r15
movabs rdi, 0x9f6e7e6081c80b0e
movabs r15, 0x9f6e7e60eda46f20
movabs r12, 0x3f7c4d775d5dfc96
movabs r13, 0xfa0d0c15eebb6e7c
movabs r14, 0xd6b59e21633e8324
nop
mov qword [rbp + 0x48], rsi
lea rcx, [rsp + 0x30]
mov rax, qword [rbp + 0x48]
mov qword [rsp + 0x30], rax
mov qword [rbp + 0x48], r15
mov rax, qword [rbp + 0x48]
mov qword [rsp + 0x38], rax
mov qword [rbp + 0x48], rbx
mov rax, qword [rbp + 0x48]
mov qword [rsp + 0x60], rax
mov qword [rbp + 0x48], rdi
mov rax, qword [rbp + 0x48]
movdqa xmm0, xmmword [rsp + 0x30]
mov qword [rsp + 0x68], rax
pxor xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x30], xmm0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [0x18008e5e8], rax
lea rcx, [rsp + 0x40]
mov qword [rbp + 0x48], r12
mov rax, qword [rbp + 0x48]
mov qword [rsp + 0x40], rax
mov qword [rbp + 0x48], r13
mov rax, qword [rbp + 0x48]
mov qword [rsp + 0x48], rax
mov qword [rbp + 0x48], r14
mov rax, qword [rbp + 0x48]
mov qword [rsp + 0x50], rax
movabs rax, 0x4e398696e8b625bc
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rbp + 0x48], rbx
mov rax, qword [rbp + 0x48]
mov qword [rsp + 0x70], rax
mov qword [rbp + 0x48], rdi
mov rax, qword [rbp + 0x48]
mov qword [rsp + 0x78], rax
movabs rax, 0xb29bfb530c5dae57
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
mov qword [rbp - 0x80], rax
movabs rax, 0x4e398696e8b649d0
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
movdqa xmm0, xmmword [rsp + 0x40]
movdqa xmm1, xmmword [rsp + 0x50]
pxor xmm0, xmmword [rsp + 0x70]
mov qword [rbp - 0x78], rax
pxor xmm1, xmmword [rbp - 0x80]
movdqa xmmword [rsp + 0x50], xmm1
movdqa xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, 0x1e
mov qword [0x18008e5c8], rax
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x18008e5e8]
test rcx, rcx
je 0x180003420
mov r14, qword [rbp + 0x30]
mov r15, qword [rsp + 0xf0]
mov r13, qword [rsp + 0xf8]
mov r12, qword [rsp + 0x100]
add rcx, qword [0x18008e7d0]
lea rbx, [0x180001410]
mov r8d, 0x30
mov qword [0x18008e5b0], rcx
lea rdx, [rbp - 0x40]
mov qword [0x18008e5d0], rcx
mov qword [0x18008e598], rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1800035ff
mov r8d, 0x30
lea rdx, [rbp - 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1800035ff
mov rax, qword [rbp - 0x70]
cmp qword [rbp - 0x40], rax
je 0x1800035ff
lea rdx, [0x180001330]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
mov qword [0x18008e5d8], rax
test rax, rax
je 0x1800035ff
mov rcx, qword [0x18008e5d0]
lea r9, [0x18008e5e0]
mov edx, 1
mov r8d, 0x120
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [0x18008b048]
lea rdi, [0x18008b038]
mov qword [0x18008e5a8], r14
cmp rcx, 0x104
jb 0x180003644
cmp qword [0x18008b050], 0x10
mov rax, rdi
mov qword [0x18008b048], 0x104
cmovae rax, qword [0x18008b038]
mov byte [rax + 0x104], 0
jmp 0x1800036a8
mov rdx, qword [0x18008b050]
mov esi, 0x104
mov rax, rdx
sub rsi, rcx
sub rax, rcx
cmp rsi, rax
ja 0x18000368e
cmp rdx, 0x10
mov qword [0x18008b048], 0x104
mov rbx, rdi
mov r8, rsi
cmovae rbx, qword [0x18008b038]
xor edx, edx
add rbx, rcx
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
mov byte [rbx + rsi], 0
jmp 0x1800036a8
mov r9, rsi
mov byte [rsp + 0x20], 0
mov rdx, rsi
mov rcx, rdi
call fcn.180003d70
mov r14, qword [0x18008e5a8]
cmp qword [0x18008b050], 0x10
mov r8d, 0x104
mov rcx, r14
cmovae rdi, qword [0x18008b038]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor eax, eax
lea r8, [0x180002ee0]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, qword [rsp + 0x108]
mov rsi, qword [rsp + 0x110]
mov rbx, qword [rsp + 0x138]
mov eax, 1
add rsp, 0x118
pop r14
pop rbp
ret