Function at 0x14003cf90
Capabilities:
Create thread
Encode data using xor
Generate random numbers using a mersenne twister
Resume thread

Disassembly:
push rbx
push rbp
push rdi
mov eax, 0x18b0
call fcn.140191300
sub rsp, rax
mov rax, qword [0x140221880]
xor rax, rsp
mov qword [rsp + 0x1890], rax
cmp byte [0x140328aea], 0
mov rbx, rdx
mov rdi, rcx
je 0x14003d077
mov rdx, qword [rcx + 0x18]
cmp rdx, 0xf
jbe 0x14003d000
mov rcx, qword [rcx]
inc rdx
cmp rdx, 0x1000
jb 0x14003cffb
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003d325
mov rcx, r8
call fcn.140190a2c
xor ebp, ebp
mov qword [rdi + 0x10], rbp
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], bpl
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x14003d04b
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x14003d046
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003d325
mov rcx, r8
call fcn.140190a2c
mov qword [rbx + 0x10], rbp
xor al, al
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], bpl
mov rcx, qword [rsp + 0x1890]
xor rcx, rsp
call fcn.140190770
add rsp, 0x18b0
pop rdi
pop rbp
pop rbx
ret
mov qword [rsp + 0x18e0], rsi
mov qword [rsp + 0x18a8], r14
mov qword [rsp + 0x18a0], r15
call fcn.1401921e4
mov dword [rsp + 0x504], eax
mov edx, 1
mov r9d, 0x270
mov dword [rsp + 0x1884], 0xffffffff
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rsp + rdx*4 + 0x504], eax
inc rdx
cmp rdx, r9
jb 0x14003d0b1
mov dword [rsp + 0x500], r9d
lea r8, [rsp + 0x508]
mov byte [0x140328aea], 1
nop word [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x14003d0f0
mov eax, dword [rsp + 0x500]
xor ebp, ebp
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], 4
mov ecx, dword [rsp + rax*4 + 0x504]
mov eax, ecx
shr eax, 0xb
and eax, dword [rsp + 0x1884]
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor ecx, eax
mov eax, 0xdb820137
mul ecx
shr edx, 0x1b
imul eax, edx, 0x9547879
xor edx, edx
sub ecx, eax
mov r8d, ecx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x60], 0x10001f
mov rcx, rax
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
lea r14, [0x140322a88]
lea rax, [0x14003cf50]
mov qword [rsp + 0xb0], rax
cmp r14, rdi
je 0x14003d215
cmp qword [rdi + 0x18], 0xf
mov r9, rdi
mov rsi, qword [rdi + 0x10]
jbe 0x14003d1d7
mov r9, qword [rdi]
mov rax, qword [reloc.WS2_32.dll_ntohs]
cmp rsi, rax
ja 0x14003d20a
cmp rax, 0xf
mov qword [0x140322a98], rsi
mov r8, rsi
mov rdx, r9
cmova r14, qword [0x140322a88]
mov rcx, r14
call fcn.1401d15a0
mov byte [r14 + rsi], bpl
jmp 0x14003d215
mov rdx, rsi
mov rcx, r14
call fcn.1400ff8b0
lea rsi, [0x140322a68]
cmp rsi, rbx
je 0x14003d270
cmp qword [rbx + 0x18], 0xf
mov r9, rbx
mov r14, qword [rbx + 0x10]
jbe 0x14003d232
mov r9, qword [rbx]
mov rax, qword [reloc.WS2_32.dll_ntohs]
cmp r14, rax
ja 0x14003d265
cmp rax, 0xf
mov qword [0x140322a78], r14
mov r8, r14
mov rdx, r9
cmova rsi, qword [0x140322a68]
mov rcx, rsi
call fcn.1401d15a0
mov byte [r14 + rsi], bpl
jmp 0x14003d270
mov rdx, r14
mov rcx, rsi
call fcn.1400ff8b0
lea rdx, [rsp + 0x30]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, 0x1964
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
lea rcx, str.9548646
mov rdx, qword [reloc.WS2_32.dll_getsockopt]
lea r9, [0x1401fe228]
cmova rcx, qword [str.9548646]
mov qword [rsp + 0x20], 3
call fcn.1400fe3b0
mov r15, qword [rsp + 0x18a0]
mov r14, qword [rsp + 0x18a8]
mov rsi, qword [rsp + 0x18e0]
cmp rax, 0xffffffffffffffff
je 0x14003d32b
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x14003d002
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x14003d31b
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003d325
mov rcx, r8
call fcn.140190a2c
jmp 0x14003d002
call fcn.1401ac538
int3
mov ecx, 1
call fcn.1401ac890
int3