Function at 0x180002a80
Capabilities:
Create thread
Encode data using xor

Disassembly:
push rbx
push rdi
sub rsp, 0x48
xor ecx, ecx
call qword [sym.imp.MSVCR90.dll__time64]
mov rcx, rax
call qword [sym.imp.MSVCR90.dll_srand]
mov edi, 4
nop dword [rax]
call qword [sym.imp.MSVCR90.dll_rand]
sub rdi, 1
jne 0x180002aa0
call qword [sym.imp.MSVCR90.dll_rand]
mov ebx, eax
imul ebx, ebx, 0x1d
call qword [sym.imp.MSVCR90.dll_rand]
add ebx, eax
mov eax, 0x431bde83
imul ebx
sar edx, 0x12
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0xf4240
sub ebx, edx
cmp ebx, 0xf4240
jl 0x180002ae6
sub ebx, 0xf4240
cmp ebx, 0x186a0
jge 0x180002afb
call qword [sym.imp.MSVCR90.dll_rand]
lea ebx, [rbx + rax + 0x186a0]
mov rcx, qword [0x18000b488]
or edx, 0xffffffff
mov dword [0x18000b43c], ebx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
or rcx, 0xffffffffffffffff
xor eax, eax
lea r8, str.224269_6:_8__C
xor ebx, ebx
mov rdi, r8
repne scasb al, byte [rdi]
not rcx
lea rdi, [rcx - 1]
mov ecx, ebx
test edi, edi
jle 0x180002b4b
mov eax, ecx
inc r8
cdq
and eax, 1
xor eax, edx
sub eax, edx
add al, cl
inc ecx
sub byte [r8 - 1], al
cmp ecx, edi
jl 0x180002b32
or rcx, 0xffffffffffffffff
xor eax, eax
lea r8, str.a5355:66kyw
mov rdi, r8
repne scasb al, byte [rdi]
not rcx
lea rdi, [rcx - 1]
mov ecx, ebx
test edi, edi
jle 0x180002b89
nop word [rax + rax]
mov eax, ecx
inc r8
cdq
and eax, 1
xor eax, edx
sub eax, edx
add al, cl
inc ecx
sub byte [r8 - 1], al
cmp ecx, edi
jl 0x180002b70
mov rcx, qword [0x18000b488]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
call fcn.180002eb0
lea rdx, [0x18000b368]
mov qword [rsp + 0x20], rdx
lea rdx, [0x18000b490]
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call fcn.180003af0
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x28], rdx
lea r8, [0x180004050]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x180002bf9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x68]
lea r8, [0x180001a70]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x180002c29
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x70]
lea r8, [0x180004490]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x180002c59
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x78]
lea r8, [0x180004dd0]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x180002c89
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x30]
lea r8, [0x1800055f0]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x180002cb9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x34]
lea r8, [0x180005e00]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x180002ce9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x48
pop rdi
pop rbx
ret