Function at 0x1400bad80
Capabilities:
Create thread
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov rdi, r8
mov r14, rdx
mov rbx, rcx
mov eax, dword [0x141dd7800]
xor edx, edx
div dword [0x141dd7804]
imul rax, rax, 0x106473fb
shr rax, 0x3b
and eax, 0xfffffffe
cmp eax, 0x6771edf
ja 0x1400badf0
mov eax, dword [0x141dd7808]
imul eax, dword [0x141dd780c]
imul rcx, rax, 0xef7c93b
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1f
imul eax, eax, 0xed732e5c
or eax, 0x2cfe461e
movzx ecx, byte [0x141dde6f8]
cmp eax, 0x11c743a6
jae 0x1400badf9
movzx eax, byte [0x141dde6f8]
jmp 0x1400badb6
mov eax, dword [0x141dd7810]
add eax, dword [0x141dd7814]
or eax, 0x7defe375
cmp eax, 0x3fb3fefd
jne 0x1400bae1d
mov edx, 0x10
xor ecx, ecx
call fcn.1400c29b0
xor ebp, ebp
nop
mov edx, 0x10
xor ecx, ecx
call fcn.1400c29b0
test bpl, bpl
jne 0x1400bae20
mov rsi, rax
test rax, rax
je 0x1400bae47
mov qword [rsi], r14
xor eax, eax
test al, al
je 0x1400bae76
jmp 0x1400baecc
ud2
mov eax, dword [0x141dd7818]
xor edx, edx
div dword [0x141dd781c]
or eax, 0x95027890
and eax, 0xb58af991
imul r14, rax, 0x155122af
shr r14, 0x3b
mov qword [rsi + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x1400bbab0]
xor ecx, ecx
mov rdx, rbx
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp r14d, 0x5f771273
jbe 0x1400baefb
mov qword [rsi + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x1400bbab0]
xor ecx, ecx
mov rdx, rbx
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x1400bae76
mov rdx, rax
test rax, rax
je 0x1400baf0a
xor eax, eax
jmp 0x1400bb1d2
mov rdi, qword [rsi]
mov rbx, qword [rsi + 8]
nop word cs:[rax + rax]
mov eax, dword [0x141dd7828]
imul eax, dword [0x141dd782c]
imul eax, eax, 0x6dd0ef7f
add eax, 0x7901bcb3
cmp eax, 0x1e0f0795
jb 0x1400baf20
mov r14, qword [rbx]
nop word cs:[rax + rax]
mov eax, dword [0x141dd7830]
sub eax, dword [0x141dd7834]
imul eax, eax, 0xeee25819
and eax, 0xa1a977b
cmp eax, 0x9ae361da
je 0x1400baf50
test r14, r14
je 0x1400bafd0
xor eax, eax
test al, al
je 0x1400baf80
mov rcx, rdi
call r14
nop
mov eax, dword [0x141dd7838]
add eax, dword [0x141dd783c]
imul ebp, eax, 0x44c721a2
mov rcx, rdi
call r14
cmp ebp, 0x8f974030
je 0x1400baf80
mov eax, dword [0x141dd7840]
sub eax, dword [0x141dd7844]
and eax, 0xc12978e7
xor eax, 0x185a07b8
imul eax, eax, 0x9b5c66d3
cmp eax, 0x21c09146
jb 0x1400bafa0
nop word cs:[rax + rax]
mov eax, dword [0x141dd7848]
and eax, dword [0x141dd784c]
imul eax, eax, 0x50c538f
add eax, 0x4a0a5028
or eax, 0x15af3737
cmp eax, 0xc16fe13e
je 0x1400bafd0
nop word cs:[rax + rax]
mov eax, dword [0x141dd7850]
sub eax, dword [str._Pe]
imul eax, eax, 0x934bcb49
add eax, 0x4874f0d0
and eax, 0xc24e106b
cmp eax, 0x8fa728ec
je 0x1400bb000
mov rcx, qword [rbx + 8]
mov eax, dword [0x141dd7858]
xor edx, edx
div dword [0x141dd785c]
xor eax, eax
nop word [rax + rax]
test al, al
jne 0x1400bb040
test rcx, rcx
je 0x1400bb11f
mov rcx, qword [rbx + 0x10]
nop word cs:[rax + rax]
mov eax, dword [0x141dd7860]
add eax, dword [0x141dd7864]
imul eax, eax, 0xe5bb106a
add eax, 0x35b27242
or eax, 0x6056af52
cmp eax, 0x51b29ef
je 0x1400bb060
nop word cs:[rax + rax]
mov eax, dword [0x141dd7868]
xor edx, edx
div dword [0x141dd786c]
imul rax, rax, 0x2e7f378f
shr rax, 0x3d
or eax, 0xe0077a72
imul rax, rax, 0x56bdc5a1
shr rax, 0x3e
cmp eax, 0xeac3d97f
ja 0x1400bb090
cmp rcx, 0x11
jb 0x1400bb10d
mov eax, dword [0x141dd7870]
xor edx, edx
div dword [0x141dd7874]
nop word cs:[rax + rax]
mov eax, dword [0x141dd7878]
sub eax, dword [0x141dd787c]
imul eax, eax, 0xd1a917c8
add eax, 0xcfa0c578
imul rax, rax, 0x2e4f0275
shr rax, 0x3c
cmp eax, 0x2acc89
je 0x1400bb0e0
mov rdi, qword [rdi - 8]
mov rcx, qword [0x141dde6e0]
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [0x141dd7880]
xor eax, dword [0x141dd7884]
xor eax, 0xc04600
or eax, 0x8f1799bf
xor eax, 0xcbb5466c
cmp eax, 0x30240db5
jae 0x1400bb153
mov rcx, qword [0x141dde6e0]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, 0xdcb6a1a3
mov rbx, qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov r14d, dword [0x141dd7888]
and r14d, dword [0x141dd788c]
add r14d, 0xdd5410d7
or r14d, 0xad60eeb7
imul r14, rdi
shr r14, 0x3c
mov rcx, qword [0x141dde6e0]
xor edx, edx
mov r8, rsi
call rbx
cmp r14d, 0x1af09a08
ja 0x1400bb160
call qword [sym.imp.KERNEL32.dll_GetLastError]
movsxd rdx, eax
shl rdx, 0x20
or rdx, 2
nop dword [rax]
mov eax, dword [0x141dd7890]
and eax, dword [0x141dd7894]
and eax, 0x214aec8c
add eax, 0x57e40c16
cmp eax, 0xa16d431b
ja 0x1400bb1b0
mov eax, 1
xor ecx, ecx
nop word cs:[rax + rax]
test cl, cl
jne 0x1400bb1e0
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret