Function at 0x1400bf070
Capabilities:
Create thread
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov rdi, r8
mov r14, rdx
mov rbx, rcx
mov eax, dword [0x141f41f38]
add eax, dword [0x141f41f3c]
imul eax, eax, 0xdea8e27a
cmp eax, 0xd1e7991d
je 0x1400bf0c6
mov eax, dword [0x141f41f40]
imul eax, dword [0x141f41f44]
add eax, 0x39219746
or eax, 0x2415de0d
and eax, 0x3535df4f
movzx ecx, byte [0x141f49078]
cmp eax, 0x72f3be01
jbe 0x1400bf0cf
movzx eax, byte [0x141f49078]
jmp 0x1400bf09c
mov edx, 0x10
xor ecx, ecx
call fcn.1400c6170
test rax, rax
je 0x1400bf0eb
mov rsi, rax
xor eax, eax
test al, al
je 0x1400bf11a
jmp 0x1400bf123
ud2
mov qword [rsi], r14
xor eax, eax
test al, al
je 0x1400bf128
mov qword [rsi], r14
jmp 0x1400bf11a
xor eax, eax
test al, al
jne 0x1400bf17d
mov eax, dword [0x141f41f48]
add eax, dword [0x141f41f4c]
and eax, 0x666eda64
imul ebp, eax, 0x4bdb2fa0
add ebp, 0xdaf8bc60
mov qword [rsi + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x1400bfdf0]
xor ecx, ecx
mov rdx, rbx
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp ebp, 0x7e385494
jae 0x1400bf1a9
mov qword [rsi + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x1400bfdf0]
xor ecx, ecx
mov rdx, rbx
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x1400bf12e
mov rcx, rax
nop dword [rax]
mov eax, dword [0x141f41f50]
xor edx, edx
div dword [0x141f41f54]
add eax, 0x15bc23df
or eax, 0x41612c53
add eax, 0xec377cfc
cmp eax, 0xbf61986b
ja 0x1400bf1b0
test rcx, rcx
je 0x1400bf1e0
xor eax, eax
jmp 0x1400bf440
mov rdi, qword [rsi]
mov rbx, qword [rsi + 8]
mov eax, dword [0x141f41f60]
xor edx, edx
div dword [0x141f41f64]
mov eax, 0xd1578f2d
nop word [rax + rax]
mov ecx, dword [0x141f41f68]
or ecx, dword [0x141f41f6c]
add ecx, 0x820d60ac
imul rcx, rax
shr rcx, 0x3d
cmp ecx, 0x7e9192fc
je 0x1400bf200
mov r14, qword [rbx]
xor eax, eax
nop word [rax + rax]
test al, al
jne 0x1400bf230
test r14, r14
je 0x1400bf2c0
mov eax, dword [0x141f41f70]
xor eax, dword [0x141f41f74]
xor eax, 0xe1b5ea63
imul rax, rax, 0x6891bd2d
shr rax, 0x3e
cmp eax, 0x3bf8e51e
jne 0x1400bf270
mov rcx, rdi
call r14
nop word cs:[rax + rax]
mov ebp, dword [0x141f41f78]
sub ebp, dword [0x141f41f7c]
mov rcx, rdi
call r14
cmp ebp, 0xcfd85341
je 0x1400bf270
nop word [rax + rax]
mov eax, dword [0x141f41f80]
or eax, dword [0x141f41f84]
and eax, 0xcdcc5233
imul rax, rax, 0xdbf2f8b
shr rax, 0x39
or eax, 0xda07ca18
cmp eax, 0x446b379c
jb 0x1400bf290
nop dword [rax + rax]
mov eax, dword [0x141f41f88]
and eax, dword [0x141f41f8c]
or eax, 0x45c008e8
and eax, 0x57db08e8
xor eax, 0xf410e9b6
cmp eax, 0xe424a8ea
ja 0x1400bf2c0
mov rcx, qword [rbx + 8]
nop word cs:[rax + rax]
mov eax, dword [0x141f41f90]
and eax, dword [0x141f41f94]
or eax, 0x18000040
xor eax, 0x501100
and eax, 0x1854d5c1
cmp eax, 0xf5163240
ja 0x1400bf2f0
mov rax, qword [rbx + 0x10]
xor edx, edx
nop dword [rax + rax]
test dl, dl
jne 0x1400bf320
test rcx, rcx
je 0x1400bf3a3
nop dword [rax]
mov ecx, dword [0x141f41f98]
xor ecx, dword [0x141f41f9c]
and ecx, 0x48e12241
xor ecx, 0xc8c82049
or ecx, 0x2714d996
cmp ecx, 0x29084fe1
jb 0x1400bf330
cmp rax, 0x11
jb 0x1400bf391
mov ecx, 0xe8b4e28d
nop word cs:[rax + rax]
mov eax, dword [0x141f41fa0]
xor edx, edx
div dword [0x141f41fa4]
imul rax, rcx
shr rax, 0x3a
cmp eax, 0x848965fd
je 0x1400bf370
mov rdi, qword [rdi - 8]
mov rcx, qword [0x141f49060]
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [0x141f41fa8]
and eax, dword [0x141f41fac]
imul eax, eax, 0xc72c9e2e
add eax, 0x395650b8
xor eax, 0x9d8e2d5c
cmp eax, 0x4b346268
jb 0x1400bf3ea
mov eax, dword [0x141f41fb0]
and eax, dword [0x141f41fb4]
and eax, 0x14128076
add eax, 0x9f04fff4
mov rcx, qword [0x141f49060]
cmp eax, 0x64436c4b
jae 0x1400bf3f3
mov rax, qword [0x141f49060]
jmp 0x1400bf3c6
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
shl rcx, 0x20
or rcx, 2
nop
mov eax, dword [0x141f41fb8]
xor edx, edx
div dword [0x141f41fbc]
imul eax, eax, 0xd7bf8459
and eax, 0xbed5257d
add eax, 0x9e817cad
cmp eax, 0x3acf9fe4
jb 0x1400bf410
mov eax, 1
nop word [rax + rax]
mov edx, dword [0x141f41fc0]
and edx, dword [0x141f41fc4]
or edx, 0xffe67fed
cmp edx, 0xd4b9b9d2
jb 0x1400bf440
mov rdx, rcx
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret