Function at 0x1400ecad0
Capabilities:
Create thread
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0xd0
mov rax, qword [0x14015d040]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor edi, edi
mov word [rsp + 0x60], 0x60
mov byte [rsp + 0x62], dil
lea rax, [rsp + 0x60]
mov rbx, 0xffffffffffffffff
mov rcx, rbx
inc rcx
cmp byte [rax + rcx], 0
jne 0x1400ecb17
mov rdx, qword [0x1401674f0]
movabs rsi, 0x7fffffffffffffff
mov rax, rsi
sub rax, rdx
cmp rax, rcx
jb 0x1400ed0d2
lea rax, [0x1401674e0]
cmp qword [0x1401674f8], 0xf
cmova rax, qword [0x1401674e0]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.14002d380
lea rdx, [rsp + 0x40]
lea rcx, [0x1401671b0]
call fcn.14002a540
lea rcx, [rsp + 0x40]
call fcn.14002b140
mov word [rsp + 0x60], 0x60
mov byte [rsp + 0x62], 0
lea rax, [rsp + 0x60]
mov rcx, rbx
inc rcx
cmp byte [rax + rcx], 0
jne 0x1400ecba4
mov rdx, qword [0x140167550]
mov rax, rsi
sub rax, rdx
cmp rax, rcx
jb 0x1400ed0d7
lea rax, [0x140167540]
cmp qword [0x140167558], 0xf
cmova rax, qword [0x140167540]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.14002d380
lea rdx, [rsp + 0x40]
lea rcx, [0x140167210]
call fcn.14002a540
lea rcx, [rsp + 0x40]
call fcn.14002b140
lea rdx, [0x1401671b0]
lea rcx, [rsp + 0xa0]
call fcn.14002a640
nop
lea rdx, [0x140167210]
lea rcx, [rsp + 0x80]
call fcn.14002a640
nop
xor eax, eax
mov word [rsp + 0x60], ax
lea rcx, [rsp + 0x60]
mov rax, rbx
nop dword [rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x1400ecc50
lea rcx, [0x140167560]
cmp qword [0x140167578], 0xf
cmova rcx, qword [0x140167560]
mov r8, qword [0x140167570]
cmp r8, rax
jne 0x1400eceed
lea rdx, [rsp + 0x60]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400eceed
xor eax, eax
mov word [rsp + 0x60], ax
lea rcx, [rsp + 0x60]
mov rax, rbx
inc rax
cmp byte [rcx + rax], 0
jne 0x1400ecca1
lea rcx, [0x140167330]
cmp qword [0x140167348], 0xf
cmova rcx, qword [0x140167330]
mov r8, qword [0x140167340]
cmp r8, rax
jne 0x1400eceed
lea rdx, [rsp + 0x60]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400eceed
xor eax, eax
mov word [rsp + 0x60], ax
lea rcx, [rsp + 0x60]
mov rax, rbx
inc rax
cmp byte [rcx + rax], 0
jne 0x1400eccf2
lea rcx, [0x1401675a0]
cmp qword [0x1401675b8], 0xf
cmova rcx, qword [0x1401675a0]
mov r8, qword [0x1401675b0]
cmp r8, rax
jne 0x1400eceed
lea rdx, [rsp + 0x60]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400eceed
xor eax, eax
mov word [rsp + 0x60], ax
lea rcx, [rsp + 0x60]
mov rax, rbx
inc rax
cmp byte [rcx + rax], 0
jne 0x1400ecd43
lea rcx, [0x1401672d0]
cmp qword [0x1401672e8], 0xf
cmova rcx, qword [0x1401672d0]
mov r8, qword [0x1401672e0]
cmp r8, rax
jne 0x1400eceed
lea rdx, [rsp + 0x60]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400eceed
movdqa xmm0, xmmword [0x140138610]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x50], 0x100
mov rcx, rdi
nop dword [rax]
lea eax, [rcx - 0x2b]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 0x10
jb 0x1400ecda0
mov byte [rsp + 0x51], 0
lea rax, [rsp + 0x40]
mov rcx, rbx
nop dword [rax]
inc rcx
cmp byte [rax + rcx], 0
jne 0x1400ecdc0
mov rax, rsi
mov rdx, qword [rsp + 0xb0]
sub rax, rdx
cmp rax, rcx
jb 0x1400ed0dd
lea r9, [rsp + 0xa0]
cmp qword [rsp + 0xb8], 0xf
cmova r9, qword [rsp + 0xa0]
mov qword [rsp + 0x30], rcx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea rcx, [rsp + 0x60]
call fcn.14002d380
lea rcx, [rsp + 0x60]
call fcn.1400d15c0
movdqa xmm0, xmmword [0x140135730]
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 0xc6c9c882
mov word [rsp + 0x54], 0x100
nop
lea eax, [rdi - 0x2b]
xor byte [rsp + rdi + 0x40], al
inc rdi
cmp rdi, 0x14
jb 0x1400ece40
mov byte [rsp + 0x55], 0
lea rax, [rsp + 0x40]
nop word [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400ece60
mov rax, qword [rsp + 0x90]
sub rsi, rax
cmp rsi, rbx
jb 0x1400ed0e2
lea r9, [rsp + 0x80]
cmp qword [rsp + 0x98], 0xf
cmova r9, qword [rsp + 0x80]
mov qword [rsp + 0x30], rbx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x60]
call fcn.14002d380
lea rcx, [rsp + 0x60]
call fcn.1400d15c0
mov byte [0x140166963], 0
mov byte [0x140166921], 0
lea rcx, [rsp + 0x80]
call fcn.14002b140
nop
lea rcx, [rsp + 0xa0]
call fcn.14002b140
jmp 0x1400ed0a8
mov byte [0x140166a75], 1
mov rsi, qword [0x140167a98]
cmp byte [rsi + 0x1d0], 0
je 0x1400ed085
mov dword [rsp + 0x60], 0x8c9e8e90
mov word [rsp + 0x64], 0x100
mov rcx, rdi
nop word [rax + rax]
lea eax, [rcx - 0x2b]
xor byte [rsp + rcx + 0x60], al
inc rcx
cmp rcx, 4
jb 0x1400ecf20
mov byte [rsp + 0x65], 0
add rsi, 0x140
lea rcx, [rsp + 0x60]
mov rax, rbx
inc rax
cmp byte [rcx + rax], 0
jne 0x1400ecf44
mov rcx, rsi
cmp qword [rsi + 0x18], 0xf
jbe 0x1400ecf5a
mov rcx, qword [rsi]
mov r14, qword [rsi + 0x10]
cmp r14, rax
jne 0x1400ecf78
mov r8, r14
lea rdx, [rsp + 0x60]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400ed085
cmp byte [0x140166963], 0
je 0x1400ed08c
cmp byte [0x140166921], 0
je 0x1400ed08c
mov dword [rsp + 0x60], 0x8c9e8e90
mov word [rsp + 0x64], 0x100
mov rcx, rdi
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx - 0x2b]
xor byte [rsp + rcx + 0x60], al
inc rcx
cmp rcx, 4
jb 0x1400ecfb0
mov byte [rsp + 0x65], 0
lea rax, [rsp + 0x60]
nop word [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400ecfd0
cmp qword [rsi + 0x18], 0xf
jbe 0x1400ecfe3
mov rsi, qword [rsi]
cmp r14, rbx
jne 0x1400ed000
mov r8, r14
lea rdx, [rsp + 0x60]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400ed08c
mov ecx, 1
call fcn.14010ee60
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x1401013e0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400ed075
cmp dword [rsp + 0x48], 0
jne 0x1400ed04d
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
je 0x1400ed073
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
jmp 0x1400ed08c
mov dword [rsp + 0x48], edi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov byte [0x140166a75], 0
lea rcx, [rsp + 0x80]
call fcn.14002b140
nop
lea rcx, [rsp + 0xa0]
call fcn.14002b140
nop
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14010ee40
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r14
ret
call fcn.140004f60
call fcn.140004f60
nop
call fcn.140004f60
call fcn.140004f60
int3