Function at 0x1400a1e60
Capabilities:
Create thread
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14015d040]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rcx
mov qword [rbp - 0x30], rcx
xor r14d, r14d
mov dword [rbp - 0x20], 0xb1a3b5b4
mov dword [rbp - 0x1c], 0xada7b4b6
mov dword [rbp - 0x18], 0xabb7a8
mov byte [rbp - 0x14], 1
mov ecx, r14d
nop
lea eax, [rcx - 0x2b]
xor byte [rbp + rcx - 0x20], al
inc rcx
cmp rcx, 0xb
jb 0x1400a1eb0
mov byte [rbp - 0x14], 0
lea rcx, [rbp - 0x20]
mov rbx, 0xffffffffffffffff
mov rax, rbx
inc rax
cmp byte [rcx + rax], 0
jne 0x1400a1ed2
mov rcx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x1400a1ee8
mov rcx, qword [rdi]
mov r8, qword [rdi + 0x10]
cmp r8, rax
jne 0x1400a1f22
lea rdx, [rbp - 0x20]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400a1f22
mov byte [0x1401669f4], al
mov dl, 1
mov rcx, qword [0x140167a98]
call fcn.140107f00
nop
mov rcx, rdi
call fcn.14002b140
mov al, 1
jmp 0x1400a2498
movdqa xmm0, xmmword [0x1401361f0]
movdqu xmmword [rbp - 0x50], xmm0
mov dword [rbp - 0x40], 0xe2939580
mov dword [rbp - 0x3c], 0x89868b87
mov word [rbp - 0x38], 0x91
mov byte [rbp - 0x36], 1
mov rcx, r14
nop word [rax + rax]
lea eax, [rcx - 0x2b]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0x19
jb 0x1400a1f50
mov byte [rbp - 0x36], 0
lea rax, [rbp - 0x50]
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400a1f70
mov rcx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x1400a1f86
mov rcx, qword [rdi]
mov qword [rsp + 0x20], rbx
lea r9, [rbp - 0x50]
xor r8d, r8d
mov rdx, qword [rdi + 0x10]
call fcn.14002c540
cmp rax, 0xffffffffffffffff
je 0x1400a248e
cmp byte [0x140166969], 0
je 0x1400a2018
mov ecx, 1
call fcn.14010ee60
mov qword [rbp - 0x20], rax
lea rcx, [rbp - 0x48]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r14d
mov r9, rax
lea r8, [0x1400cdd30]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x50], rax
test rax, rax
je 0x1400a24c9
cmp dword [rbp - 0x48], 0
je 0x1400a24bd
movaps xmm0, xmmword [rbp - 0x50]
movdqa xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x1400a24bd
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x50], xmm0
cmp byte [0x1401669ae], 0
je 0x1400a208b
mov ecx, 1
call fcn.14010ee60
mov qword [rbp - 0x20], rax
lea rcx, [rbp - 0x48]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r14d
mov r9, rax
lea r8, [0x1400cde40]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x50], rax
test rax, rax
je 0x1400a24e5
cmp dword [rbp - 0x48], 0
je 0x1400a24d9
movaps xmm0, xmmword [rbp - 0x50]
movdqa xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x1400a24d9
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x50], xmm0
cmp byte [0x140166955], 0
je 0x1400a20fe
mov ecx, 1
call fcn.14010ee60
mov qword [rbp - 0x20], rax
lea rcx, [rbp - 0x48]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r14d
mov r9, rax
lea r8, [0x1400cdf50]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x50], rax
test rax, rax
je 0x1400a2501
cmp dword [rbp - 0x48], 0
je 0x1400a24f5
movaps xmm0, xmmword [rbp - 0x50]
movdqa xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x1400a24f5
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x50], xmm0
cmp byte [0x1401669cd], 0
je 0x1400a2171
mov ecx, 1
call fcn.14010ee60
mov qword [rbp - 0x20], rax
lea rcx, [rbp - 0x48]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r14d
mov r9, rax
lea r8, [0x1400ce060]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x50], rax
test rax, rax
je 0x1400a251d
cmp dword [rbp - 0x48], 0
je 0x1400a2511
movaps xmm0, xmmword [rbp - 0x50]
movdqa xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x1400a2511
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x50], xmm0
cmp byte [0x14016692e], 0
je 0x1400a21e4
mov ecx, 1
call fcn.14010ee60
mov qword [rbp - 0x20], rax
lea rcx, [rbp - 0x48]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r14d
mov r9, rax
lea r8, [0x1400ce170]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x50], rax
test rax, rax
je 0x1400a2539
cmp dword [rbp - 0x48], 0
je 0x1400a252d
movaps xmm0, xmmword [rbp - 0x50]
movdqa xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x1400a252d
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x50], xmm0
cmp byte [0x140166954], 0
je 0x1400a2257
mov ecx, 1
call fcn.14010ee60
mov qword [rbp - 0x20], rax
lea rcx, [rbp - 0x48]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r14d
mov r9, rax
lea r8, [0x1400ce280]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x50], rax
test rax, rax
je 0x1400a2555
cmp dword [rbp - 0x48], 0
je 0x1400a2549
movaps xmm0, xmmword [rbp - 0x50]
movdqa xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x1400a2549
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x50], xmm0
cmp byte [0x140166972], 0
je 0x1400a22ca
mov ecx, 1
call fcn.14010ee60
mov qword [rbp - 0x20], rax
lea rcx, [rbp - 0x48]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r14d
mov r9, rax
lea r8, [0x1400ce390]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x50], rax
test rax, rax
je 0x1400a2571
cmp dword [rbp - 0x48], 0
je 0x1400a2565
movaps xmm0, xmmword [rbp - 0x50]
movdqa xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x1400a2565
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x50], xmm0
cmp byte [0x140166920], 0
je 0x1400a233d
mov ecx, 1
call fcn.14010ee60
mov qword [rbp - 0x20], rax
lea rcx, [rbp - 0x48]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r14d
mov r9, rax
lea r8, [0x1400ce4a0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x50], rax
test rax, rax
je 0x1400a258d
cmp dword [rbp - 0x48], 0
je 0x1400a2581
movaps xmm0, xmmword [rbp - 0x50]
movdqa xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x1400a2581
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x50], xmm0
cmp byte [0x14016692c], 0
je 0x1400a23b0
mov ecx, 1
call fcn.14010ee60
mov qword [rbp - 0x20], rax
lea rcx, [rbp - 0x48]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r14d
mov r9, rax
lea r8, [0x1400ce5b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x50], rax
test rax, rax
je 0x1400a25a9
cmp dword [rbp - 0x48], 0
je 0x1400a259d
movaps xmm0, xmmword [rbp - 0x50]
movdqa xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x1400a259d
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x50], xmm0
cmp byte [0x140166996], 0
je 0x1400a2423
mov ecx, 1
call fcn.14010ee60
mov qword [rbp - 0x20], rax
lea rcx, [rbp - 0x48]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r14d
mov r9, rax
lea r8, [0x1400ce6c0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x50], rax
test rax, rax
je 0x1400a25c5
cmp dword [rbp - 0x48], 0
je 0x1400a25b9
movaps xmm0, xmmword [rbp - 0x50]
movdqa xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x1400a25b9
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x50], xmm0
cmp byte [0x1401669a1], 0
je 0x1400a248e
mov ecx, 1
call fcn.14010ee60
mov qword [rbp - 0x20], rax
lea rcx, [rbp - 0x48]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r14d
mov r9, rax
lea r8, [0x1400ce7d0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x50], rax
test rax, rax
je 0x1400a25e1
cmp dword [rbp - 0x48], 0
je 0x1400a25d5
movaps xmm0, xmmword [rbp - 0x50]
movdqa xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x1400a25d5
mov rcx, rdi
call fcn.14002b140
xor al, al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14010ee40
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x48], r14d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x48], r14d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x48], r14d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x48], r14d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x48], r14d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x48], r14d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x48], r14d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x48], r14d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x48], r14d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x48], r14d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x48], r14d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3