Function at 0x1800125e0
Capabilities:
Create thread
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov esi, dword [rsp + 0x60]
lea eax, [rdx - 0x77]
mov r8d, ecx
lea edi, [rdx + 0xad2]
xor r8d, 0x1d0d
lea ebp, [rdx + 0xff4]
lea r14d, [rsi - 0x1240]
xor esi, 0x3ce1
cmp r8d, eax
jl 0x1800128f0
lea eax, [r14 + 0x3d6]
mov qword [rsp + 0x40], rbx
mov rbx, qword [rsp + 0x68]
cmp esi, eax
je 0x18001284e
mov eax, dword [rbx + 0xcc]
add r8d, 0x293
sub eax, dword [rbx + 0xdc]
add edx, 0x8f0
sub eax, 0x1a1c6e
add ecx, 0xffffff17
xor dword [rbx + 0x58], eax
lea eax, [rbp - 0x10b5]
mov dword [rsp + 0x28], eax
xor ebp, 0xfab
mov r9d, ebp
mov qword [rsp + 0x20], rbx
call fcn.180002660
xor esi, esi
mov r9d, esi
nop word [rax + rax]
movsxd rcx, dword [rbx + 0x64]
mov eax, dword [rbx + 0x28]
add eax, 0x1b094b
xor dword [rbx + 0x4c], eax
mov eax, dword [rbx + 0xf0]
sub eax, dword [rbx + 0xdc]
xor eax, 0x2bd18
add dword [rbx + 0x11c], eax
mov rax, qword [rbx + 0x98]
mov r8d, dword [r9 + rax]
mov eax, 0x1a9295
sub eax, dword [rbx + 0xf8]
add r9, 4
sub eax, dword [rbx + 0x74]
add dword [rbx + 8], eax
imul r8d, dword [rbx + 0x58]
mov rax, qword [rbx + 0xb0]
mov edx, r8d
shr edx, 8
mov byte [rcx + rax], dl
inc dword [rbx + 0x64]
movsxd rcx, dword [rbx + 0x64]
mov rax, qword [rbx + 0xb0]
mov byte [rcx + rax], r8b
inc dword [rbx + 0x64]
mov eax, dword [rbx + 0x40]
mov r11d, dword [rbx + 0x64]
sub eax, 0x16843f
xor dword [rbx + 0x74], eax
cmp r9, 0x198
jl 0x180012690
mov eax, dword [rbx + 0x28]
sub eax, dword [rbx + 0xcc]
mov ebp, dword [rbx + 0x5c]
sub eax, 0x66102c27
mov dword [rbx + 0x58], eax
lea rax, [0x180023440]
mov qword [rbx + 0x98], rax
nop
mov ecx, dword [rbx + 0x6c]
mov r8d, dword [rbx + 0x108]
add ecx, 0x331506
mov r10d, dword [rbx + 0x6c]
add ecx, r8d
xor r8d, dword [rbx + 0x74]
mov rax, qword [rbx + 0x98]
xor r8d, 0x5659f
movzx edx, byte [rbx + 0x58]
imul r10d, ecx
mov dword [rbx + 0x6c], r10d
mov r9d, dword [rsi + rax]
add rsi, 4
mov eax, dword [rbx + 0x7c]
xor dword [rbx + 0x24], eax
mov eax, dword [rbx + 0x11c]
add dword [rbx + 0x70], r8d
lea ecx, [rax + 0x3093abe9]
add ecx, ebp
imul ecx, eax
lea eax, [r10 + 0x387ae2]
imul eax, dword [rbx + 0x74]
mov dword [rbx + 0x11c], ecx
mov dword [rbx + 0x74], eax
movsxd rcx, r11d
movzx eax, r9b
imul edx, eax
mov rax, qword [rbx + 0xb0]
mov byte [rcx + rax], dl
mov edx, dword [rbx + 0xc0]
mov r8d, dword [rbx + 0x110]
mov ecx, dword [rbx + 0x40]
inc dword [rbx + 0x64]
mov eax, dword [rbx + 0xa8]
mov ebp, dword [rbx + 0x5c]
sub eax, 0x65e6c
or dword [rbx + 0x90], eax
mov eax, 0xffe9d7fe
mov r11d, dword [rbx + 0x64]
sub eax, r8d
add dword [rbx + 0x6c], eax
lea eax, [rdx - 0x1c]
imul ecx, eax
lea eax, [r8 + 0x162802]
xor dword [rbx + 0x70], eax
mov eax, dword [rbx + 0x4c]
add eax, 0x30779e70
mov dword [rbx + 0x40], ecx
lea ecx, [rdx + rbp]
add ecx, eax
mov eax, dword [rbx + 0xf8]
add eax, dword [rbx + 0x20]
xor eax, dword [rbx + 0x108]
xor eax, 0x3786c9
mov dword [rbx + 0xc0], ecx
mov dword [rbx + 0x108], eax
cmp rsi, 0x330
jl 0x180012740
add edi, 0x522
jmp 0x1800128eb
mov eax, dword [rbx + 8]
xor eax, 0x353f
cmp edi, eax
jae 0x1800128eb
mov ecx, dword [rbx + 0xfc]
mov r11d, dword [rbx + 0xe0]
mov r9d, ecx
mov edx, dword [rbx + 0x3c]
mov r10d, dword [rbx + 0x114]
xor rdx, rcx
mov ecx, dword [rbx + 0xc0]
add r10d, dword [rbx + 0x2c]
imul r9d, r8d
mov r8d, dword [rbx + 0x48]
mov eax, ebp
xor r11, rax
mov eax, esi
and r8, rax
mov qword [rsp + 0x28], r11
mov eax, edi
and rcx, rax
mov dword [rsp + 0x20], r10d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [rbx + 0x38]
mov eax, dword [rbx + 0xf0]
mov edx, dword [rbx + 0x110]
add eax, dword [rbx + 0x20]
xor edx, r14d
or eax, dword [rbx + 0x100]
sub edx, dword [rbx + 0xf4]
sub dword [rbx + 0x90], eax
imul ecx, ebp
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ecx, dword [rbx + 0xdc]
and ecx, 0x369c
xor dword [rbx + 0x50], ecx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
xor edi, 0x93c
mov rsi, qword [rsp + 0x50]
mov eax, edi
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret