Function at 0x180002a90
Capabilities:
Create thread
Encode data using xor

Disassembly:
push rbx
push rdi
sub rsp, 0x48
xor ecx, ecx
call qword [sym.imp.MSVCR90.dll__time64]
mov rcx, rax
call qword [sym.imp.MSVCR90.dll_srand]
mov edi, 4
nop dword [rax]
call qword [sym.imp.MSVCR90.dll_rand]
sub rdi, 1
jne 0x180002ab0
call qword [sym.imp.MSVCR90.dll_rand]
mov ebx, eax
imul ebx, ebx, 0x1d
call qword [sym.imp.MSVCR90.dll_rand]
add ebx, eax
mov eax, 0x431bde83
imul ebx
sar edx, 0x12
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0xf4240
sub ebx, edx
cmp ebx, 0xf4240
jl 0x180002af6
sub ebx, 0xf4240
cmp ebx, 0x186a0
jge 0x180002b0b
call qword [sym.imp.MSVCR90.dll_rand]
lea ebx, [rbx + rax + 0x186a0]
mov rcx, qword [0x18000b488]
or edx, 0xffffffff
mov dword [0x18000b43c], ebx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
or rcx, 0xffffffffffffffff
xor eax, eax
lea r8, str.224269_6:_8__C
xor ebx, ebx
mov rdi, r8
repne scasb al, byte [rdi]
not rcx
lea rdi, [rcx - 1]
mov ecx, ebx
test edi, edi
jle 0x180002b5b
mov eax, ecx
inc r8
cdq
and eax, 1
xor eax, edx
sub eax, edx
add al, cl
inc ecx
sub byte [r8 - 1], al
cmp ecx, edi
jl 0x180002b42
or rcx, 0xffffffffffffffff
xor eax, eax
lea r8, str.a5355:66kyw
mov rdi, r8
repne scasb al, byte [rdi]
not rcx
lea rdi, [rcx - 1]
mov ecx, ebx
test edi, edi
jle 0x180002b99
nop word [rax + rax]
mov eax, ecx
inc r8
cdq
and eax, 1
xor eax, edx
sub eax, edx
add al, cl
inc ecx
sub byte [r8 - 1], al
cmp ecx, edi
jl 0x180002b80
mov rcx, qword [0x18000b488]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
call fcn.180002ec0
lea rdx, [0x18000b368]
mov qword [rsp + 0x20], rdx
lea rdx, [0x18000b490]
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call fcn.180003ab0
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x28], rdx
lea r8, [0x180004010]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x180002c09
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x68]
lea r8, [0x180001a80]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x180002c39
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x70]
lea r8, [0x180004450]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x180002c69
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x78]
lea r8, [0x180004d60]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x180002c99
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x30]
lea r8, [0x180005590]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x180002cc9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x34]
lea r8, [0x180005d90]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x180002cf9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x48
pop rdi
pop rbx
ret