Function at 0x1400985c0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
cmp word [rdx], 0
mov rsi, rdx
mov r13, qword [rcx + 0x2a0]
mov rdi, rcx
mov r14, rdx
je 0x1400974dd
lea r15, [rcx + 0x310]
xor ebp, ebp
lea rbx, [rcx + 0x318]
nop word [rax + rax]
movzx eax, word [r14]
cmp ax, 0xc
je 0x140097474
lea rbx, [rdi + 0x318]
test ax, ax
je 0x140097474
lea rbx, [rdi + 0x318]
cmp ax, 0x3d
jne 0x14009743d
mov rcx, qword [rbx]
lea r15, [rdi + 0x310]
mov rax, rcx
sub rax, qword [rdi + 0x320]
test rax, 0xfffffffffffffffe
jne 0x140097304
lea rbp, [r13 + 0x130]
jmp 0x14009737b
cmp rcx, qword [r15]
jne 0x14009731d
lea rcx, [rdi + 0x300]
call fcn.140097e70
test al, al
je 0x1400974fc
mov rax, qword [rbx]
lea rdx, [r13 + 0x78]
mov r9d, SafeArrayGetElemsize
mov rcx, rdi
mov word [rax], bp
mov r8, qword [rdi + 0x320]
add qword [rbx], 2
call fcn.1400977b0
mov rbp, rax
test rax, rax
je 0x1400974fc
mov rdx, qword [rax]
cmp rdx, qword [rdi + 0x320]
jne 0x140097371
lea rcx, [r13 + 0xa0]
call fcn.1400980c0
mov qword [rbp], rax
test rax, rax
je 0x1400974fc
mov rcx, qword [rdi + 0x320]
mov qword [rbx], rcx
movzx edx, word [r14 + 2]
lea rsi, [r14 + 2]
cmp dx, 0xc
je 0x1400973d1
mov rax, rcx
nop dword [rax]
mov rcx, rax
test dx, dx
je 0x1400973d1
cmp rax, qword [r15]
jne 0x1400973b1
lea rcx, [rdi + 0x300]
call fcn.140097e70
test al, al
je 0x1400974fc
movzx eax, word [rsi]
add rsi, 2
mov rcx, qword [rbx]
mov word [rcx], ax
add qword [rbx], 2
movzx edx, word [rsi]
mov rcx, qword [rbx]
mov rax, rcx
cmp dx, 0xc
jne 0x140097390
cmp rcx, qword [r15]
jne 0x1400973ea
lea rcx, [rdi + 0x300]
call fcn.140097e70
test al, al
je 0x1400974fc
mov rax, qword [rbx]
xor ecx, ecx
xor r8d, r8d
mov rdx, rbp
mov word [rax], cx
lea rax, [rdi + 0x2c0]
mov r9, qword [rdi + 0x320]
mov rcx, rdi
add qword [rbx], 2
mov qword [rsp + 0x20], rax
call fcn.140095be0
test eax, eax
jne 0x1400974fc
mov rax, qword [rdi + 0x320]
mov qword [rbx], rax
cmp word [rsi], 0
je 0x140097433
add rsi, 2
mov r14, rsi
xor ebp, ebp
jmp 0x1400974d3
mov rax, qword [r15]
cmp qword [rbx], rax
jne 0x140097459
lea rcx, [rdi + 0x300]
call fcn.140097e70
test al, al
je 0x1400974fc
movzx eax, word [r14]
lea r15, [rdi + 0x310]
mov rcx, qword [rbx]
mov word [rcx], ax
add qword [rbx], 2
add r14, 2
jmp 0x1400974d3
mov rax, qword [r15]
cmp qword [rbx], rax
jne 0x14009748c
lea rcx, [rdi + 0x300]
call fcn.140097e70
test al, al
je 0x1400974fc
mov rax, qword [rbx]
xor r9d, r9d
mov rdx, r13
mov rcx, rdi
mov word [rax], bp
mov r8, qword [rdi + 0x320]
add qword [rbx], 2
call fcn.1400977b0
test rax, rax
je 0x1400974b4
mov byte [rax + 0x38], 1
cmp word [r14], 0
je 0x1400974bf
add r14, 2
mov rax, qword [rdi + 0x320]
mov rsi, r14
mov qword [rbx], rax
lea rbx, [rdi + 0x318]
cmp word [rsi], 0
jne 0x1400972b0
mov al, 1
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor al, al
jmp 0x1400974df
push rdi
sub rsp, 0x30
cmp dword [rcx + 0x388], 0
mov rdi, rcx
jne 0x1400986ef
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
xor esi, esi
mov ebx, esi
nop dword [rax]
nop dword [rax + rax]
mov edx, 4
mov dword [rsp + 0x40], esi
lea rcx, [rsp + 0x40]
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x140098670
mov edx, dword [rsp + 0x40]
mov rcx, rsi
nop
cmp rbx, 4
jae 0x140098631
mov eax, edx
shr eax, cl
add rcx, 8
mov byte [rsp + rbx + 0x48], al
inc rbx
cmp rcx, 0x20
jb 0x140098610
cmp rbx, 4
jb 0x1400985f0
lea rcx, str.EXPAT_ENTROPY_DEBUG
call fcn.1401135a8
mov ebx, dword [rsp + 0x48]
test rax, rax
je 0x1400986df
cmp byte [rax], 0x31
jne 0x1400986df
cmp byte [rax + 1], sil
jne 0x1400986df
mov ecx, 2
call fcn.1401133f0
lea r8, str.rand_s
jmp 0x1400986be
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov ebx, dword [rsp + 0x48]
xor ebx, dword [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor eax, ebx
lea rcx, str.EXPAT_ENTROPY_DEBUG
imul ebx, eax, 0x7fffffff
call fcn.1401135a8
test rax, rax
je 0x1400986df
cmp byte [rax], 0x31
jne 0x1400986df
cmp byte [rax + 1], sil
jne 0x1400986df
mov ecx, 2
call fcn.1401133f0
lea r8, str.fallback_4_
mov dword [rsp + 0x28], 4
lea rdx, str.Entropy:__s_____0x_0lx___lu_bytes__n
mov r9d, 8
mov dword [rsp + 0x20], ebx
mov rcx, rax
call fcn.140090070
mov rsi, qword [rsp + 0x58]
mov dword [rdi + 0x388], ebx
mov rbx, qword [rsp + 0x50]
cmp byte [rdi + 0x1c8], 0
je 0x14009870c
lea rdx, str.xmlhttp:__www.w3.org_XML_1998_namespace
mov rcx, rdi
add rsp, 0x30
pop rdi
jmp 0x140097260
mov al, 1
add rsp, 0x30
pop rdi
ret