Function at 0x140011410
Capabilities:
Encode data using xor
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov rsi, rdx
mov rdi, rcx
mov eax, dword [0x141dc0fb0]
xor edx, edx
div dword [0x141dc0fb4]
imul eax, eax, 0xcd4333a4
imul rax, rax, 0x30bf477f
shr rax, 0x3c
cmp eax, 0x2f8be5aa
jne 0x140011460
mov eax, 0x20
call fcn.1400ef330
sub rsp, rax
nop dword [rax]
mov eax, dword [0x141dc0fb8]
sub eax, dword [0x141dc0fbc]
imul rcx, rax, 0x218dfbf7
shr rcx, 0x3b
add ecx, 0xc8f43b99
mov eax, 0x20
call fcn.1400ef330
sub rsp, rax
mov rbx, rsp
cmp ecx, 0x2c33ad26
jb 0x140011460
mov eax, 0x20
call fcn.1400ef330
sub rsp, rax
mov r15, rsp
mov eax, 0x40
call fcn.1400ef330
sub rsp, rax
mov r12, rsp
xorps xmm0, xmm0
movups xmmword [r15 + 0x10], xmm0
movups xmmword [r15], xmm0
sub rsp, 0x20
xor ecx, ecx
mov rdx, r15
mov r8d, 0x20
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
add rsp, 0x20
cmp eax, 0xc0000000
jb 0x1400115d6
mov r14d, eax
mov eax, dword [0x141dc0fc0]
and eax, dword [0x141dc0fc4]
imul rax, rax, 0x40cb965
shr rax, 0x3a
or eax, 0x2a306042
imul rax, rax, 0x765a1a1
shr rax, 0x38
cmp eax, 0x4ca73f95
je 0x14001154e
mov eax, dword [0x141dc0fc8]
sub eax, dword [0x141dc0fcc]
imul r13d, eax, 0x32fce628
sub rsp, 0x20
mov rcx, r15
mov edx, 0x20
call qword [sym.imp.ADVAPI32.dll_SystemFunction036]
add rsp, 0x20
cmp r13d, 0xb90f2a7f
jne 0x140011566
sub rsp, 0x20
mov rcx, r15
mov edx, 0x20
call qword [sym.imp.ADVAPI32.dll_SystemFunction036]
add rsp, 0x20
jmp 0x14001151c
mov ecx, eax
mov eax, dword [0x141dc0fd0]
xor edx, edx
div dword [0x141dc0fd4]
nop word cs:[rax + rax]
mov eax, dword [0x141dc0fd8]
mov edx, dword [0x141dc0fdc]
add eax, edx
add eax, 0x785d0648
xor eax, 0x163dec0a
and eax, 0x17bdff1a
cmp eax, 0x376ed407
je 0x140011580
nop word cs:[rax + rax]
mov eax, dword [0x141dc0fe0]
xor eax, dword [0x141dc0fe4]
and eax, 0x818ad301
imul eax, eax, 0x84ed09dc
cmp eax, 0xdefaf394
je 0x1400115b0
test cl, cl
je 0x1400117f1
movups xmm0, xmmword [r15]
movups xmm1, xmmword [r15 + 0x10]
movups xmmword [rbx + 0x10], xmm1
movups xmmword [rbx], xmm0
mov r14, r12
add r14, 0x10
mov rcx, qword [0x141ddb268]
mov eax, dword [0x141dc1008]
xor edx, edx
div dword [0x141dc100c]
nop word cs:[rax + rax]
mov eax, dword [0x141dc1010]
xor eax, dword [0x141dc1014]
imul rdx, rax, 0x2e634b1b
shr rdx, 0x20
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0x1e
add eax, 0x80b2a942
imul rax, rax, 0x29926ef
shr rax, 0x38
cmp eax, 0x176d2db4
ja 0x140011610
test rcx, rcx
je 0x140011690
and ecx, 0x4000
xor r8d, r8d
nop word cs:[rax + rax]
mov eax, dword [0x141dc1020]
xor edx, edx
div dword [0x141dc1024]
or eax, 0xbbbbacaf
imul rdx, rax, 0x651db26d
shr rdx, 0x20
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0x1c
cmp eax, 0xb5a75e9a
je 0x140011660
jmp 0x1400116da
mov eax, dword [0x141dc1018]
mov ecx, dword [0x141dc101c]
add eax, ecx
add eax, 0x321bee3
and eax, 0x8f95c5dc
imul eax, eax, 0xceab6e3b
cmp eax, 0x29fbe125
jb 0x140011867
xor r15d, r15d
sub rsp, 0x20
call fcn.1400fc980
add rsp, 0x20
test r15b, r15b
jne 0x1400116bc
mov rcx, rax
and ecx, 0x4000
xor r8d, r8d
mov eax, dword [0x141dc1028]
xor edx, edx
div dword [0x141dc102c]
nop dword [rax + rax]
mov eax, dword [0x141dc1030]
add eax, dword [0x141dc1034]
and eax, 0x2e7d3e75
add eax, 0x5c27a72
or eax, 0x354d6d8a
cmp eax, 0xa234988e
je 0x1400116f0
or rcx, r8
je 0x1400117c9
mov eax, dword [str.f_Iu]
xor eax, dword [0x141dc104c]
and eax, 0x66ed3b17
add eax, 0x5f7b7605
xor eax, 0xb1a0ab89
cmp eax, 0x95c92d08
jbe 0x140011757
sub rsp, 0x20
lea r8, [0x141db9060]
mov rcx, r14
mov rdx, rbx
call fcn.140070a70
add rsp, 0x20
lea r15, [0x141db9060]
nop
mov r12d, dword [0x141dc1050]
xor r12d, dword [0x141dc1054]
xor r12d, 0x4202d6b
add r12d, 0xb4f72802
sub rsp, 0x20
mov rcx, r14
mov rdx, rbx
mov r8, r15
call fcn.140070a70
add rsp, 0x20
cmp r12d, 0xf664cb2d
ja 0x140011760
nop dword [rax + rax]
mov eax, dword [0x141dc1058]
xor edx, edx
div dword [0x141dc105c]
xor eax, 0x20285000
or eax, 0xc6d60a0e
and eax, 0xe6fedb0e
cmp eax, 0x8495df1d
je 0x1400117a0
jmp 0x140011970
mov eax, dword [0x141dc1038]
xor edx, edx
div dword [0x141dc103c]
add eax, 0xa44ea974
and eax, 0x2090cb1
cmp eax, 0xb93c4473
jbe 0x14001192a
jmp 0x140011952
add r14d, 0x80000000
xor eax, eax
nop word [rax + rax]
test al, al
jne 0x140011800
nop word cs:[rax + rax]
mov eax, dword [0x141dc0fe8]
xor edx, edx
div dword [0x141dc0fec]
xor eax, 0x38286121
and eax, 0xbeec7333
add eax, 0x6c081165
cmp eax, 0x65aed6b1
jb 0x140011810
test r14d, r14d
je 0x1400115d6
mov eax, dword [0x141dc0ff0]
or eax, dword [0x141dc0ff4]
imul rax, rax, 0x3a37bbf9
shr rax, 0x3b
add eax, 0x7929aeb6
xor eax, 0xf26a4bc4
cmp eax, 0x28a05060
jae 0x140011879
jmp 0x1400118c0
sub rsp, 0x20
call fcn.1400fc980
add rsp, 0x20
jmp 0x1400116b9
mov eax, dword [0x141dc0ff8]
xor edx, edx
div dword [0x141dc0ffc]
imul eax, eax, 0x842de1b9
add eax, 0x789c7ef9
imul rbx, rax, 0x38f2fe85
shr rbx, 0x3b
movzx eax, byte [0x141ddb278]
sub rsp, 0x20
mov edx, 4
xor ecx, ecx
call fcn.1400c0180
add rsp, 0x20
cmp ebx, 0xd029ec34
jbe 0x1400118dd
movzx eax, byte [0x141ddb278]
sub rsp, 0x20
mov edx, 4
xor ecx, ecx
call fcn.1400c0180
add rsp, 0x20
jmp 0x140011879
mov r8, rax
mov eax, dword [0x141dc1000]
xor edx, edx
div dword [0x141dc1004]
add eax, 0xf8548135
and eax, 0x57a26a8f
xor eax, 0xdedb4b28
cmp eax, 0xca10b7c2
ja 0x1400118e0
test r8, r8
je 0x140011928
mov dword [r8], r14d
mov rcx, qword [0x141ddb260]
sub rsp, 0x20
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
jmp 0x140011a39
ud2
mov eax, dword [0x141dc1040]
and eax, dword [0x141dc1044]
add eax, 0x8949bad7
and eax, 0x20014600
movaps xmm1, xmmword [rbx]
movaps xmm0, xmmword [rbx + 0x10]
movaps xmmword [r14], xmm1
cmp eax, 0x47dcad22
jbe 0x14001195b
movaps xmm0, xmmword [rbx]
movaps xmmword [r14], xmm0
jmp 0x14001192a
movaps xmmword [r12 + 0x20], xmm0
xorps xmm0, xmm0
movaps xmmword [r12 + 0x30], xmm0
nop word [rax + rax]
mov eax, dword [0x141dc1060]
imul eax, dword [0x141dc1064]
imul eax, eax, 0xab3cffdd
add eax, 0xb5f4d329
imul rax, rax, 0x6f55f193
shr rax, 0x3e
cmp eax, 0x1910c83d
je 0x140011970
mov eax, dword [0x141dc1068]
or eax, dword [0x141dc106c]
add eax, 0xfb980263
cmp eax, 0x4889cd29
jae 0x1400119d0
movaps xmm0, xmmword [r14]
movaps xmm1, xmmword [r14 + 0x10]
movaps xmm2, xmmword [r14 + 0x20]
movaps xmmword [rdi + 0x20], xmm2
movaps xmmword [rdi + 0x10], xmm1
movaps xmmword [rdi], xmm0
nop dword [rax + rax]
mov eax, dword [0x141dc1070]
xor eax, dword [0x141dc1074]
imul eax, eax, 0x7a472fab
add eax, 0xe05042aa
xor eax, 0xf0c5deff
movaps xmm0, xmmword [r14]
movaps xmm1, xmmword [r14 + 0x10]
movaps xmm2, xmmword [r14 + 0x20]
movaps xmmword [rdi + 0x20], xmm2
movaps xmmword [rdi + 0x10], xmm1
movaps xmmword [rdi], xmm0
cmp eax, 0x5d91500
jb 0x1400119d0
nop dword [rax]
mov eax, dword [0x141dc1078]
add eax, dword [0x141dc107c]
imul eax, eax, 0x7339d505
or eax, 0xa823d3d0
imul rax, rax, 0x711ced23
shr rax, 0x3e
cmp eax, 0x164e496f
je 0x140011a10
mov qword [rdi + 0x40], 0
mov eax, dword [0x141dc1080]
xor edx, edx
div dword [0x141dc1084]
cmp eax, 0x50741c5c
je 0x140011a6b
mov rax, 0xffffffffffffff00
add rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
xor eax, eax
test al, al
je 0x140011a7c
mov rax, 0xffffffffffffff00
add rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
jmp 0x140011a56
mov eax, dword [0x141dc1088]
add eax, dword [0x141dc108c]
or eax, 0x8205e730
add eax, 0x5ef08028
and eax, 0x9ce6cc60
cmp eax, 0x6902cfa2
je 0x140011ad1
mov ebx, dword [0x141dc1090]
and ebx, dword [0x141dc1094]
xor ebx, 0x32181272
or ebx, 0x4dc7cd0d
sub rsp, 0x20
mov rcx, rdi
mov rdx, rsi
call fcn.140070b90
add rsp, 0x20
cmp ebx, 0xa778f5a3
jne 0x140011ae6
sub rsp, 0x20
mov rcx, rdi
mov rdx, rsi
call fcn.140070b90
add rsp, 0x20
jmp 0x140011a9e
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret