Function at 0x1400114a0
Capabilities:
Check for time delay via gettickcount
Encode data using xor
Generate random numbers via winapi

Disassembly:
test rdx, rdx
je 0x140011947
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x100]
sub rsp, 0x200
mov rax, qword [0x14009c218]
xor rax, rsp
mov qword [rbp + 0xf0], rax
mov r15, rcx
mov qword [rsp + 0x58], rdx
call fcn.140047220
mov rbx, rax
movabs r12, 0xffffffff00000000
mov r14d, 0x40000000
test rax, rax
je 0x14001159e
call fcn.140047100
mov rsi, rax
call fcn.140047190
mov rdi, rax
xor r9d, r9d
lea r8, [0x14007b3f0]
lea rdx, [0x14007b430]
lea rcx, [rsp + 0x50]
call rbx
test eax, eax
jne 0x14001159e
mov bl, 1
mov rcx, qword [rsp + 0x58]
test r12, rcx
je 0x14001161f
test rcx, rcx
je 0x14001158d
nop dword [rax]
nop word [rax + rax]
cmp rcx, r14
cmova rcx, r14
mov rbx, rcx
xor r9d, r9d
mov r8d, ecx
mov rdx, r15
mov rcx, qword [rsp + 0x50]
call rdi
test eax, eax
jne 0x14001158b
mov rcx, qword [rsp + 0x58]
sub rcx, rbx
mov qword [rsp + 0x58], rcx
jne 0x140011550
xor edx, edx
mov rcx, qword [rsp + 0x50]
call rsi
jmp 0x14001191e
xor bl, bl
xor edx, edx
mov rcx, qword [rsp + 0x50]
call rsi
test bl, bl
jne 0x14001191e
mov bl, 1
mov dword [rsp + 0x20], 0xf0000000
mov r9d, 1
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x14001165c
mov rax, qword [rsp + 0x58]
test r12, rax
je 0x140011948
test rax, rax
je 0x140011647
nop dword [rax]
cmp rax, r14
cmova rax, r14
mov rbx, rax
mov r8, r15
mov edx, eax
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x140011645
mov rax, qword [rsp + 0x58]
sub rax, rbx
mov qword [rsp + 0x58], rax
jne 0x1400115e0
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x14001191e
xor r9d, r9d
mov r8d, ecx
mov rdx, r15
mov rcx, qword [rsp + 0x50]
call rdi
test eax, eax
je 0x14001158d
xor edx, edx
mov rcx, qword [rsp + 0x50]
call rsi
jmp 0x14001159e
xor bl, bl
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test bl, bl
jne 0x14001191e
mov rax, qword [rsp + 0x58]
mov rcx, rax
shr rcx, 6
test al, 0x3f
lea rdi, [rcx + 1]
cmove rdi, rcx
mov qword [rsp + 0x30], rdi
call sub.KERNEL32.dll_GetTickCount
mov ebx, eax
call fcn.140060994
add ebx, eax
mov ecx, ebx
shr ecx, 0x10
movzx eax, bx
xor ecx, eax
add ecx, 0x3e8
call fcn.1400609c0
xor r12d, r12d
test rdi, rdi
je 0x14001191e
lea rcx, [rdi - 1]
xor r13d, r13d
lea r14, [rbp + 0xb0]
sub r14, r15
nop word [rax + rax]
mov rax, qword [rsp + 0x58]
sub rax, r13
mov esi, 0x40
cmp r12, rcx
cmove rsi, rax
lea rcx, [rsp + 0x48]
call fcn.1400371b0
mov rcx, qword [rax]
mov qword [rbp - 0x80], rcx
mov r8d, 8
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x60]
call fcn.14003f330
lea rax, [rsp + 0x58]
mov dword [rsp + 0x68], eax
mov r8d, 4
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x68]
call fcn.14003f330
call fcn.140060994
mov dword [rsp + 0x6c], eax
mov r8d, 4
lea rdx, [rsp + 0x6c]
lea rcx, [rbp + 0x6c]
call fcn.14003f330
cmp byte [0x14009cd20], 0
jne 0x1400117dc
call sub.KERNEL32.dll_GetCurrentProcessId
mov dword [0x14009cd24], eax
mov qword [rsp + 0x78], 0
lea rcx, [rsp + 0x78]
call fcn.140038b80
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x38]
call fcn.14001bbe0
lea rdi, [0x14008d1d0]
mov rax, qword [rsp + 0x38]
test rax, rax
cmovne rdi, rax
lea rcx, [rsp + 0x38]
call fcn.140020130
mov rbx, rax
lea rcx, [rbp - 0x70]
call fcn.14000fd00
lea rcx, [rbp - 0x70]
call fcn.140010fc0
mov r8, rbx
mov rdx, rdi
lea rcx, [rbp - 0x70]
call fcn.1400110b0
lea rdx, [0x14009cd28]
lea rcx, [rbp - 0x70]
call fcn.140010c00
lea rcx, [rbp - 0x70]
call fcn.14000fd10
mov byte [0x14009cd20], 1
lea rcx, [rsp + 0x78]
call fcn.14001bff0
mov rdi, qword [rsp + 0x30]
mov r8d, 4
lea rdx, [0x14009cd24]
lea rcx, [rbp + 0x70]
call fcn.14003f330
call fcn.1400470e0
mov dword [rsp + 0x70], eax
mov r8d, 4
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x74]
call fcn.14003f330
mov ecx, 1
call fcn.14003f370
mov dword [rsp + 0x60], eax
test rax, rax
je 0x14001182a
mov rcx, rax
call fcn.14003f4a0
mov r8d, 4
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x78]
call fcn.14003f330
call sub.KERNEL32.dll_GetTickCount
mov dword [rsp + 0x50], eax
mov r8d, 4
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x7c]
call fcn.14003f330
mov r8d, 0x20
lea rdx, [0x14009cd28]
lea rcx, [rbp + 0x80]
call fcn.14003f330
inc qword [0x14009cd48]
mov r8d, 8
lea rdx, [0x14009cd48]
lea rcx, [rbp + 0xa0]
call fcn.14003f330
lea rcx, [rbp - 0x70]
call fcn.14000fd00
lea rcx, [rbp - 0x70]
call fcn.140011010
mov r8d, 0x48
lea rdx, [rbp + 0x60]
lea rcx, [rbp - 0x70]
call fcn.140011190
lea rdx, [rbp + 0xb0]
lea rcx, [rbp - 0x70]
call fcn.140010d20
lea rcx, [rbp - 0x70]
call fcn.14000fd10
xor ebx, ebx
test rsi, rsi
je 0x140011902
mov rdi, r15
nop dword [rax]
call fcn.140060994
xor ebx, eax
movzx eax, bl
xor al, byte [r14 + rdi]
mov byte [rdi], al
shr ebx, 8
lea rdi, [rdi + 1]
sub rsi, 1
jne 0x1400118e0
mov rdi, qword [rsp + 0x30]
add r15, 0x40
sub r14, 0x40
inc r12
add r13, 0x40
cmp r12, rdi
lea rcx, [rdi - 1]
jb 0x1400116c0
mov rcx, qword [rbp + 0xf0]
xor rcx, rsp
call fcn.14005a330
mov rbx, qword [rsp + 0x250]
add rsp, 0x200
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r8, r15
mov edx, eax
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x140011647
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x14001165c