Function at 0x140011990
Capabilities:
Encode data using xor
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
movaps xmmword [rbp - 0x10], xmm6
mov qword [rbp - 0x38], rdx
mov rdi, rcx
mov eax, dword [0x141dc0100]
add eax, dword [0x141dc0104]
imul eax, eax, 0x6b7020e5
and eax, 0x7c463463
imul eax, eax, 0x88e0ec1e
cmp eax, 0x805bfaab
jae 0x140011a17
mov eax, 0x20
call fcn.1400eeec0
sub rsp, rax
mov rdx, rsp
mov eax, 0x40
call fcn.1400eeec0
sub rsp, rax
xorps xmm0, xmm0
movups xmmword [rdx + 0x10], xmm0
movups xmmword [rdx], xmm0
sub rsp, 0x20
xor ecx, ecx
mov r8d, 0x20
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
add rsp, 0x20
mov r12d, 0x803a146f
xorps xmm6, xmm6
mov r13, qword [sym.imp.bcrypt.dll_BCryptGenRandom]
nop word [rax + rax]
mov esi, dword [0x141dc0108]
xor esi, dword [0x141dc010c]
add esi, 0x20f7a91b
imul rsi, r12
shr rsi, 0x3f
mov eax, 0x20
call fcn.1400eeec0
sub rsp, rax
mov r14, rsp
mov eax, 0x40
call fcn.1400eeec0
sub rsp, rax
mov r15, rsp
movups xmmword [r14 + 0x10], xmm6
movups xmmword [r14], xmm6
sub rsp, 0x20
xor ecx, ecx
mov rdx, r14
mov r8d, 0x20
mov r9d, 2
call r13
add rsp, 0x20
cmp esi, 0x27777d0f
ja 0x140011a30
mov ebx, eax
cmp eax, 0xc0000000
jb 0x140011b79
mov eax, dword [0x141dc0110]
sub eax, dword [0x141dc0114]
xor eax, 0x51332b91
imul eax, eax, 0xdeaf905d
cmp eax, 0x4d81d4bd
ja 0x140011af7
mov eax, dword [0x141dc0118]
xor eax, dword [0x141dc011c]
and eax, 0x4e80
imul esi, eax, 0x2f87d4f8
sub rsp, 0x20
mov rcx, r14
mov edx, 0x20
call qword [sym.imp.ADVAPI32.dll_SystemFunction036]
add rsp, 0x20
cmp esi, 0xaf130ebd
jbe 0x140011b0f
sub rsp, 0x20
mov rcx, r14
mov edx, 0x20
call qword [sym.imp.ADVAPI32.dll_SystemFunction036]
add rsp, 0x20
jmp 0x140011ac2
mov ecx, eax
nop word cs:[rax + rax]
mov eax, dword [0x141dc0120]
xor edx, edx
div dword [0x141dc0124]
and eax, 0x9f3de9a5
xor eax, 0xa166b881
imul eax, eax, 0x3c36ac23
cmp eax, 0xc3b406b0
je 0x140011b20
nop word cs:[rax + rax]
mov eax, dword [0x141dc0128]
mov edx, dword [0x141dc012c]
add eax, edx
add eax, 0xe689a238
and eax, 0x8ea3866e
imul eax, eax, 0xde2e1069
cmp eax, 0xfb6ff17b
ja 0x140011b50
test cl, cl
je 0x140011ba6
mov eax, dword [0x141dc0158]
imul eax, dword [0x141dc015c]
xor eax, 0x1893c07d
imul eax, eax, 0x26b88775
add eax, 0xb8de388a
cmp eax, 0x89259511
jae 0x140011d8d
jmp 0x140011dbd
add ebx, 0x80000000
mov eax, 0xa9ef0aeb
nop word cs:[rax + rax]
mov ecx, dword [0x141dc0130]
add ecx, dword [0x141dc0134]
or ecx, 0xf00fd9f2
imul rcx, rax
shr rcx, 0x3f
imul ecx, ecx, 0x5c779929
cmp ecx, 0x6f977c1e
je 0x140011bc0
nop dword [rax + rax]
mov eax, dword [0x141dc0138]
xor eax, dword [0x141dc013c]
or eax, 0x2973f6b1
imul eax, eax, 0x35ac4352
cmp eax, 0x73bd8141
ja 0x140011bf0
test ebx, ebx
je 0x140011b79
mov eax, dword [0x141dc0140]
sub eax, dword [0x141dc0144]
mov ecx, 0xe2633ac3
imul rcx, rax
shr rcx, 0x3d
add ecx, 0xf72c4499
cmp ecx, 0x35e074a8
jae 0x140011c60
movzx eax, byte [0x141dda6b8]
sub rsp, 0x20
mov edx, 4
xor ecx, ecx
call fcn.1400bf230
add rsp, 0x20
nop dword [rax + rax]
mov esi, dword [0x141dc0148]
or esi, dword [0x141dc014c]
movzx eax, byte [0x141dda6b8]
sub rsp, 0x20
mov edx, 4
xor ecx, ecx
call fcn.1400bf230
add rsp, 0x20
cmp esi, 0x59b964d8
je 0x140011c60
mov r14, rax
nop word cs:[rax + rax]
mov eax, dword [0x141dc0150]
or eax, dword [0x141dc0154]
xor eax, 0xc4e80500
or eax, 0x30016268
xor eax, 0x9e2c5b5d
cmp eax, 0x1e04d276
jb 0x140011ca0
test r14, r14
je 0x140011d8b
mov eax, dword [0x141dc01c0]
add eax, dword [0x141dc01c4]
shr eax, 7
imul rax, rax, 0x80cccd
shr rax, 0x30
or eax, 0xb0665248
cmp eax, 0x9cf6cb1a
jae 0x140011cf4
mov dword [r14], ebx
xor eax, eax
nop word cs:[rax + rax]
mov dword [r14], ebx
test al, al
jne 0x140011d00
mov eax, dword [0x141dc01c8]
xor edx, edx
div dword [0x141dc01cc]
imul eax, eax, 0xaef53b34
add eax, 0xfea3cf2
or eax, 0x8a071f7c
cmp eax, 0xdc1e8f61
jbe 0x140011d46
mov rcx, qword [0x141dda6a0]
sub rsp, 0x20
xor edx, edx
mov r8, r14
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
mov rsi, qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax]
mov eax, dword [0x141dc01d0]
or eax, dword [0x141dc01d4]
imul ebx, eax, 0x9c635a2
and ebx, 0x1defdb34
mov rcx, qword [0x141dda6a0]
sub rsp, 0x20
xor edx, edx
mov r8, r14
call rsi
add rsp, 0x20
cmp ebx, 0x5bf8ef5
jb 0x140011d50
jmp 0x14001207e
ud2
mov eax, dword [0x141dc0160]
imul eax, dword [0x141dc0164]
imul eax, eax, 0x908cbef9
add eax, 0x7097d915
movups xmm0, xmmword [r14]
movups xmm1, xmmword [r14 + 0x10]
movaps xmmword [rbp - 0x30], xmm0
movaps xmmword [rbp - 0x20], xmm1
cmp eax, 0x5e6d5ae1
jae 0x140011dd0
movups xmm0, xmmword [r14]
movups xmm1, xmmword [r14 + 0x10]
movaps xmmword [rbp - 0x20], xmm1
movaps xmmword [rbp - 0x30], xmm0
jmp 0x140011d8d
mov rax, qword [0x141dda6a8]
test rax, rax
je 0x140011f17
mov ecx, dword [0x141dc0168]
or ecx, dword [0x141dc016c]
or ecx, 0x1ea2cf1c
and ecx, 0x1ef6cfbd
cmp ecx, 0x25e3cbef
ja 0x140011de0
and eax, 0x4000
nop word cs:[rax + rax]
mov ecx, dword [0x141dc0170]
imul ecx, dword [0x141dc0174]
xor ecx, 0x13c95a21
imul ecx, ecx, 0x68e4d784
cmp ecx, 0xa72625b2
ja 0x140011e10
xor ecx, ecx
nop word cs:[rax + rax]
mov edx, dword [0x141dc0178]
xor edx, dword [0x141dc017c]
add edx, 0xacee06a7
shr edx, 4
imul rdx, rdx, 0x445167b
shr rdx, 0x35
add edx, 0x6dbe34b6
cmp edx, 0x716d99e8
ja 0x140011e40
mov rbx, r15
add rbx, 0x10
nop word cs:[rax + rax]
mov edx, dword [0x141dc0180]
sub edx, dword [0x141dc0184]
and edx, 0x1410c
add edx, 0x19c1e158
cmp edx, 0x5b920fb9
ja 0x140011e80
or rax, rcx
je 0x140011ec7
mov eax, dword [0x141dc01a0]
imul eax, dword [0x141dc01a4]
or eax, 0xd2e8f257
cmp eax, 0x34484ec6
jne 0x140011fab
jmp 0x140011fe7
xor eax, eax
test al, al
je 0x140011ee0
movaps xmm0, xmmword [rbp - 0x30]
movaps xmmword [rbx], xmm0
nop word cs:[rax + rax]
mov eax, dword [0x141dc0188]
imul eax, dword [0x141dc018c]
imul eax, eax, 0xfda33044
add eax, 0xfc373f2e
and eax, 0x65de2c16
movaps xmm1, xmmword [rbp - 0x30]
movaps xmm0, xmmword [rbp - 0x20]
movaps xmmword [rbx], xmm1
cmp eax, 0x6b50cf62
je 0x140011ee0
xor eax, eax
test al, al
je 0x140011f30
jmp 0x140011f5e
sub rsp, 0x20
call fcn.1400fba70
add rsp, 0x20
and eax, 0x4000
xor ecx, ecx
jmp 0x140011e6e
mov eax, dword [0x141dc0190]
and eax, dword [0x141dc0194]
imul eax, eax, 0xcf898cd6
xor eax, 0x8c31c742
imul rax, rax, 0x10c54ff
shr rax, 0x37
movaps xmmword [r15 + 0x20], xmm0
cmp eax, 0xa9201121
jbe 0x140011f65
movaps xmmword [r15 + 0x20], xmm0
jmp 0x140011f30
mov eax, dword [0x141dc0198]
xor eax, dword [0x141dc019c]
or eax, 0xffe673e7
mov ecx, 0xd71a19c7
imul rcx, rax
shr rcx, 0x3f
cmp ecx, 0xa1f5954c
jne 0x140011f93
xorps xmm0, xmm0
movaps xmmword [r15 + 0x30], xmm0
xorps xmm0, xmm0
mov al, 1
nop dword [rax + rax]
movaps xmmword [r15 + 0x30], xmm0
test al, al
je 0x140011fa0
jmp 0x140012004
mov esi, dword [0x141dc01a8]
imul esi, dword [0x141dc01ac]
add esi, 0xb74c44c0
and esi, 0x6863a0af
sub rsp, 0x20
lea r8, [0x141db8260]
lea rdx, [rbp - 0x30]
mov rcx, rbx
call fcn.1400707d0
add rsp, 0x20
cmp esi, 0x9465f80f
jne 0x140012004
sub rsp, 0x20
lea r8, [0x141db8260]
lea rdx, [rbp - 0x30]
mov rcx, rbx
call fcn.1400707d0
add rsp, 0x20
jmp 0x140011fab
mov eax, dword [0x141dc01b0]
xor eax, dword [0x141dc01b4]
and eax, 0x40300208
cmp eax, 0xe7b9b12a
jne 0x140012032
movaps xmm0, xmmword [rbx]
movaps xmm1, xmmword [rbx + 0x10]
movaps xmm2, xmmword [rbx + 0x20]
movaps xmmword [rdi + 0x20], xmm2
movaps xmmword [rdi + 0x10], xmm1
movaps xmmword [rdi], xmm0
mov eax, 0xd2faa441
nop word [rax + rax]
mov ecx, dword [0x141dc01b8]
and ecx, dword [0x141dc01bc]
add ecx, 0x542fa31e
or ecx, 0x2058b309
imul rcx, rax
shr rcx, 0x3e
movaps xmm0, xmmword [rbx]
movaps xmm1, xmmword [rbx + 0x10]
movaps xmm2, xmmword [rbx + 0x20]
movaps xmmword [rdi + 0x20], xmm2
movaps xmmword [rdi + 0x10], xmm1
movaps xmmword [rdi], xmm0
cmp ecx, 0xe7fae69a
je 0x140012040
mov eax, dword [0x141dc01d8]
and eax, dword [0x141dc01dc]
or eax, 0xfb7ffdbf
cmp eax, 0x5aa92f25
jne 0x1400120ad
mov qword [rdi + 0x40], 0
mov rax, 0xffffffffffffff00
add rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
mov rax, 0xffffffffffffff00
mov r14, qword [rbp - 0x38]
nop dword [rax + rax]
mov ecx, dword [0x141dc01e0]
xor ecx, dword [0x141dc01e4]
imul ecx, ecx, 0x8b0de705
add ecx, 0x16fe34ec
mov rdx, qword [rdi + 0x30]
add rdx, rax
mov qword [rdi + 0x40], 0
mov qword [rdi + 0x38], rdx
cmp ecx, 0xb51fed29
ja 0x1400120c0
xor eax, eax
test al, al
je 0x14001210c
sub rsp, 0x20
mov rcx, rdi
mov rdx, r14
call fcn.1400708f0
add rsp, 0x20
mov esi, 0xc39d3683
nop word cs:[rax + rax]
mov eax, dword [0x141dc01e8]
imul eax, dword [0x141dc01ec]
or eax, 0xa3cfc9fd
imul ebx, eax, 0x60a5573
shr ebx, 1
imul rbx, rsi
shr rbx, 0x3c
sub rsp, 0x20
mov rcx, rdi
mov rdx, r14
call fcn.1400708f0
add rsp, 0x20
cmp ebx, 0x38d09c4f
ja 0x140012120
movaps xmm6, xmmword [rbp - 0x10]
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret