Function at 0x14001b4c0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x13c0]
mov eax, 0x14c0
call fcn.140032650
sub rsp, rax
movaps xmmword [rsp + 0x14b0], xmm6
mov rax, qword [0x1400850b0]
xor rax, rsp
mov qword [rbp + 0x13a0], rax
xor r12d, r12d
mov dword [rsp + 0x34], r12d
mov byte [rsp + 0x30], r12b
mov dword [rsp + 0x38], r12d
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x38]
call fcn.14001bd20
call fcn.140003340
mov rbx, rax
movzx ecx, byte [rsp + 0x30]
mov byte [rax + 0x160], cl
movabs rax, 0x3fb999999999999a
mov qword [rbx + 0x168], rax
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x68], r12
mov qword [rbp - 0x60], 0xf
mov byte [rbp - 0x78], r12b
lea r8d, [r12 + 0xe]
lea rdx, str.rsDNSClientSvc
lea rcx, [rbp - 0x78]
call fcn.140007b00
nop
lea rdx, [rbp - 0x78]
lea rcx, [rbp - 0x58]
call fcn.140029f00
lea rcx, [rbx + 0x80]
mov rdx, rax
call fcn.140006860
mov rdx, qword [rbp - 0x40]
cmp rdx, 8
jb 0x14001b5cb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b5c6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001bcf0
call fcn.140031c90
mov qword [rbp - 0x48], r12
mov qword [rbp - 0x40], 7
mov word [rbp - 0x58], r12w
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x14001b617
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b612
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001bcf6
call fcn.140031c90
mov rcx, rbx
call fcn.140003c50
test al, al
jne 0x14001b62b
mov rcx, rbx
call fcn.1400036c0
call fcn.140003340
movzx edx, byte [rax + 0x160]
lea rcx, [rbp - 0x18]
call fcn.140001f30
mov r15, rax
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x48], r12
mov qword [rbp - 0x40], 0xf
mov byte [rbp - 0x58], 0
xor r8d, r8d
lea rdx, [0x14007204b]
lea rcx, [rbp - 0x58]
call fcn.140007b00
mov ebx, 1
mov dword [rsp + 0x34], ebx
mov r14d, dword [rsp + 0x38]
mov ecx, r14d
lea rsi, str.Unknown
lea edi, [rbx + 8]
test r14d, r14d
je 0x14001b6ac
sub ecx, ebx
je 0x14001b6a3
cmp ecx, ebx
je 0x14001b697
mov rdx, rsi
jmp 0x14001b6b3
lea rdx, str.Uninstall
mov r8, rdi
jmp 0x14001b6b9
lea rdx, str.Install
jmp 0x14001b6b3
lea rdx, str.Regular
mov r8d, 7
lea rcx, [rbp - 0x58]
call fcn.140007b00
mov r9d, 0x1f
lea r8, str.rsClientSvc_starting_with_mode
lea rcx, [rbp - 0x58]
call fcn.14000b050
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x68], r12
mov qword [rbp - 0x60], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x68], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov dword [rsp + 0x34], 3
mov r8d, 6
lea rdx, str._dev:
lea rcx, [rbp - 0x78]
call fcn.140007c60
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x28], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov dword [rsp + 0x34], 7
mov r9, r15
lea r8, [rbp - 0x38]
lea rcx, [rsp + 0x68]
call fcn.14000a030
mov dword [rsp + 0x34], 0xf
lea rcx, [rsp + 0x68]
call fcn.1400283a0
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x14001b7a6
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b7a0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001bcfc
call fcn.140031c90
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x14001b7e1
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b7dc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001bd02
call fcn.140031c90
mov qword [rbp - 0x68], r12
mov qword [rbp - 0x60], 0xf
mov byte [rbp - 0x78], 0
mov dword [rsp + 0x34], 0xe
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x14001b834
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b82f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001bd08
call fcn.140031c90
mov qword [rbp - 0x48], r12
mov qword [rbp - 0x40], 0xf
mov byte [rbp - 0x58], 0
mov rdx, qword [rbp]
cmp rdx, 0x10
jb 0x14001b87f
inc rdx
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b87a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001bd0e
call fcn.140031c90
call fcn.14001d780
call fcn.140023aa0
mov edx, eax
test eax, eax
jne 0x14001b938
call fcn.140030e78
mov dword [rbp + 0x1394], 0xffffffff
mov dword [rbp + 0x14], eax
nop word [rax + rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, ebx
mov dword [rbp + rbx*4 + 0x14], eax
inc rbx
cmp rbx, 0x270
jb 0x14001b8b0
mov dword [rbp + 0x10], 0x270
lea rcx, [rbp + 0x10]
call fcn.14001ce40
mov r8d, eax
mov eax, 0x6680a41
mul r8d
mov ecx, r8d
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 9
cmp ecx, 0x419a02
jae 0x14001b8d6
mov eax, 0x6680a41
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 9
imul eax, eax, 0x3e7
sub r8d, eax
lea ecx, [r8 - 0x7fffffff]
mov r8d, 0x80000000
lea eax, [rcx + r8]
lea edx, [rcx - 0x80000000]
cmp ecx, r8d
cmovae edx, eax
movd xmm6, edx
cvtdq2pd xmm6, xmm6
divsd xmm6, qword [0x140079388]
call fcn.140003340
movsd xmm1, qword [rax + 0x168]
movzx eax, byte [0x14008887a]
mov byte [0x140088878], al
test al, al
jne 0x14001b98d
xorps xmm0, xmm0
comisd xmm6, xmm0
jb 0x14001b989
comisd xmm1, xmm0
jbe 0x14001b989
movsd xmm0, qword [0x140079380]
comisd xmm0, xmm1
jb 0x14001b989
comisd xmm1, xmm6
ja 0x14001b98d
xor al, al
jmp 0x14001b98f
mov al, 1
mov byte [0x140088879], al
lea rax, [rbp - 0x58]
mov qword [rsp + 0x40], rax
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x68], r12
mov qword [rbp - 0x60], 0xf
mov byte [rbp - 0x78], 0
xor r8d, r8d
lea rdx, [0x14007204b]
lea rcx, [rbp - 0x78]
call fcn.140007b00
mov dword [rsp + 0x34], 0x1e
mov ecx, r14d
test r14d, r14d
je 0x14001b9f1
sub ecx, 1
je 0x14001b9e8
cmp ecx, 1
jne 0x14001b9f8
lea rsi, str.Uninstall
jmp 0x14001b9fd
lea rsi, str.Install
jmp 0x14001b9f8
lea rsi, str.Regular
mov edi, 7
mov r8, rdi
mov rdx, rsi
lea rcx, [rbp - 0x78]
call fcn.140007b00
mov r9d, 0x1c
lea r8, str.rsClientSvc_running_in_mode
lea rcx, [rbp - 0x78]
call fcn.14000b050
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x48], r12
mov qword [rbp - 0x40], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x48], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov dword [rsp + 0x34], 0x3e
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x20], 0xf
mov r8d, 4
lea rdx, str.Main
lea rcx, [rbp - 0x38]
call fcn.140007b00
nop
lea rdx, [rbp - 0x58]
lea rcx, [rbp - 0x38]
call fcn.1400196f0
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x14001bac4
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001babf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001bd14
call fcn.140031c90
call fcn.140003340
lea rdx, [rax + 0xc0]
lea rcx, [rbp - 0x18]
call fcn.140006940
mov rbx, rax
mov rdx, rax
cmp qword [rax + 0x18], 8
jb 0x14001bae9
mov rdx, qword [rax]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14001bbce
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x14001bb50
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14001bb4b
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001bcea
mov rcx, r8
call fcn.140031c90
mov word [rbx], r12w
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 7
lea rax, [rbp - 0x38]
mov qword [rsp + 0x40], rax
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x20], 0xf
mov r8d, 0x21
lea rdx, str.Product_registry_entry_is_missing
lea rcx, [rbp - 0x38]
call fcn.140007b00
nop
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x68], r12
mov qword [rbp - 0x60], 0xf
mov r8d, 4
lea rdx, str.Main
lea rcx, [rbp - 0x78]
call fcn.140007b00
nop
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x78]
call fcn.1400199a0
mov eax, 0xfffffffe
jmp 0x14001bcba
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x14001bc18
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14001bc13
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001bcea
mov rcx, r8
call fcn.140031c90
mov word [rbx], r12w
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 7
cmp r14d, 1
jne 0x14001bc38
call fcn.14001c0a0
jmp 0x14001bcba
cmp r14d, 2
jne 0x14001bc45
call fcn.14001c6e0
jmp 0x14001bcba
call fcn.140003340
sub rax, 0xffffffffffffff80
cmp qword [rax + 0x18], 8
jb 0x14001bc58
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
lea rax, [0x14001c880]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r12
lea rcx, [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
test eax, eax
jne 0x14001bc89
mov eax, 0xfffffffd
jmp 0x14001bcba
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x20], 7
mov r8d, 0x17
lea rdx, str.rsClientSvc:_Main:_Exit
lea rcx, [rbp - 0x38]
call fcn.140007930
lea rcx, [rbp - 0x38]
call fcn.140028440
xor eax, eax
mov rcx, qword [rbp + 0x13a0]
xor rcx, rsp
call fcn.140031c70
lea r11, [rsp + 0x14c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.1400447c4
nop
call fcn.1400447c4
nop
call fcn.1400447c4
nop
call fcn.1400447c4
nop
call fcn.1400447c4
nop
call fcn.1400447c4
nop
call fcn.1400447c4
int3
call fcn.1400447c4
int3