Function at 0x1400030d0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1400]
mov eax, 0x1500
call fcn.140008050
sub rsp, rax
mov rax, qword [0x14000e040]
xor rax, rsp
mov qword [rbp + 0x13f8], rax
xor esi, esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
mov qword [rbp + 0x40], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 8], xmm0
mov qword [rbp + 8], rax
lea rcx, [0x1400096c8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x140003177
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Failed_to_get_handle_for_ntdll.dll._Error:
mov ebx, eax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140005460
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140005640]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400038d3
mov r9d, 0x18
lea r8, [rbp - 8]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
test eax, eax
jne 0x1400031a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Failed_to_get_module_information_for_ntdll.dll._Error:
jmp 0x140003149
mov rbx, qword [rbp - 8]
mov qword [rbp - 0x78], rbx
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
mov r8d, 1
lea rcx, str.c:windows_system32_ntdll.dll
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r13, rax
mov qword [rsp + 0x78], rax
cmp rax, 0xffffffffffffffff
jne 0x1400031f4
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Failed_to_open_ntdll.dll_file._Error:
jmp 0x140003149
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor edx, edx
mov r8d, 0x1000002
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rdi, rax
mov qword [rbp - 0x70], rax
test rax, rax
jne 0x140003261
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdx, str.Failed_to_create_file_mapping_for_ntdll.dll._Error:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140005460
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140005640]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400038d3
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
mov edx, 4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rbp - 0x80], rax
test rax, rax
jne 0x1400032d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdx, str.Failed_to_map_view_of_ntdll.dll._Error:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140005460
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140005640]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400038d3
movsxd r15, dword [rbx + 0x3c]
add r15, rbx
mov qword [rsp + 0x58], r15
xorps xmm0, xmm0
movzx ebx, word [r15 + 6]
movdqu xmmword [rbp + 0x28], xmm0
mov qword [rbp + 0x38], rsi
test rbx, rbx
je 0x140003379
lea rbx, [rbx*4]
test rbx, rbx
jne 0x14000330d
mov r12, rsi
mov qword [rsp + 0x40], rsi
jmp 0x140003355
cmp rbx, 0x1000
jb 0x140003345
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x14000390e
call fcn.140007104
test rax, rax
je 0x1400038c4
lea r12, [rax + 0x27]
and r12, 0xffffffffffffffe0
mov qword [rsp + 0x40], r12
mov qword [r12 - 8], rax
jmp 0x140003355
mov rcx, rbx
call fcn.140007104
mov r12, rax
mov qword [rsp + 0x40], rax
mov qword [rbp + 0x28], r12
lea rdi, [rbx + r12]
mov qword [rsp + 0x48], rdi
mov qword [rbp + 0x38], rdi
mov r8, rbx
xor edx, edx
mov rcx, r12
call sub.VCRUNTIME140.dll_memset
mov qword [rbp + 0x30], rdi
jmp 0x14000338b
mov rdi, qword [rbp + 0x30]
mov qword [rsp + 0x48], rdi
mov r12, qword [rbp + 0x28]
mov qword [rsp + 0x40], r12
mov ecx, esi
cmp si, word [r15 + 6]
jae 0x1400033b1
mov rdx, r12
nop word [rax + rax]
mov dword [rdx], ecx
inc ecx
lea rdx, [rdx + 4]
movzx eax, word [r15 + 6]
cmp ecx, eax
jl 0x1400033a0
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov r8d, 0xffffffff
mov dword [rbp + 0x13d4], r8d
mov dword [rbp + 0x54], eax
mov edx, 1
nop dword [rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rbp + rdx*4 + 0x54], eax
inc rdx
cmp rdx, 0x270
jb 0x1400033d0
mov dword [rbp + 0x50], 0x270
mov rsi, 0xffffffffffffffff
mov r14d, 0x40
lea r14, [r14 - 1]
shr rsi, 1
cmp rsi, r8
ja 0x140003403
cmp r12, rdi
je 0x1400034f6
lea rax, [r12 + 4]
mov qword [rsp + 0x68], rax
cmp rax, rdi
je 0x1400034f6
mov r13d, 2
nop dword [rax]
nop word [rax + rax]
lea r15, [r13 - 1]
xor r12d, r12d
nop word [rax + rax]
mov rdi, r12
mov rbx, r12
test r15, r15
je 0x140003495
nop dword [rax + rax]
lea rcx, [r14 - 1]
shl rdi, cl
add rdi, rdi
nop word [rax + rax]
lea rcx, [rbp + 0x50]
call fcn.140006380
mov eax, eax
cmp rax, rsi
ja 0x140003470
or rdi, rax
lea rcx, [r14 - 1]
shl rbx, cl
add rbx, rbx
or rbx, rsi
cmp rbx, r15
jb 0x140003460
xor edx, edx
mov rax, rbx
div r13
mov r8, rdx
mov rcx, rax
xor edx, edx
mov rax, rdi
div r13
cmp rax, rcx
jb 0x1400034b5
cmp r8, r15
jne 0x140003450
cmp rdx, r15
mov r12, qword [rsp + 0x40]
mov r8, qword [rsp + 0x68]
je 0x1400034d2
mov ecx, dword [r8]
mov eax, dword [r12 + rdx*4]
mov dword [r8], eax
mov dword [r12 + rdx*4], ecx
inc r13
add r8, 4
mov qword [rsp + 0x68], r8
mov rdi, qword [rsp + 0x48]
cmp r8, rdi
jne 0x140003440
mov r15, qword [rsp + 0x58]
mov r13, qword [rsp + 0x78]
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x10], xmm1
xor r14d, r14d
mov qword [rbp + 0x20], r14
cmp r12, rdi
je 0x140003745
lea r9, [0x140002f80]
lea rdi, vtable.std::_Task_async_state_void_.0
mov rsi, qword [rbp - 0x78]
mov r14, qword [rbp + 0x40]
mov r13, qword [rbp - 0x80]
nop dword [rax + rax]
movsxd rax, dword [r12]
lea rdx, [rax*4 + 3]
movzx ecx, word [r15 + 0x14]
add rcx, r15
add rdx, rax
lea r8, [rcx + rdx*8]
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], r8
mov qword [rbp - 0x58], r13
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], r14
mov qword [rbp - 0x40], r9
mov ecx, 0x120
call fcn.140007104
mov rbx, rax
mov qword [rbp + 0x40], rax
xor edx, edx
mov r8d, 0x120
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp - 0x68]
mov rcx, rbx
call fcn.140006530
nop
mov qword [rbx], rdi
lea rdi, [rbx + 0x110]
xor eax, eax
mov qword [rdi], rax
mov qword [rdi + 8], rax
lea rax, [rbp - 0x68]
mov qword [rbp - 0x78], rax
call fcn.140001570
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x1400035c5
lock inc dword [rcx + 8]
mov rcx, qword [rax]
mov qword [rsp + 0x58], rcx
mov rax, qword [rax + 8]
mov qword [rsp + 0x60], rax
mov qword [rbp - 0x68], rcx
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rcx
mov qword [rbp - 0x50], 0
lea rcx, [rbp - 0x48]
call qword [sym.imp.MSVCP140.dll_private:_void___cdecl_Concurrency::task_continuation_context::constructor_void____ptr64]
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x28], xmm0
xor eax, eax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x30], rax
mov byte [rbp - 0x38], al
mov word [rbp - 0x10], ax
lea r8, [rbp - 0x68]
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.140006630
cmp rdi, rax
je 0x14000362e
mov rdx, rax
mov rcx, rdi
call fcn.140005390
mov rdi, qword [rsp + 0x70]
test rdi, rdi
je 0x140003667
mov eax, 0xffffffff
lock xadd dword [rdi + 8], eax
cmp eax, 1
jne 0x140003667
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
mov eax, 0xffffffff
lock xadd dword [rdi + 0xc], eax
cmp eax, 1
jne 0x140003667
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 8]
mov byte [rbx + 0xc2], 1
mov qword [rsp + 0x48], rbx
mov byte [rsp + 0x50], 1
lock inc dword [rbx + 8]
mov eax, 0xffffffff
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x1400036af
mov rcx, qword [rbx + 0xc8]
test rcx, rcx
je 0x1400036a1
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax]
jmp 0x1400036af
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
nop
mov rdx, qword [rbp + 0x18]
cmp rdx, qword [rbp + 0x20]
je 0x1400036ce
xor ecx, ecx
mov qword [rsp + 0x48], rcx
mov qword [rdx], rbx
mov byte [rdx + 8], 1
add qword [rbp + 0x18], 0x10
jmp 0x1400036e1
lea r8, [rsp + 0x48]
lea rcx, [rbp + 0x10]
call fcn.140005a90
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14000371d
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14000371d
mov rcx, qword [rsp + 0x48]
mov r8, qword [rcx + 0xc8]
test r8, r8
je 0x140003713
mov rax, qword [r8]
mov rdx, rcx
mov rcx, r8
call qword [rax]
jmp 0x14000371d
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
add r12, 4
cmp r12, qword [rbp + 0x30]
lea r9, [0x140002f80]
lea rdi, vtable.std::_Task_async_state_void_.0
jne 0x140003530
mov r12, qword [rbp + 0x28]
mov r13, qword [rsp + 0x78]
xor r14d, r14d
mov rdi, qword [rbp + 0x10]
mov rsi, qword [rbp + 0x18]
cmp rdi, rsi
je 0x1400037c8
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
mov rbx, qword [rdi]
mov qword [rdi], r14
mov qword [rbp + 0x40], rbx
mov byte [rbp + 0x48], 1
test rbx, rbx
je 0x140003903
cmp byte [rbx + 0xb8], 0
jne 0x140003903
mov rax, qword [rbx]
mov dl, 1
mov rcx, rbx
call qword [rax + 0x10]
nop
mov eax, 0xffffffff
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x1400037bb
mov rcx, qword [rbx + 0xc8]
test rcx, rcx
je 0x1400037ae
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax]
jmp 0x1400037bb
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
add rdi, 0x10
cmp rdi, rsi
jne 0x140003752
mov r12, qword [rbp + 0x28]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rbx, qword [rbp + 0x10]
test rbx, rbx
je 0x140003892
mov rdi, qword [rbp + 0x18]
cmp rbx, rdi
je 0x14000384b
nop dword [rax]
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000383a
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14000383a
mov r8, qword [rcx + 0xc8]
test r8, r8
je 0x140003830
mov rax, qword [r8]
mov rdx, rcx
mov rcx, r8
call qword [rax]
jmp 0x14000383a
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
add rbx, 0x10
cmp rbx, rdi
jne 0x140003800
mov r12, qword [rbp + 0x28]
mov rbx, qword [rbp + 0x10]
mov rdx, qword [rbp + 0x20]
sub rdx, rbx
and rdx, 0xfffffffffffffff0
mov rax, rbx
cmp rdx, 0x1000
jb 0x14000387e
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000387e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.140007380
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], r14
test r12, r12
je 0x1400038d3
mov rdx, qword [rbp + 0x38]
sub rdx, r12
and rdx, 0xfffffffffffffffc
mov rax, r12
cmp rdx, 0x1000
jb 0x1400038cb
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400038cb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r12
call fcn.140007380
mov rcx, qword [rbp + 0x13f8]
xor rcx, rsp
call fcn.140007000
lea r11, [rsp + 0x1500]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 4
call fcn.140002da0
nop
call fcn.140001200
int3