Function at 0x1401e03a0
Capabilities:
Encode data using xor
Get memory capacity

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov r9, rcx
mov eax, dword [0x1415a8ed8]
mov ecx, dword [0x1415a8edc]
mov edx, ecx
not edx
mov r8d, eax
and r8d, edx
or edx, eax
not edx
imul edx, r8d
mov r8d, eax
and r8d, ecx
or eax, ecx
imul eax, r8d
add eax, edx
add eax, 0x5ecd3854
mov ecx, eax
not ecx
mov edx, eax
and edx, 0xa5dab874
and ecx, 0x5a25478b
imul ecx, edx
mov edx, eax
and edx, 0x5a25478b
or eax, 0x5a25478b
imul eax, edx
add eax, ecx
cmp eax, 0xd4853b0
je 0x1401e04d4
mov eax, dword [0x1415a8ee0]
or eax, dword [0x1415a8ee4]
mov ecx, eax
not ecx
mov edx, eax
and edx, 0x53536294
and ecx, 0xacac9d6b
imul ecx, edx
mov edx, eax
and edx, 0xacac9d6b
or eax, 0xacac9d6b
imul eax, edx
add eax, ecx
mov ecx, eax
not ecx
and ecx, 0xa1e17036
mov edx, eax
and edx, 0x5e1e8fc9
imul edx, ecx
mov ecx, eax
and ecx, 0xa1e17036
or eax, 0xa1e17036
imul eax, ecx
lea ecx, [rax + rdx]
add ecx, 0x1b18b0a9
mov eax, 0x70
call fcn.14020e090
sub rsp, rax
mov r13, rsp
mov eax, 0x40
call fcn.14020e090
sub rsp, rax
mov r10, rsp
mov eax, 0x10
call fcn.14020e090
sub rsp, rax
mov rdx, rsp
mov eax, 0x10
call fcn.14020e090
sub rsp, rax
mov r12, rsp
mov eax, 0xd0
call fcn.14020e090
sub rsp, rax
mov r8, rsp
cmp ecx, 0x86d17868
jbe 0x1401e051a
mov eax, 0x70
call fcn.14020e090
sub rsp, rax
mov eax, 0x40
call fcn.14020e090
sub rsp, rax
mov eax, 0x10
call fcn.14020e090
sub rsp, rax
mov eax, 0x10
call fcn.14020e090
sub rsp, rax
mov eax, 0xd0
call fcn.14020e090
sub rsp, rax
jmp 0x1401e041b
mov rbx, r8
nop dword [rax]
mov eax, dword [0x1415a8ee8]
mov ecx, dword [0x1415a8eec]
xor ecx, eax
not ecx
and ecx, eax
or ecx, 0x3f8027e6
imul rax, rcx, 0x110ed4d3
shr rax, 0x39
mov ecx, eax
xor ecx, 0xe6f7a854
and eax, 0xfffffffb
add eax, eax
sub eax, ecx
cmp eax, 0x1eb66a9d
je 0x1401e0520
mov eax, dword [0x1415acbd4]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x70]
nop word cs:[rax + rax]
mov ecx, dword [0x1415a8ef0]
sub ecx, dword [0x1415a8ef4]
imul ecx, ecx, 0xe740a2ff
xor ecx, 0xe868eeac
imul rcx, rcx, 0x73b77b3d
shr rcx, 0x3d
cmp ecx, 0xa83f9dc2
ja 0x1401e0580
test al, 1
mov qword [rbp - 0x20], r9
mov qword [rbp - 0x18], rdx
mov qword [rbp - 8], r8
mov qword [rbp], r10
je 0x1401e0668
nop word cs:[rax + rax]
mov eax, dword [0x1415a8f20]
mov ecx, dword [0x1415a8f24]
mov edx, eax
not edx
and edx, ecx
not ecx
and ecx, eax
sub ecx, edx
or ecx, 0x411
and ecx, 0x9100611
cmp ecx, 0x99a880c7
ja 0x1401e05d0
mov eax, dword [0x1415acbd4]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov r15, qword [rax + 0x78]
nop word cs:[rax + rax]
mov eax, dword [0x1415a8f28]
xor edx, edx
div dword [0x1415a8f2c]
and eax, 0x3fffffff
xor eax, 0x2b4eed68
add eax, 0xa16f8d27
or eax, 0xc77798ad
cmp eax, 0xa05545aa
jb 0x1401e0620
mov eax, dword [0x1415acbd4]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov r14, qword [rax + 0x80]
jmp 0x1401e081f
mov eax, dword [0x1415a8ef8]
or eax, dword [0x1415a8efc]
add eax, 0xd0dea7
mov ecx, 0xfc1fdceb
imul rcx, rax
shr rcx, 0x3e
imul eax, ecx, 0x5aa861a0
cmp eax, 0x68d8a153
ja 0x1401e06bd
mov eax, dword [0x1415a8f00]
add eax, dword [0x1415a8f04]
and eax, 0xe207f7f
xor eax, 0xc006178
add eax, 0xe3b7d477
xorps xmm0, xmm0
movups xmmword [r12], xmm0
cmp eax, 0x835b3e86
jae 0x1401e06c7
xorps xmm0, xmm0
movups xmmword [r12], xmm0
jmp 0x1401e0693
xor eax, eax
test al, al
je 0x1401e06fd
sub rsp, 0x20
mov edx, 0x10
mov rcx, r12
call qword [sym.imp.bcryptprimitives.dll_ProcessPrng]
add rsp, 0x20
mov eax, dword [0x1415acbd4]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov byte [rax + 0x70], 1
mov rdi, qword [sym.imp.bcryptprimitives.dll_ProcessPrng]
nop word cs:[rax + rax]
mov eax, dword [0x1415a8f08]
mov ecx, dword [0x1415a8f0c]
mov edx, eax
xor edx, ecx
not ecx
and ecx, eax
add ecx, ecx
sub ecx, edx
imul rsi, rcx, 0x4cc2970d
shr rsi, 0x3e
not esi
and esi, 0xc7f99349
xor esi, 0x647e2fcb
add esi, 0xc0112803
sub rsp, 0x20
mov edx, 0x10
mov rcx, r12
call rdi
add rsp, 0x20
mov r15, qword [r12]
mov r14, qword [r12 + 8]
mov eax, dword [0x1415acbd4]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov byte [rax + 0x70], 1
cmp esi, 0x6875f684
ja 0x1401e0710
mov eax, dword [0x1415a8f10]
and eax, dword [0x1415a8f14]
mov ecx, eax
not ecx
or ecx, 0x201
and ecx, 0x30440315
mov edx, eax
and edx, 0x4c020000
or edx, ecx
xor edx, 0x40600215
and eax, 0x70040100
or eax, edx
or eax, 0x8399fc4a
cmp eax, 0x61e571bc
jb 0x1401e0803
mov eax, dword [0x1415acbd4]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov ecx, dword [0x1415a8f18]
imul ecx, dword [0x1415a8f1c]
imul rcx, rcx, 0x61079a41
shr rcx, 0x3d
xor ecx, 0x7ec455d5
mov qword [rax + 0x80], r14
cmp ecx, 0x694d385f
jne 0x1401e081f
mov eax, dword [0x1415acbd4]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov qword [rax + 0x80], r14
jmp 0x1401e07c3
mov qword [rbp - 0x10], r13
movabs rax, 0x9825be49b2404d6f
mov rcx, r15
sub rcx, rax
add rax, rcx
inc rax
mov ecx, dword [0x1415acbd4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov qword [rcx + 0x78], rax
movzx eax, byte [0x1415acbd0]
sub rsp, 0x20
mov edx, 0x58410
xor ecx, ecx
call fcn.1401ac910
add rsp, 0x20
test rax, rax
je 0x1401e08de
mov r12, rax
mov eax, dword [0x1415a8f30]
or eax, dword [0x1415a8f34]
movabs rdi, 0x8000000000000000
mov ecx, eax
not ecx
and ecx, 0x10c855cc
mov edx, eax
and edx, 0xef37aa33
imul edx, ecx
mov ecx, eax
and ecx, 0x10c855cc
or eax, 0x10c855cc
imul eax, ecx
lea ecx, [rax + rdx]
add ecx, 0x43ceaf06
add eax, edx
mov edx, 0xbc3150f9
sub edx, eax
and edx, 0x6f3aae7d
and ecx, 0x90c55182
or ecx, edx
cmp ecx, 0xd3b8e028
jne 0x1401e092a
jmp 0x1401e09ba
mov eax, dword [0x1415a8f40]
mov ecx, dword [0x1415a8f44]
mov edx, ecx
not edx
mov r8d, eax
and r8d, edx
or edx, eax
not edx
imul edx, r8d
mov r8d, eax
and r8d, ecx
or eax, ecx
imul eax, r8d
add eax, edx
or eax, 0xffbffff2
imul rax, rax, 0x69553b2f
shr rax, 0x3d
cmp eax, 0x64ebc130
jbe 0x1401e0db3
jmp 0x1401e0dbb
mov eax, dword [0x1415a8f38]
xor edx, edx
div dword [0x1415a8f3c]
or eax, 0x22016cf0
imul rsi, rax, 0xaea38e1
shr rsi, 0x3a
mov eax, esi
not eax
and eax, 0xe9459c71
mov ecx, esi
and ecx, 0xfffffffe
imul ecx, eax
mov eax, esi
and eax, 1
or esi, 0xe9459c71
imul esi, eax
add esi, ecx
lea r13, [r12 + 0x58000]
sub rsp, 0x20
mov r8d, 0x410
mov rcx, r13
mov dl, 0xff
call fcn.14021c2d0
add rsp, 0x20
xorps xmm0, xmm0
movups xmmword [rbx + 0x70], xmm0
movups xmmword [rbx + 0x80], xmm0
mov qword [rbx], 0
mov qword [rbx + 8], 8
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], rdi
cmp esi, 0xc9948418
jbe 0x1401e0a05
lea rcx, [r12 + 0x58000]
sub rsp, 0x20
mov r8d, 0x410
mov dl, 0xff
call fcn.14021c2d0
add rsp, 0x20
xorps xmm0, xmm0
movups xmmword [rbx + 0x70], xmm0
movups xmmword [rbx + 0x80], xmm0
mov qword [rbx], 0
mov qword [rbx + 8], 8
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], rdi
jmp 0x1401e092a
mov dword [rbx + 0x30], 0
mov byte [rbx + 0x38], 0
mov qword [rbx + 0x40], r13
mov qword [rbx + 0x48], 0x3ff
mov qword [rbx + 0x50], 0x380
mov qword [rbx + 0x58], 0
mov qword [rbx + 0x60], r15
mov qword [rbx + 0x68], r14
mov qword [rbx + 0x90], 0
mov rdi, qword [rbp]
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x30], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x10], xmm0
mov dword [rdi], 0x40
sub rsp, 0x20
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
add rsp, 0x20
test eax, eax
jne 0x1401e0b00
mov eax, dword [0x1415a8f48]
and eax, dword [0x1415a8f4c]
mov ecx, eax
not ecx
and ecx, 0xabc85d28
and eax, 0x5437a2d7
sub eax, ecx
add eax, 0x30166036
mov ecx, eax
not ecx
and ecx, 0xb8e8e850
mov edx, eax
and edx, 0x471717af
imul edx, ecx
mov ecx, eax
and ecx, 0xb8e8e850
or eax, 0xb8e8e850
imul eax, ecx
add eax, edx
cmp eax, 0x96907572
je 0x1401e0af1
mov eax, dword [0x1415a8f50]
mov ecx, dword [0x1415a8f54]
lea esi, [rax + rcx]
add esi, 0xfd6a22f6
xor esi, 0x3c54fdef
sub rsp, 0x20
call sub.KERNEL32.dll_GetLastError
add rsp, 0x20
cmp esi, 0x9178963a
jbe 0x1401e0b00
sub rsp, 0x20
call sub.KERNEL32.dll_GetLastError
add rsp, 0x20
jmp 0x1401e0ac1
mov r8, qword [rbp - 8]
add r8, 0x70
movups xmm0, xmmword [rdi + 8]
mov eax, dword [0x1415a8f58]
add eax, dword [0x1415a8f5c]
mov ecx, 0xe3b8bc8d
imul rcx, rax
shr rcx, 0x3f
imul eax, ecx, 0x75d2fd8a
add eax, 0x8d47c5eb
cmp eax, 0x6dbd71b8
mov r14, qword [rbp - 0x20]
mov r15, qword [rbp - 0x18]
mov rdi, qword [rbp - 0x10]
jb 0x1401e0b94
mov eax, dword [0x1415a8f60]
mov ecx, dword [0x1415a8f64]
add eax, ecx
add eax, 0x8e249f85
mov ecx, eax
not ecx
mov edx, eax
and edx, 0xf433be87
and ecx, 0xbcc4178
imul ecx, edx
mov edx, eax
and edx, 0xbcc4178
or eax, 0xbcc4178
imul eax, edx
add eax, ecx
mov ecx, eax
and ecx, 0x20ab380
add ecx, ecx
sub eax, ecx
movups xmmword [r8], xmm0
cmp eax, 0x230d409c
jne 0x1401e0b9a
movups xmmword [r8], xmm0
jmp 0x1401e0b43
xorps xmm0, xmm0
movups xmmword [rdi + 0x50], xmm0
movups xmmword [rdi + 0x40], xmm0
movups xmmword [rdi + 0x30], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x60], 0
sub rsp, 0x20
mov rcx, rdi
mov edx, 0x68
call qword [sym.imp.KERNEL32.dll_K32GetPerformanceInfo]
add rsp, 0x20
test eax, eax
je 0x1401e0cb5
nop word [rax + rax]
mov eax, dword [0x1415a8f68]
and eax, dword [0x1415a8f6c]
add eax, 0x58db92be
mov ecx, eax
and ecx, 0x2b44ec87
add ecx, ecx
sub eax, ecx
cmp eax, 0xccc10b99
je 0x1401e0be0
mov r8, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x50]
xor r9d, r9d
mov r10, 0xffffffffffffffff
nop word cs:[rax + rax]
mov eax, dword [0x1415a8f70]
mov edx, dword [0x1415a8f74]
not edx
mov r11d, eax
or r11d, edx
and edx, eax
not r11d
or r11d, edx
mov esi, r11d
and esi, 0x771acf97
xor esi, 0x62108982
or esi, 0x8e50000
xor r11d, 3
and r11d, 0x11100193
and esi, 0x6eefce04
or esi, r11d
xor esi, 0xf5c61060
mov rdx, qword [rdi + 0x10]
sub rdx, r8
cmovb rdx, r9
mov rax, rcx
mul rdx
cmovo rax, r10
cmp esi, 0x6fe3e91a
jb 0x1401e0c20
mov rdx, qword [rdi + 8]
mov qword [rbx + 0x80], rax
xor r9d, r9d
sub rdx, r8
cmovae r9, rdx
mov rax, rcx
mul r9
mov rcx, 0xffffffffffffffff
cmovno rcx, rax
mov qword [rbx + 0x88], rcx
movabs rsi, 0x202020202020101
mov eax, dword [0x1415a8f78]
add eax, dword [0x1415a8f7c]
shr eax, 1
mov ecx, 0x946cdaef
imul rcx, rax
shr rcx, 0x3d
add ecx, 0xab82caa2
mov eax, ecx
not eax
mov edx, ecx
and edx, 0x22008201
and eax, 0x143d0446
imul eax, edx
mov edx, ecx
and edx, 0x898248a6
or ecx, 0x9dbf4ce6
imul ecx, edx
add ecx, eax
cmp ecx, 0x7c386682
jbe 0x1401e0d50
sub rsp, 0x20
mov rcx, rbx
mov dl, 1
call fcn.1401b2290
add rsp, 0x20
mov byte [r15], 1
mov qword [r15 + 1], rsi
sub rsp, 0x20
mov rcx, rbx
mov rdx, r15
call fcn.14020db00
mov r8d, 0xd0
mov rcx, r14
mov rdx, rbx
call fcn.14021bb50
add rsp, 0x20
nop dword [rax]
mov edi, dword [0x1415a8f80]
or edi, dword [0x1415a8f84]
sub rsp, 0x20
mov rcx, rbx
mov dl, 1
call fcn.1401b2290
add rsp, 0x20
mov byte [r15], 1
mov qword [r15 + 1], rsi
sub rsp, 0x20
mov rcx, rbx
mov rdx, r15
call fcn.1401b39f0
mov r8d, 0xd0
mov rcx, r14
mov rdx, rbx
call fcn.14021bb50
add rsp, 0x20
cmp edi, 0xe0b65d8f
je 0x1401e0d50
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
ud2
ud2