Function at 0x1400daef0
Capabilities:
Encode data using xor
Get memory capacity

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x18
lea rbp, [rsp + 0x10]
mov eax, dword [0x141dd8ad0]
add eax, dword [0x141dd8ad4]
xor eax, 0x8d94b052
imul rax, rax, 0x372ce0e1
shr rax, 0x3d
imul eax, eax, 0x8dc2fa0c
cmp eax, 0xdd991d7e
jne 0x1400daf40
mov eax, 0x70
call fcn.1400ef330
sub rsp, rax
nop dword [rax + rax]
mov eax, dword [0x141dd8ad8]
imul eax, dword [0x141dd8adc]
imul edx, eax, 0xcd85ff31
add edx, 0xc99b2bdb
and edx, 0x6986c444
mov eax, 0x70
call fcn.1400ef330
sub rsp, rax
mov r8, rsp
cmp edx, 0x5f4c30a8
jb 0x1400daf40
mov eax, dword [0x141dd8ae0]
sub eax, dword [0x141dd8ae4]
and eax, 0xc8800c00
or eax, 0x146fb3de
xor eax, 0x4847b221
cmp eax, 0xbd72b588
ja 0x1400dafe9
mov eax, dword [0x141dd8ae8]
xor edx, edx
div dword [0x141dd8aec]
imul edx, eax, 0xc1643332
imul rax, rdx, 0xb7f1c67
shr rax, 0x20
sub edx, eax
shr edx, 1
add edx, eax
shr edx, 0x1e
mov eax, 0x40
call fcn.1400ef330
sub rsp, rax
mov r14, rsp
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov rdi, rsp
cmp edx, 0x78bb871d
jne 0x1400db005
mov eax, 0x40
call fcn.1400ef330
sub rsp, rax
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
jmp 0x1400daf99
mov eax, dword [0x141dd8af0]
xor edx, edx
div dword [0x141dd8af4]
cmp eax, 0x838122b4
je 0x1400db05f
mov eax, dword [0x141dd8af8]
imul eax, dword [0x141dd8afc]
xor eax, 0x85308836
and eax, 0x9d7aeff6
imul edx, eax, 0x3a19d448
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov r12, rsp
mov eax, 0xd0
call fcn.1400ef330
sub rsp, rax
mov rbx, rsp
cmp edx, 0xce870b70
jne 0x1400db07b
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov eax, 0xd0
call fcn.1400ef330
sub rsp, rax
jmp 0x1400db01a
mov eax, dword [0x141ddb27c]
mov rdx, qword gs:[0x58]
mov rax, qword [rdx + rax*8]
test byte [rax + 0x70], 1
mov qword [rbp - 0x10], rcx
mov qword [rbp - 8], r8
je 0x1400db163
nop word cs:[rax + rax]
mov eax, dword [0x141dd8b20]
mov edx, dword [0x141dd8b24]
add eax, edx
add eax, 0x8cf42260
imul rax, rax, 0x47ed671
shr rax, 0x33
or eax, 0x7a395836
cmp eax, 0x82db8ba6
je 0x1400db0b0
mov eax, dword [0x141ddb27c]
mov rdx, qword gs:[0x58]
mov rax, qword [rdx + rax*8]
mov rsi, qword [rax + 0x78]
nop word cs:[rax + rax]
mov eax, dword [0x141dd8b28]
sub eax, dword [0x141dd8b2c]
and eax, 0xf27c1392
imul eax, eax, 0x2b0e0780
xor eax, 0xe6d209cf
cmp eax, 0xab3c2ff4
ja 0x1400db100
mov eax, dword [0x141ddb27c]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov r15, qword [rax + 0x80]
nop dword [rax]
mov eax, dword [0x141dd8b30]
or eax, dword [0x141dd8b34]
or eax, 0xc7dd1a8
imul eax, eax, 0x3baf30eb
cmp eax, 0xd2e02675
je 0x1400db140
jmp 0x1400db275
xorps xmm0, xmm0
movups xmmword [r12], xmm0
sub rsp, 0x20
mov edx, 0x10
mov rcx, r12
call qword [sym.imp.bcryptprimitives.dll_ProcessPrng]
add rsp, 0x20
mov eax, dword [0x141dd8b00]
and eax, dword [0x141dd8b04]
cmp eax, 0x77f183d4
jne 0x1400db1b0
mov eax, dword [0x141ddb27c]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov byte [rax + 0x70], 1
nop
mov eax, dword [0x141dd8b08]
or eax, dword [0x141dd8b0c]
imul eax, eax, 0x6fa630d
add eax, 0xaf2ea79
mov rsi, qword [r12]
mov ecx, dword [0x141ddb27c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov r15, qword [r12 + 8]
mov byte [rcx + 0x70], 1
cmp eax, 0x77b22f17
ja 0x1400db1b0
mov eax, dword [0x141dd8b10]
xor edx, edx
div dword [0x141dd8b14]
add eax, 0x3ef98f7d
and eax, 0xde3c918d
cmp eax, 0x9c09ba93
jne 0x1400db230
mov eax, dword [0x141ddb27c]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov qword [rax + 0x80], r15
nop word [rax + rax]
mov eax, dword [0x141ddb27c]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov ecx, dword [0x141dd8b18]
xor ecx, dword [0x141dd8b1c]
or ecx, 0x67557d4b
imul rcx, rcx, 0x7ceffa83
shr rcx, 0x3c
or ecx, 0x6cc4eb4c
mov qword [rax + 0x80], r15
cmp ecx, 0xe42ee336
jae 0x1400db230
mov qword [rbp], r14
xor eax, eax
test al, al
jne 0x1400db2df
mov eax, dword [0x141dd8b38]
xor eax, dword [0x141dd8b3c]
add eax, 0xa4ad3909
shr eax, 1
imul r13, rax, 0x595c1111
shr r13, 0x3b
lea rax, [rsi + 1]
mov ecx, dword [0x141ddb27c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov qword [rcx + 0x78], rax
movzx eax, byte [0x141ddb278]
sub rsp, 0x20
mov edx, 0x58410
xor ecx, ecx
call fcn.1400c0180
add rsp, 0x20
cmp r13d, 0x1342fffd
jbe 0x1400db31d
lea rax, [rsi + 1]
mov ecx, dword [0x141ddb27c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov qword [rcx + 0x78], rax
movzx eax, byte [0x141ddb278]
sub rsp, 0x20
mov edx, 0x58410
xor ecx, ecx
call fcn.1400c0180
add rsp, 0x20
jmp 0x1400db27f
mov r12, rax
test rax, rax
je 0x1400db34d
mov eax, dword [0x141dd8b40]
imul eax, dword [0x141dd8b44]
or eax, 0xaf5658b0
add eax, 0x86c18399
or eax, 0x6d9012d8
cmp eax, 0x4a1ab8ef
jae 0x1400db3b6
jmp 0x1400db403
mov eax, dword [0x141dd8b50]
xor eax, dword [0x141dd8b54]
add eax, 0xa70dd3ee
mov ecx, 0x8b16c6b5
imul rcx, rax
shr rcx, 0x3f
imul eax, ecx, 0x228dd88f
cmp eax, 0x89e24ec5
jbe 0x1400db380
ud2
mov eax, dword [0x141dd8b58]
imul eax, dword [0x141dd8b5c]
or eax, 0x17c15ac6
imul eax, eax, 0x30d559f9
and eax, 0x1cccc4a3
ud2
mov eax, dword [0x141dd8b48]
and eax, dword [0x141dd8b4c]
imul eax, eax, 0x979b12cd
imul r14, rax, 0x6523a929
shr r14, 0x3e
add r14d, 0x96b509ef
lea r13, [r12 + 0x58000]
sub rsp, 0x20
mov r8d, 0x410
mov rcx, r13
mov dl, 0xff
call sub.VCRUNTIME140.dll_memset
add rsp, 0x20
cmp r14d, 0xc2eaa169
jbe 0x1400db422
lea rcx, [r12 + 0x58000]
sub rsp, 0x20
mov r8d, 0x410
mov dl, 0xff
call sub.VCRUNTIME140.dll_memset
add rsp, 0x20
jmp 0x1400db3b6
xorps xmm0, xmm0
movups xmmword [rbx + 0x80], xmm0
movups xmmword [rbx + 0x70], xmm0
mov qword [rbx], 0
mov qword [rbx + 8], 8
mov qword [rbx + 0x10], 0
movabs rax, 0x8000000000000000
mov qword [rbx + 0x18], rax
mov dword [rbx + 0x30], 0
mov byte [rbx + 0x38], 0
mov qword [rbx + 0x40], r13
mov qword [rbx + 0x48], 0x3ff
mov qword [rbx + 0x50], 0x380
mov qword [rbx + 0x58], 0
mov qword [rbx + 0x60], rsi
mov qword [rbx + 0x68], r15
mov qword [rbx + 0x90], 0
mov r14, qword [rbp]
movups xmmword [r14], xmm0
movups xmmword [r14 + 0x30], xmm0
movups xmmword [r14 + 0x20], xmm0
movups xmmword [r14 + 0x10], xmm0
mov dword [r14], 0x40
sub rsp, 0x20
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
add rsp, 0x20
test eax, eax
jne 0x1400db4f4
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
mov eax, dword [0x141dd8b60]
mov ecx, dword [0x141dd8b64]
add eax, ecx
add eax, 0xfc07d04a
or eax, 0x8c012a04
and eax, 0x8c57fa54
cmp eax, 0xbcc4a32c
je 0x1400db4d0
mov rcx, rbx
add rcx, 0x70
mov r15, qword [rbp - 0x10]
mov rsi, qword [rbp - 8]
nop word cs:[rax + rax]
mov eax, dword [0x141dd8b68]
and eax, dword [0x141dd8b6c]
add eax, 0xf04addef
and eax, 0x1e9cd1b9
cmp eax, 0x95fc17b2
ja 0x1400db510
mov eax, dword [0x141dd8b70]
xor edx, edx
div dword [0x141dd8b74]
add eax, 0x48a2d3a3
and eax, 0x8234adc3
cmp eax, 0xbdc6d0e0
jne 0x1400db554
movups xmm0, xmmword [r14 + 8]
movups xmmword [rcx], xmm0
mov eax, 0x8adb43f7
nop dword [rax]
mov edx, dword [0x141dd8b78]
and edx, dword [0x141dd8b7c]
imul rdx, rax
shr rdx, 0x3e
imul edx, edx, 0x4cdff19
or edx, 0x578119b
movups xmm0, xmmword [r14 + 8]
movups xmmword [rcx], xmm0
cmp edx, 0xf955e0ce
je 0x1400db560
xorps xmm0, xmm0
movups xmmword [rsi + 0x50], xmm0
movups xmmword [rsi + 0x40], xmm0
movups xmmword [rsi + 0x30], xmm0
movups xmmword [rsi + 0x20], xmm0
movups xmmword [rsi + 0x10], xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x60], 0
sub rsp, 0x20
mov rcx, rsi
mov edx, 0x68
call qword [sym.imp.KERNEL32.dll_K32GetPerformanceInfo]
add rsp, 0x20
test eax, eax
je 0x1400db6b8
mov rcx, qword [rsi + 0x50]
mov r9, qword [rsi + 0x20]
mov rdx, qword [rsi + 0x10]
xor r10d, r10d
sub rdx, r9
cmovb rdx, r10
mov r11, qword [rsi + 8]
mov rax, rcx
mul rdx
mov r8, 0xffffffffffffffff
cmovo rax, r8
mov qword [rbx + 0x80], rax
sub r11, r9
cmovb r11, r10
mov rax, rcx
mul r11
mov rcx, rax
seto r9b
mov eax, dword [0x141dd8b80]
imul eax, dword [0x141dd8b84]
and eax, 0x306d26d0
add eax, 0xb2e252c3
and eax, 0x838b0f81
cmp eax, 0x50e0b47e
je 0x1400db678
mov eax, dword [0x141dd8b88]
xor edx, edx
div dword [0x141dd8b8c]
or eax, 0xa92a13e7
imul eax, eax, 0x5d664d00
shr eax, 2
imul rax, rax, 0x411025d7
shr rax, 0x3c
test r9b, r9b
mov rdx, rcx
cmovne rdx, r8
mov qword [rbx + 0x88], rdx
cmp eax, 0x264607f7
jne 0x1400db690
test r9b, r9b
mov rax, rcx
cmovne rax, r8
mov qword [rbx + 0x88], rax
jmp 0x1400db639
mov eax, dword [0x141dd8b90]
and eax, dword [0x141dd8b94]
add eax, 0xbc9a5a0
imul rax, rax, 0x72d595db
shr rax, 0x3e
or eax, 0x8f908b48
cmp eax, 0x1a42414d
jb 0x1400db690
mov eax, dword [0x141dd8b98]
xor eax, dword [0x141dd8b9c]
and eax, 0x9b14596e
imul eax, eax, 0xc17df728
cmp eax, 0x28b9153e
jne 0x1400db6e8
sub rsp, 0x20
mov rcx, rbx
mov dl, 1
call fcn.1400c1a30
add rsp, 0x20
xor esi, esi
nop word [rax + rax]
sub rsp, 0x20
mov rcx, rbx
mov dl, 1
call fcn.1400c1a30
add rsp, 0x20
test sil, sil
jne 0x1400db6f0
mov eax, dword [0x141dd8ba0]
and eax, dword [0x141dd8ba4]
xor eax, 0xa201001
or eax, 0x31d92ff6
imul rcx, rax, 0x138d5afd
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1d
cmp eax, 0xfb027fce
ja 0x1400db758
mov eax, dword [0x141dd8ba8]
xor eax, dword [0x141dd8bac]
and eax, 0x2b4de41f
add eax, 0x9a90d58d
mov byte [rdi], 1
cmp eax, 0x2ef3d0ef
jae 0x1400db75d
mov byte [rdi], 1
jmp 0x1400db738
movabs rsi, 0x202020202020101
mov eax, dword [0x141dd8bb0]
and eax, dword [0x141dd8bb4]
xor eax, 0x4f7ba098
add eax, 0x5b959283
or eax, 0x9fb90135
cmp eax, 0xe8e2cfd7
jne 0x1400db7c0
mov qword [rdi + 1], rsi
sub rsp, 0x20
mov rcx, rbx
mov rdx, rdi
call fcn.1400c2870
mov r8d, 0xd0
mov rcx, r15
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
add rsp, 0x20
nop word cs:[rax + rax]
mov eax, dword [0x141dd8bb8]
or eax, dword [0x141dd8bbc]
xor eax, 0x2087d6
and eax, 0x10e797ff
imul r14d, eax, 0x53532666
mov qword [rdi + 1], rsi
sub rsp, 0x20
mov rcx, rbx
mov rdx, rdi
call fcn.1400c2870
mov r8d, 0xd0
mov rcx, r15
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
add rsp, 0x20
cmp r14d, 0xd1ee9345
ja 0x1400db7c0
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret