Function at 0x14007b260
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
cmp word [rdx], 0
mov rsi, rdx
mov r13, qword [rcx + 0x2a0]
mov rdi, rcx
mov r14, rdx
je 0x14007ad7d
lea r15, [rcx + 0x310]
xor ebp, ebp
lea rbx, [rcx + 0x318]
nop word [rax + rax]
movzx eax, word [r14]
cmp ax, 0xc
je 0x14007ad14
lea rbx, [rdi + 0x318]
test ax, ax
je 0x14007ad14
lea rbx, [rdi + 0x318]
cmp ax, 0x3d
jne 0x14007acdd
mov rcx, qword [rbx]
lea r15, [rdi + 0x310]
mov rax, rcx
sub rax, qword [rdi + 0x320]
test rax, 0xfffffffffffffffe
jne 0x14007aba4
lea rbp, [r13 + 0x130]
jmp 0x14007ac1b
cmp rcx, qword [r15]
jne 0x14007abbd
lea rcx, [rdi + 0x300]
call fcn.140079f90
test al, al
je 0x14007ad9c
mov rax, qword [rbx]
lea rdx, [r13 + 0x78]
mov r9d, 0x10
mov rcx, rdi
mov word [rax], bp
mov r8, qword [rdi + 0x320]
add qword [rbx], 2
call fcn.1400785d0
mov rbp, rax
test rax, rax
je 0x14007ad9c
mov rdx, qword [rax]
cmp rdx, qword [rdi + 0x320]
jne 0x14007ac11
lea rcx, [r13 + 0xa0]
call fcn.140079d20
mov qword [rbp], rax
test rax, rax
je 0x14007ad9c
mov rcx, qword [rdi + 0x320]
mov qword [rbx], rcx
movzx edx, word [r14 + 2]
lea rsi, [r14 + 2]
cmp dx, 0xc
je 0x14007ac71
mov rax, rcx
nop dword [rax]
mov rcx, rax
test dx, dx
je 0x14007ac71
cmp rax, qword [r15]
jne 0x14007ac51
lea rcx, [rdi + 0x300]
call fcn.140079f90
test al, al
je 0x14007ad9c
movzx eax, word [rsi]
add rsi, 2
mov rcx, qword [rbx]
mov word [rcx], ax
add qword [rbx], 2
movzx edx, word [rsi]
mov rcx, qword [rbx]
mov rax, rcx
cmp dx, 0xc
jne 0x14007ac30
cmp rcx, qword [r15]
jne 0x14007ac8a
lea rcx, [rdi + 0x300]
call fcn.140079f90
test al, al
je 0x14007ad9c
mov rax, qword [rbx]
xor ecx, ecx
xor r8d, r8d
mov rdx, rbp
mov word [rax], cx
lea rax, [rdi + 0x2c0]
mov r9, qword [rdi + 0x320]
mov rcx, rdi
add qword [rbx], 2
mov qword [rsp + 0x20], rax
call fcn.1400733b0
test eax, eax
jne 0x14007ad9c
mov rax, qword [rdi + 0x320]
mov qword [rbx], rax
cmp word [rsi], 0
je 0x14007acd3
add rsi, 2
mov r14, rsi
xor ebp, ebp
jmp 0x14007ad73
mov rax, qword [r15]
cmp qword [rbx], rax
jne 0x14007acf9
lea rcx, [rdi + 0x300]
call fcn.140079f90
test al, al
je 0x14007ad9c
movzx eax, word [r14]
lea r15, [rdi + 0x310]
mov rcx, qword [rbx]
mov word [rcx], ax
add qword [rbx], 2
add r14, 2
jmp 0x14007ad73
mov rax, qword [r15]
cmp qword [rbx], rax
jne 0x14007ad2c
lea rcx, [rdi + 0x300]
call fcn.140079f90
test al, al
je 0x14007ad9c
mov rax, qword [rbx]
xor r9d, r9d
mov rdx, r13
mov rcx, rdi
mov word [rax], bp
mov r8, qword [rdi + 0x320]
add qword [rbx], 2
call fcn.1400785d0
test rax, rax
je 0x14007ad54
mov byte [rax + 0x38], 1
cmp word [r14], 0
je 0x14007ad5f
add r14, 2
mov rax, qword [rdi + 0x320]
mov rsi, r14
mov qword [rbx], rax
lea rbx, [rdi + 0x318]
cmp word [rsi], 0
jne 0x14007ab50
mov al, 1
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor al, al
jmp 0x14007ad7f
push rdi
sub rsp, 0x30
cmp dword [rcx + 0x388], 0
mov rdi, rcx
jne 0x14007b38f
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
xor esi, esi
mov ebx, esi
nop dword [rax]
nop dword [rax + rax]
mov edx, 4
mov dword [rsp + 0x40], esi
lea rcx, [rsp + 0x40]
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x14007b310
mov edx, dword [rsp + 0x40]
mov rcx, rsi
nop
cmp rbx, 4
jae 0x14007b2d1
mov eax, edx
shr eax, cl
add rcx, 8
mov byte [rsp + rbx + 0x48], al
inc rbx
cmp rcx, 0x20
jb 0x14007b2b0
cmp rbx, 4
jb 0x14007b290
lea rcx, str.EXPAT_ENTROPY_DEBUG
call fcn.14009d840
mov ebx, dword [rsp + 0x48]
test rax, rax
je 0x14007b37f
cmp byte [rax], 0x31
jne 0x14007b37f
cmp byte [rax + 1], sil
jne 0x14007b37f
mov ecx, 2
call fcn.140018860
lea r8, str.rand_s
jmp 0x14007b35e
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov ebx, dword [rsp + 0x48]
xor ebx, dword [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor eax, ebx
lea rcx, str.EXPAT_ENTROPY_DEBUG
imul ebx, eax, 0x7fffffff
call fcn.14009d840
test rax, rax
je 0x14007b37f
cmp byte [rax], 0x31
jne 0x14007b37f
cmp byte [rax + 1], sil
jne 0x14007b37f
mov ecx, 2
call fcn.140018860
lea r8, str.fallback_4_
mov dword [rsp + 0x28], 4
lea rdx, str.Entropy:__s_____0x_0lx___lu_bytes__n
mov r9d, 8
mov dword [rsp + 0x20], ebx
mov rcx, rax
call fcn.1400777a0
mov rsi, qword [rsp + 0x58]
mov dword [rdi + 0x388], ebx
mov rbx, qword [rsp + 0x50]
cmp byte [rdi + 0x1c8], 0
je 0x14007b3ac
lea rdx, str.xmlhttp:__www.w3.org_XML_1998_namespace
mov rcx, rdi
add rsp, 0x30
pop rdi
jmp 0x14007ab00
mov al, 1
add rsp, 0x30
pop rdi
ret