Function at 0x140028400
Capabilities:
Encode data using xor
Generate random numbers via winapi

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
mov rsi, rdx
mov rdi, rcx
mov eax, dword [0x141587948]
xor edx, edx
div dword [0x14158794c]
add eax, 0xf7914507
or eax, 0xc4900204
and eax, 0xe5d1165c
cmp eax, 0x74c9ee52
jne 0x14002844a
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
xorps xmm0, xmm0
nop dword [rax]
mov eax, dword [0x141587950]
imul eax, dword [0x141587954]
add eax, 0x399ddf9e
mov ecx, eax
and ecx, 0x8a43000b
xor ecx, 0x82000001
and eax, 0x82000001
or eax, ecx
or eax, 0x75bcfff4
movaps xmmword [rsp + 0x20], xmm0
movaps xmmword [rsp + 0x30], xmm0
cmp eax, 0x30f59676
je 0x140028450
mov eax, dword [0x141587958]
sub eax, dword [0x14158795c]
mov ecx, eax
not ecx
and ecx, 0x9f01f0df
mov edx, eax
and edx, 0x60fe0f20
imul edx, ecx
mov ecx, eax
and ecx, 0x9f01f0df
or eax, 0x9f01f0df
imul eax, ecx
add eax, edx
mov ecx, eax
xor ecx, 0x2099819c
add ecx, eax
and eax, 0xdf667e63
sub ecx, eax
shr ecx, 2
imul rax, rcx, 0x14d78bb5
shr rax, 0x3a
cmp eax, 0x341309
jbe 0x1400284ff
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x20
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
mov r15d, 0xab2334c3
lea r14, [rsp + 0x20]
mov r12, qword [sym.imp.bcrypt.dll_BCryptGenRandom]
nop word cs:[rax + rax]
mov eax, dword [0x141587960]
mov ecx, dword [0x141587964]
mov edx, eax
and edx, ecx
not edx
not eax
not ecx
or ecx, eax
and ecx, edx
not ecx
imul r13d, ecx, 0xc6aee9a6
imul r13, r15
shr r13, 0x3f
or r13d, 0x560190ce
xor ecx, ecx
mov rdx, r14
mov r8d, 0x20
mov r9d, 2
call r12
cmp r13d, 0x7cfd7ec7
ja 0x140028520
mov ebx, eax
cmp eax, 0xc0000000
jb 0x1400285d3
lea rcx, [rsp + 0x20]
mov edx, 0x20
call fcn.14020b1b0
nop word [rax + rax]
mov ecx, dword [0x141587968]
mov edx, dword [0x14158796c]
mov r8d, edx
and r8d, ecx
add ecx, edx
sub ecx, r8d
mov edx, ecx
or edx, 0x78242349
and edx, 0x78eff37b
or ecx, 0x7aeff37b
add ecx, edx
and ecx, 0xd027261a
cmp ecx, 0x31350eb4
jb 0x140028590
test al, al
je 0x14002891f
mov eax, dword [0x141587998]
or eax, dword [0x14158799c]
or eax, 0x2f3ed4b7
add eax, 0x275cf213
imul rax, rax, 0x6fab929d
shr rax, 0x3e
cmp eax, 0x42c7366b
jbe 0x14002860f
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x50], xmm1
movaps xmmword [rsp + 0x40], xmm0
lea rbx, [rsp + 0x70]
nop word cs:[rax + rax]
mov eax, dword [0x1415879a0]
and eax, dword [0x1415879a4]
mov ecx, eax
not ecx
or ecx, 0x11b71a9f
add eax, ecx
inc eax
or eax, 0xe7dfdcbd
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x50], xmm1
cmp eax, 0x15a27c15
je 0x140028620
mov ecx, dword [0x1415879a8]
mov edx, dword [0x1415879ac]
mov eax, ecx
not eax
mov r8d, edx
not r8d
mov r9d, eax
and r9d, 0x840016a5
and ecx, 0x7bffe95a
or ecx, r9d
or eax, r8d
and r8d, 0x840016a5
and edx, 0x7bffe95a
or edx, r8d
xor edx, ecx
not eax
or eax, edx
mov ecx, eax
xor ecx, 0x4dce5179
and eax, 0x3231ae86
add eax, eax
sub eax, ecx
mov ecx, eax
not ecx
or ecx, 0x2402820
and ecx, 0xd3462da4
and eax, 0x988201
or eax, ecx
cmp eax, 0x4c5a502a
jne 0x1400286e0
mov rax, qword [0x1415acbb8]
nop word cs:[rax + rax]
mov eax, dword [0x1415879b0]
sub eax, dword [0x1415879b4]
mov ecx, eax
not ecx
or ecx, 0x13e28d0c
add ecx, eax
add ecx, 0x37e5fec
or ecx, 0x87492fbe
mov rax, qword [0x1415acbb8]
cmp ecx, 0x6423d9e3
jb 0x1400286e0
test rax, rax
jne 0x140028759
xor eax, eax
test al, al
jne 0x140028a4d
mov ebp, dword [0x1415879b8]
xor ebp, dword [0x1415879bc]
mov eax, ebp
not eax
or eax, 0xc4008238
and eax, 0xe6c29abc
and ebp, 0x19212501
sub ebp, eax
not ebp
or ebp, 0x7fd4bcf2
call fcn.14023b9f0
cmp ebp, 0x9346a28c
je 0x140028722
and eax, 0x4000
nop
mov ecx, dword [0x1415879c0]
mov edx, dword [0x1415879c4]
mov r8d, ecx
not r8d
and r8d, edx
mov r9d, edx
not r9d
and r9d, ecx
imul r9d, r8d
mov r8d, ecx
and r8d, edx
or ecx, edx
imul ecx, r8d
add ecx, r9d
mov edx, ecx
xor edx, 0x3abe6f1a
and ecx, 0x54190e5
add ecx, ecx
sub ecx, edx
add ecx, 0x9522ecc4
or ecx, 0xcca29a32
cmp ecx, 0x26c0eef2
jb 0x140028760
test rax, rax
je 0x140028820
mov eax, dword [0x1415879e0]
xor eax, dword [0x1415879e4]
mov ecx, eax
not ecx
mov edx, eax
and edx, 0x14bac80d
and ecx, 0xeb4537f2
imul ecx, edx
mov edx, eax
and edx, 0xeb4537f2
or eax, 0xeb4537f2
imul eax, edx
add eax, ecx
mov ecx, eax
and ecx, 0x4ead4ca2
xor eax, 0x4ead4ca3
or eax, ecx
add eax, 0x5ef50893
cmp eax, 0x72013066
jae 0x140028ab0
jmp 0x140028af5
mov eax, dword [0x1415879c8]
mov ecx, dword [0x1415879cc]
not eax
not ecx
or ecx, eax
mov eax, ecx
not eax
xor ecx, 0x908f957e
or eax, 0x908f957e
and eax, ecx
imul rax, rax, 0x1c115b3f
shr rax, 0x3c
imul eax, eax, 0xdd09a7ea
cmp eax, 0x3db45c7
ja 0x140028820
movaps xmm0, xmmword [rsp + 0x40]
mov eax, dword [0x1415879d4]
mov ecx, eax
xor ecx, eax
not ecx
and ecx, dword [0x1415879d0]
xor ecx, eax
and ecx, 0x975b7f10
mov eax, ecx
not eax
or ecx, 0xcd05870c
and eax, 0x323a6821
mov edx, ecx
and edx, 0x409010
or edx, eax
xor edx, 0x46620970
and ecx, 0x995d661c
or ecx, edx
cmp ecx, 0x4da9a85b
jae 0x1400288c0
movaps xmm1, xmmword [rsp + 0x50]
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x80], xmm1
nop dword [rax + rax]
mov eax, dword [0x1415879d8]
mov ecx, dword [0x1415879dc]
mov edx, eax
xor edx, ecx
not edx
and edx, ecx
add edx, edx
sub ecx, edx
add ecx, eax
imul eax, ecx, 0x84198248
or eax, 0x389f0e95
mov ecx, eax
xor ecx, 0x8ad795b7
and eax, 0x75286a48
add eax, eax
sub eax, ecx
movaps xmm1, xmmword [rsp + 0x50]
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x80], xmm1
cmp eax, 0xce6b9cdb
je 0x1400288c0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x90], xmm0
jmp 0x140028b80
add ebx, 0x80000000
nop word cs:[rax + rax]
mov ecx, dword [0x141587970]
mov edx, dword [0x141587974]
mov eax, ecx
not eax
mov r8d, edx
not r8d
mov r9d, eax
and r9d, 0x817f3de0
and ecx, 0x7e80c21f
or ecx, r9d
or eax, r8d
and r8d, 0x817f3de0
and edx, 0x7e80c21f
or edx, r8d
xor edx, ecx
not eax
or eax, edx
add eax, 0xfa9628dd
mov ecx, eax
xor ecx, 0x1001280
xor eax, 0x548c0141
and eax, 0xdeaea94f
and ecx, 0x215156b0
or ecx, eax
cmp ecx, 0xa0278d9
je 0x140028930
test ebx, ebx
je 0x1400285d3
movzx eax, byte [0x1415acbd0]
mov edx, 4
xor ecx, ecx
call fcn.1401ac910
mov r14, rax
mov eax, dword [0x141587978]
xor edx, edx
div dword [0x14158797c]
nop word cs:[rax + rax]
mov eax, dword [0x141587980]
sub eax, dword [0x141587984]
xor eax, 0x5883f276
add eax, 0xb77a57b4
mov ecx, eax
and ecx, 0xff4c42d
add ecx, ecx
sub eax, ecx
add eax, 0x8ff4c42d
cmp eax, 0xe72f4f1a
ja 0x1400289d0
test r14, r14
je 0x140028a57
mov eax, dword [0x141587a18]
mov ecx, dword [0x141587a1c]
mov edx, eax
not edx
and edx, ecx
mov r8d, ecx
not r8d
and r8d, eax
imul r8d, edx
mov edx, eax
and edx, ecx
or eax, ecx
imul eax, edx
add eax, r8d
and eax, 0xd9e1403b
xor eax, 0xd8410020
add eax, 0x6f6dbb31
cmp eax, 0xb669a8fb
jbe 0x140028cf3
jmp 0x140028d23
call fcn.14023b9f0
jmp 0x140028722
mov eax, dword [0x141587988]
sub eax, dword [0x14158798c]
add eax, 0x6e1348ee
imul rax, rax, 0x7ba34861
shr rax, 0x3e
imul eax, eax, 0x91d95b4
cmp eax, 0x5ce13a50
ja 0x140028aaa
mov eax, dword [0x141587990]
sub eax, dword [0x141587994]
add eax, 0xe105e421
shr eax, 1
mov ecx, 0x85dcd7f3
imul rcx, rax
shr rcx, 0x3c
ud2
ud2
mov eax, dword [0x1415879e8]
mov ecx, dword [0x1415879ec]
xor ecx, eax
not ecx
and ecx, eax
imul ebp, ecx, 0x3eb46342
mov eax, ebp
xor eax, 0x57d3900c
and ebp, 0x282c6ff2
add ebp, ebp
sub ebp, eax
lea r8, [0x141578750]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.14020b1d0
cmp ebp, 0x892465d3
jae 0x140028b10
lea r8, [0x141578750]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.14020b1d0
jmp 0x140028ab0
mov eax, dword [0x1415879f0]
mov ecx, dword [0x1415879f4]
mov edx, ecx
not edx
mov r8d, eax
and r8d, edx
or edx, eax
not edx
imul edx, r8d
mov r8d, eax
and r8d, ecx
or eax, ecx
imul eax, r8d
add eax, edx
mov ecx, eax
xor ecx, 0xb4cfd6aa
xor eax, 0x2202810
and eax, 0xb62ae810
mov edx, ecx
and edx, 0x49d517ef
imul edx, eax
mov eax, ecx
and eax, 0xb62ae810
or ecx, 0xb62ae810
imul ecx, eax
add ecx, edx
cmp ecx, 0xe1ab272c
je 0x140028b10
nop word cs:[rax + rax]
mov eax, dword [0x1415879f8]
imul eax, dword [0x1415879fc]
mov ecx, eax
not ecx
mov edx, eax
and edx, 0xd2179afc
and ecx, 0x2de86503
imul ecx, edx
mov edx, eax
and edx, 0x2de86503
or eax, 0x2de86503
imul eax, edx
add eax, ecx
add eax, 0xb93b7b61
mov ecx, eax
and ecx, 0x5f1094f8
xor eax, 0xdf1094f8
lea eax, [rax + rcx*2]
cmp eax, 0x3a05af45
je 0x140028b80
mov eax, dword [str.2Xf5]
add eax, dword [0x141587a00]
mov ecx, eax
xor ecx, 0xa5f04f93
or eax, 0x5a0fb06c
and eax, ecx
xor eax, 0x481713e1
add eax, 0x66dd5aae
cmp eax, 0xd149c2b
jae 0x140028c20
movaps xmm0, xmmword [rbx]
movaps xmm1, xmmword [rbx + 0x10]
movaps xmm2, xmmword [rbx + 0x20]
movaps xmmword [rdi + 0x20], xmm2
movaps xmmword [rdi + 0x10], xmm1
movaps xmmword [rdi], xmm0
nop word cs:[rax + rax]
mov eax, dword [0x141587a08]
xor edx, edx
div dword [0x141587a0c]
imul rax, rax, 0x10039fd
shr rax, 0x38
add eax, 0x8094ae51
movaps xmm0, xmmword [rbx]
movaps xmm1, xmmword [rbx + 0x10]
movaps xmm2, xmmword [rbx + 0x20]
movaps xmmword [rdi + 0x20], xmm2
movaps xmmword [rdi + 0x10], xmm1
movaps xmmword [rdi], xmm0
cmp eax, 0xab39dd7b
ja 0x140028c20
nop dword [rax + rax]
mov eax, dword [0x141587a10]
or eax, dword [0x141587a14]
mov ecx, eax
or ecx, 0x33516861
mov edx, eax
not edx
and edx, 0x84a21306
mov r8d, ecx
and r8d, 0x484cc4f9
imul r8d, edx
and ecx, 0xb7b33b06
or eax, 0xb7f37b67
imul eax, ecx
add eax, r8d
mov ecx, eax
xor ecx, 0x3682bc64
and ecx, eax
cmp ecx, 0x99bc7a3a
ja 0x140028c60
mov qword [rdi + 0x40], 0
mov rbx, qword [rdi + 0x30]
mov eax, dword [str.3LH_]
or eax, dword [0x141587a3c]
imul rax, rax, 0x3aab2b85
shr rax, 0x3c
add eax, 0x65858271
mov ecx, eax
and ecx, 0x40800003
add ecx, ecx
sub eax, ecx
cmp eax, 0xf80b4a5a
jne 0x140028e07
jmp 0x140028e8f
mov eax, dword [0x141587a20]
or eax, dword [0x141587a24]
imul eax, eax, 0x380d800a
add eax, 0xd23f7350
mov ecx, eax
xor ecx, 0x4ba2fa85
and eax, 0x4ba2fa84
or eax, ecx
mov dword [r14], ebx
cmp eax, 0x96b2c6bd
jae 0x140028d28
mov dword [r14], ebx
jmp 0x140028cf3
mov rbx, qword [0x1415acb98]
mov eax, dword [0x141587a28]
mov ecx, dword [0x141587a2c]
mov edx, ecx
not edx
and edx, eax
xor ecx, eax
add ecx, eax
sub ecx, edx
imul eax, ecx, 0x94a1ce6d
mov ecx, eax
or ecx, 0xdb9b4087
mov edx, eax
not edx
and edx, 0x4008428
mov r8d, ecx
and r8d, 0x61767bd7
imul r8d, edx
and ecx, 0x9e898428
or eax, 0xdf9bc4af
imul eax, ecx
add eax, r8d
cmp eax, 0x447b2d41
jae 0x140028d93
mov rcx, rbx
xor edx, edx
mov r8, r14
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r15, qword [sym.imp.KERNEL32.dll_HeapFree]
nop word [rax + rax]
mov eax, dword [0x141587a30]
mov ebp, dword [0x141587a34]
xor ebp, eax
not ebp
and ebp, eax
mov eax, ebp
not eax
and eax, 0x218e2402
mov ecx, ebp
and ecx, 0xde71dbfd
imul ecx, eax
mov eax, ebp
and eax, 0x218e2402
or ebp, 0x218e2402
imul ebp, eax
add ebp, ecx
mov eax, ebp
and eax, 0x2a6a5ce6
add eax, eax
sub ebp, eax
add ebp, 0x2a6a5ce7
xor ebp, 0x70d2334
mov rcx, rbx
xor edx, edx
mov r8, r14
call r15
cmp ebp, 0xa18cf2b9
ja 0x140028da0
jmp 0x140028caf
mov eax, dword [0x141587a40]
mov ecx, dword [0x141587a44]
not eax
mov edx, eax
and edx, ecx
not edx
or eax, ecx
and eax, edx
mov ebp, eax
not ebp
and eax, 0xaa93d188
mov ecx, ebp
and ecx, 0x556c2e77
imul ecx, eax
mov eax, ebp
and eax, 0xaa93d188
or ebp, 0xaa93d188
imul ebp, eax
add ebp, ecx
mov eax, ebp
not eax
and eax, 0x8fa00e79
mov ecx, ebp
and ecx, 0x705ff180
imul ecx, eax
mov eax, ebp
and eax, 0x8fa00e78
or ebp, 0x8fa00e79
imul ebp, eax
add ebp, ecx
and ebp, 0xdd7c4790
lea rax, [rbx - 0x100]
mov qword [rdi + 0x38], rax
mov rcx, rdi
mov rdx, rsi
call fcn.14020b1f0
cmp ebp, 0x1f65db42
jne 0x140028eb0
lea rax, [rbx - 0x100]
mov qword [rdi + 0x38], rax
mov rcx, rdi
mov rdx, rsi
call fcn.14010e160
jmp 0x140028e07
mov eax, dword [0x141587a48]
add eax, dword [0x141587a4c]
imul eax, eax, 0x693d0440
cmp eax, 0x47b5f0ba
je 0x140028eb0
add rsp, 0xa8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret