Function at 0x1400da740
Capabilities:
Encode data using xor
Get memory capacity

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x18
lea rbp, [rsp + 0x10]
mov eax, dword [0x141dd7ed0]
add eax, dword [0x141dd7ed4]
mov qword [rbp - 8], rcx
imul eax, eax, 0x53a4434a
add eax, 0x7061090e
cmp eax, 0x3804e890
jae 0x1400da7a0
mov eax, 0x70
call fcn.1400eeec0
sub rsp, rax
mov eax, 0x40
call fcn.1400eeec0
sub rsp, rax
nop word cs:[rax + rax]
mov eax, dword [0x141dd7ed8]
xor eax, dword [0x141dd7edc]
imul ecx, eax, 0x74b30dfd
add ecx, 0x197d15cf
mov eax, 0x70
call fcn.1400eeec0
sub rsp, rax
mov rdi, rsp
mov eax, 0x40
call fcn.1400eeec0
sub rsp, rax
mov r15, rsp
cmp ecx, 0xa4b0afea
ja 0x1400da7a0
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
mov qword [rbp], rsp
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
mov r12, rsp
mov eax, 0xd0
call fcn.1400eeec0
sub rsp, rax
mov r14, rsp
mov eax, dword [0x141dda6bc]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp byte [rax + 0x70], 0
je 0x1400da853
mov eax, dword [0x141dda6bc]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rbx, qword [rax + 0x78]
mov rsi, qword [rax + 0x80]
jmp 0x1400da903
xorps xmm0, xmm0
movups xmmword [r12], xmm0
sub rsp, 0x20
mov edx, 0x10
mov rcx, r12
call qword [sym.imp.bcryptprimitives.dll_ProcessPrng]
add rsp, 0x20
mov eax, dword [0x141dd7ee0]
imul eax, dword [0x141dd7ee4]
mov rsi, qword [r12 + 8]
add eax, 0x718b3342
or eax, 0x2981285a
cmp eax, 0xfa77fce1
jne 0x1400da8b5
mov eax, dword [0x141dda6bc]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov byte [rax + 0x70], 1
mov qword [rax + 0x80], rsi
mov rbx, qword [r12]
mov eax, 0xe5cf181b
nop
mov ecx, dword [0x141dda6bc]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov edx, dword [0x141dd7ee8]
add edx, dword [0x141dd7eec]
imul rdx, rax
shr rdx, 0x3f
add edx, 0xab5725b5
mov byte [rcx + 0x70], 1
mov qword [rcx + 0x80], rsi
cmp edx, 0xace20a07
jae 0x1400da8c0
mov eax, dword [0x141dd7ef0]
xor edx, edx
div dword [0x141dd7ef4]
imul eax, eax, 0xe909cffb
imul rax, rax, 0x49cd9859
shr rax, 0x3d
or eax, 0xe88b74c0
cmp eax, 0xc5953141
jb 0x1400da996
mov eax, dword [0x141dd7ef8]
xor edx, edx
div dword [0x141dd7efc]
mov r13d, eax
or r13d, 0x4a000003
and r13d, 0x6a2a5b07
add r13d, 0x64d2bf38
lea rax, [rbx + 1]
mov ecx, dword [0x141dda6bc]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov qword [rcx + 0x78], rax
movzx eax, byte [0x141dda6b8]
sub rsp, 0x20
mov edx, 0x58410
xor ecx, ecx
call fcn.1400bf230
add rsp, 0x20
cmp r13d, 0x40dae04c
jae 0x1400da9d4
lea rax, [rbx + 1]
mov ecx, dword [0x141dda6bc]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov qword [rcx + 0x78], rax
movzx eax, byte [0x141dda6b8]
sub rsp, 0x20
mov edx, 0x58410
xor ecx, ecx
call fcn.1400bf230
add rsp, 0x20
jmp 0x1400da92e
mov r12, rax
test rax, rax
je 0x1400dada4
add r12, 0x58000
sub rsp, 0x20
mov r8d, 0x410
mov rcx, r12
mov dl, 0xff
call sub.VCRUNTIME140.dll_memset
add rsp, 0x20
xorps xmm0, xmm0
movups xmmword [r14 + 0x70], xmm0
movups xmmword [r14 + 0x80], xmm0
mov qword [r14], 0
mov qword [r14 + 8], 8
mov qword [r14 + 0x10], 0
movabs rax, 0x8000000000000000
mov qword [r14 + 0x18], rax
mov dword [r14 + 0x30], 0
mov byte [r14 + 0x38], 0
mov qword [r14 + 0x40], r12
mov qword [r14 + 0x48], 0x3ff
mov qword [r14 + 0x50], 0x380
mov qword [r14 + 0x58], 0
mov qword [r14 + 0x60], rbx
mov qword [r14 + 0x68], rsi
mov qword [r14 + 0x90], 0
mov eax, dword [0x141dd7f00]
imul eax, dword [0x141dd7f04]
xor eax, 0x223c2262
add eax, 0xd8ece675
and eax, 0xf608cef2
cmp eax, 0x27b100f2
jae 0x1400daaad
movups xmmword [r15], xmm0
movups xmmword [r15 + 0x30], xmm0
movups xmmword [r15 + 0x20], xmm0
movups xmmword [r15 + 0x10], xmm0
mov dword [r15], 0x40
mov rsi, r14
add rsi, 0x70
nop word cs:[rax + rax]
mov eax, dword [0x141dd7f08]
xor eax, dword [0x141dd7f0c]
imul eax, eax, 0x75b0a83a
add eax, 0x9a0c3611
movups xmmword [r15], xmm0
movups xmmword [r15 + 0x30], xmm0
movups xmmword [r15 + 0x20], xmm0
movups xmmword [r15 + 0x10], xmm0
mov dword [r15], 0x40
cmp eax, 0xdd8c9724
ja 0x1400daac0
mov eax, dword [0x141dd7f10]
imul eax, dword [0x141dd7f14]
add eax, 0xd4fa92d7
xor eax, 0x10070080
or eax, 0xc7a8215f
cmp eax, 0xb3850f25
jae 0x1400dab2c
sub rsp, 0x20
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
add rsp, 0x20
mov rbx, qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
nop word cs:[rax + rax]
mov eax, dword [0x141dd7f18]
and eax, dword [0x141dd7f1c]
add eax, 0xdfa43a46
xor eax, 0x84f21eb4
imul r12d, eax, 0xc1f54db4
sub rsp, 0x20
mov rcx, r15
call rbx
add rsp, 0x20
cmp r12d, 0xa5486dc
je 0x1400dab40
test eax, eax
jne 0x1400dabb9
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
nop word cs:[rax + rax]
mov eax, dword [0x141dd7f28]
add eax, dword [0x141dd7f2c]
or eax, 0x6014b89c
imul eax, eax, 0x4c9b70b9
imul rax, rax, 0x29668e7f
shr rax, 0x3d
cmp eax, 0x361bb442
ja 0x1400dab90
movups xmm0, xmmword [r15 + 8]
movups xmmword [rsi], xmm0
xorps xmm0, xmm0
movups xmmword [rdi + 0x50], xmm0
movups xmmword [rdi + 0x40], xmm0
movups xmmword [rdi + 0x30], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x60], 0
sub rsp, 0x20
mov rcx, rdi
mov edx, 0x68
call qword [sym.imp.KERNEL32.dll_K32GetPerformanceInfo]
add rsp, 0x20
test eax, eax
je 0x1400dad1b
mov rcx, qword [rdi + 0x50]
mov eax, dword [0x141dd7f30]
xor edx, edx
div dword [0x141dd7f34]
nop word cs:[rax + rax]
mov eax, dword [0x141dd7f38]
sub eax, dword [0x141dd7f3c]
imul eax, eax, 0xa5918142
cmp eax, 0xf0d8a351
je 0x1400dac20
mov eax, dword [0x141dd7f40]
and eax, dword [0x141dd7f44]
mov r10, qword [rdi + 0x20]
add eax, 0xac074885
and eax, 0xce85909f
cmp eax, 0x3dfe057a
jne 0x1400dac9c
mov rdx, qword [rdi + 0x10]
xor r8d, r8d
sub rdx, r10
cmovb rdx, r8
mov rax, rcx
mul rdx
mov r9, 0xffffffffffffffff
cmovo rax, r9
mov rdx, qword [rdi + 8]
sub rdx, r10
cmovb rdx, r8
mov qword [r14 + 0x80], rax
mov rax, rcx
mul rdx
cmovo rax, r9
mov qword [r14 + 0x88], rax
xor r11d, r11d
mov esi, 0xbb974307
mov rbx, 0xffffffffffffffff
nop dword [rax + rax]
mov eax, dword [0x141dd7f48]
xor edx, edx
div dword [0x141dd7f4c]
mov r8d, eax
or r8d, 0x475278fa
add r8d, 0xcdacc6a0
imul r8, rsi
shr r8, 0x3f
mov rdx, qword [rdi + 0x10]
sub rdx, r10
cmovb rdx, r11
mov rax, rcx
mul rdx
mov r9, rax
cmovo r9, rbx
mov rdx, qword [rdi + 8]
sub rdx, r10
cmovb rdx, r11
mov rax, rcx
mul rdx
cmovo rax, rbx
mov qword [r14 + 0x80], r9
mov qword [r14 + 0x88], rax
cmp r8d, 0x47355a4f
ja 0x1400dacb0
sub rsp, 0x20
mov rcx, r14
mov dl, 1
call fcn.1400c0eb0
add rsp, 0x20
mov rdx, qword [rbp]
mov byte [rdx], 1
movabs rax, 0x202020202020101
mov qword [rdx + 1], rax
sub rsp, 0x20
mov rcx, r14
call fcn.1400c1cd0
mov r8d, 0xd0
mov rcx, qword [rbp - 8]
mov rdx, r14
call sub.VCRUNTIME140.dll_memcpy
add rsp, 0x20
nop word cs:[rax + rax]
mov eax, dword [0x141dd7f50]
and eax, dword [0x141dd7f54]
add eax, 0x659ec860
and eax, 0x7b759229
imul eax, eax, 0x4a48573
cmp eax, 0xfda7d5e8
je 0x1400dad70
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov eax, dword [0x141dd7f20]
xor edx, edx
div dword [0x141dd7f24]
add eax, 0x2ad167e3
xor eax, 0x8d301248
and eax, 0x9d3153cd
cmp eax, 0xd9cea22
jae 0x1400dadca
ud2
xor eax, eax
nop dword [rax]
ud2