Function at 0x140031370
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
cmp word [rdx], 0
mov rsi, rdx
mov r13, qword [rcx + 0x2a0]
mov rdi, rcx
mov r14, rdx
je 0x14003028d
lea r15, [rcx + 0x310]
xor ebp, ebp
lea rbx, [rcx + 0x318]
nop word [rax + rax]
movzx eax, word [r14]
cmp ax, 0xc
je 0x140030224
lea rbx, [rdi + 0x318]
test ax, ax
je 0x140030224
lea rbx, [rdi + 0x318]
cmp ax, 0x3d
jne 0x1400301ed
mov rcx, qword [rbx]
lea r15, [rdi + 0x310]
mov rax, rcx
sub rax, qword [rdi + 0x320]
test rax, 0xfffffffffffffffe
jne 0x1400300b4
lea rbp, [r13 + 0x130]
jmp 0x14003012b
cmp rcx, qword [r15]
jne 0x1400300cd
lea rcx, [rdi + 0x300]
call fcn.140030c20
test al, al
je 0x1400302ac
mov rax, qword [rbx]
lea rdx, [r13 + 0x78]
mov r9d, reloc.WS2_32.dll_recv
mov rcx, rdi
mov word [rax], bp
mov r8, qword [rdi + 0x320]
add qword [rbx], 2
call fcn.140030560
mov rbp, rax
test rax, rax
je 0x1400302ac
mov rdx, qword [rax]
cmp rdx, qword [rdi + 0x320]
jne 0x140030121
lea rcx, [r13 + 0xa0]
call fcn.140030e70
mov qword [rbp], rax
test rax, rax
je 0x1400302ac
mov rcx, qword [rdi + 0x320]
mov qword [rbx], rcx
movzx edx, word [r14 + 2]
lea rsi, [r14 + 2]
cmp dx, 0xc
je 0x140030181
mov rax, rcx
nop dword [rax]
mov rcx, rax
test dx, dx
je 0x140030181
cmp rax, qword [r15]
jne 0x140030161
lea rcx, [rdi + 0x300]
call fcn.140030c20
test al, al
je 0x1400302ac
movzx eax, word [rsi]
add rsi, 2
mov rcx, qword [rbx]
mov word [rcx], ax
add qword [rbx], 2
movzx edx, word [rsi]
mov rcx, qword [rbx]
mov rax, rcx
cmp dx, 0xc
jne 0x140030140
cmp rcx, qword [r15]
jne 0x14003019a
lea rcx, [rdi + 0x300]
call fcn.140030c20
test al, al
je 0x1400302ac
mov rax, qword [rbx]
xor ecx, ecx
xor r8d, r8d
mov rdx, rbp
mov word [rax], cx
lea rax, [rdi + 0x2c0]
mov r9, qword [rdi + 0x320]
mov rcx, rdi
add qword [rbx], 2
mov qword [rsp + 0x20], rax
call fcn.14002e990
test eax, eax
jne 0x1400302ac
mov rax, qword [rdi + 0x320]
mov qword [rbx], rax
cmp word [rsi], 0
je 0x1400301e3
add rsi, 2
mov r14, rsi
xor ebp, ebp
jmp 0x140030283
mov rax, qword [r15]
cmp qword [rbx], rax
jne 0x140030209
lea rcx, [rdi + 0x300]
call fcn.140030c20
test al, al
je 0x1400302ac
movzx eax, word [r14]
lea r15, [rdi + 0x310]
mov rcx, qword [rbx]
mov word [rcx], ax
add qword [rbx], 2
add r14, 2
jmp 0x140030283
mov rax, qword [r15]
cmp qword [rbx], rax
jne 0x14003023c
lea rcx, [rdi + 0x300]
call fcn.140030c20
test al, al
je 0x1400302ac
mov rax, qword [rbx]
xor r9d, r9d
mov rdx, r13
mov rcx, rdi
mov word [rax], bp
mov r8, qword [rdi + 0x320]
add qword [rbx], 2
call fcn.140030560
test rax, rax
je 0x140030264
mov byte [rax + 0x38], 1
cmp word [r14], 0
je 0x14003026f
add r14, 2
mov rax, qword [rdi + 0x320]
mov rsi, r14
mov qword [rbx], rax
lea rbx, [rdi + 0x318]
cmp word [rsi], 0
jne 0x140030060
mov al, 1
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor al, al
jmp 0x14003028f
push rdi
sub rsp, 0x30
cmp dword [rcx + 0x388], 0
mov rdi, rcx
jne 0x14003149f
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
xor esi, esi
mov ebx, esi
nop dword [rax]
nop dword [rax + rax]
mov edx, 4
mov dword [rsp + 0x40], esi
lea rcx, [rsp + 0x40]
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x140031420
mov edx, dword [rsp + 0x40]
mov rcx, rsi
nop
cmp rbx, 4
jae 0x1400313e1
mov eax, edx
shr eax, cl
add rcx, 8
mov byte [rsp + rbx + 0x48], al
inc rbx
cmp rcx, 0x20
jb 0x1400313c0
cmp rbx, 4
jb 0x1400313a0
lea rcx, str.EXPAT_ENTROPY_DEBUG
call fcn.140083c14
mov ebx, dword [rsp + 0x48]
test rax, rax
je 0x14003148f
cmp byte [rax], 0x31
jne 0x14003148f
cmp byte [rax + 1], sil
jne 0x14003148f
mov ecx, 2
call fcn.140038c74
lea r8, str.rand_s
jmp 0x14003146e
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov ebx, dword [rsp + 0x48]
xor ebx, dword [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor eax, ebx
lea rcx, str.EXPAT_ENTROPY_DEBUG
imul ebx, eax, 0x7fffffff
call fcn.140083c14
test rax, rax
je 0x14003148f
cmp byte [rax], 0x31
jne 0x14003148f
cmp byte [rax + 1], sil
jne 0x14003148f
mov ecx, 2
call fcn.140038c74
lea r8, str.fallback_4_
mov dword [rsp + 0x28], 4
lea rdx, str.Entropy:__s_____0x_0lx___lu_bytes__n
mov r9d, 8
mov dword [rsp + 0x20], ebx
mov rcx, rax
call fcn.140028c80
mov rsi, qword [rsp + 0x58]
mov dword [rdi + 0x388], ebx
mov rbx, qword [rsp + 0x50]
cmp byte [rdi + 0x1c8], 0
je 0x1400314bc
lea rdx, str.xmlhttp:__www.w3.org_XML_1998_namespace
mov rcx, rdi
add rsp, 0x30
pop rdi
jmp 0x140030010
mov al, 1
add rsp, 0x30
pop rdi
ret