Function at 0x14002a1c0
Capabilities:
Encode data using xor
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
movaps xmmword [rbp - 0x10], xmm6
mov qword [rbp - 0x18], rdx
mov rdi, rcx
mov eax, dword [0x1415adb28]
mov ecx, dword [0x1415adb2c]
mov edx, eax
and edx, ecx
add edx, edx
add eax, ecx
sub eax, edx
mov ecx, eax
and ecx, 0x39bb8fd0
or eax, 0x39bb8fd0
add eax, ecx
xor eax, 0x28810170
or eax, 0xd73c7805
cmp eax, 0x87464fc2
jb 0x14002a25e
mov eax, dword [0x1415adb30]
imul eax, dword [0x1415adb34]
mov ecx, eax
and ecx, 0xab174b59
or eax, 0xab174b59
add eax, ecx
mov ecx, eax
not ecx
or ecx, 0x30479352
add ecx, eax
inc ecx
and ecx, 0x53dc0f8a
mov eax, 0x20
call fcn.14021cf50
sub rsp, rax
mov rbx, rsp
cmp ecx, 0x9a1333ba
jbe 0x14002a26d
mov eax, 0x20
call fcn.14021cf50
sub rsp, rax
jmp 0x14002a216
xor eax, eax
test al, al
je 0x14002a2b6
mov eax, 0x20
call fcn.14021cf50
sub rsp, rax
mov rdx, rsp
mov eax, 0x40
call fcn.14021cf50
sub rsp, rax
xorps xmm0, xmm0
movups xmmword [rdx + 0x10], xmm0
movups xmmword [rdx], xmm0
sub rsp, 0x20
xor ecx, ecx
mov r8d, 0x20
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
add rsp, 0x20
xorps xmm6, xmm6
mov r13, qword [sym.imp.bcrypt.dll_BCryptGenRandom]
mov eax, dword [0x1415adb38]
sub eax, dword [0x1415adb3c]
or eax, 0x531afe9b
mov ecx, eax
and ecx, 0x3c63d105
add ecx, ecx
neg ecx
add eax, ecx
add eax, 0x3c63d105
imul rsi, rax, 0x572fdb57
shr rsi, 0x3e
mov eax, 0x20
call fcn.14021cf50
sub rsp, rax
mov r15, rsp
mov eax, 0x40
call fcn.14021cf50
sub rsp, rax
mov r12, rsp
movups xmmword [r15 + 0x10], xmm6
movups xmmword [r15], xmm6
sub rsp, 0x20
xor ecx, ecx
mov rdx, r15
mov r8d, 0x20
mov r9d, 2
call r13
add rsp, 0x20
cmp esi, 0x46b4fd6
ja 0x14002a2c0
mov r14d, eax
cmp eax, 0xc0000000
jb 0x14002a43c
mov eax, dword [0x1415adb40]
xor edx, edx
div dword [0x1415adb44]
mov ecx, eax
not ecx
mov edx, eax
and edx, 0x39c74bfd
and ecx, 0xc638b402
imul ecx, edx
mov edx, eax
and edx, 0xc638b402
or eax, 0xc638b402
imul eax, edx
add eax, ecx
xor eax, 0xdcca0292
cmp eax, 0x6924f0c2
je 0x14002a3c9
mov esi, dword [0x1415adb48]
mov eax, dword [0x1415adb4c]
mov ecx, eax
and ecx, esi
add esi, eax
sub esi, ecx
and esi, 0x5eb68586
add esi, 0x87bf3f2d
sub rsp, 0x20
mov rcx, r15
mov edx, 0x20
call qword [sym.imp.ADVAPI32.dll_SystemFunction036]
add rsp, 0x20
cmp esi, 0xa78c9caf
jae 0x14002a3e1
sub rsp, 0x20
mov rcx, r15
mov edx, 0x20
call qword [sym.imp.ADVAPI32.dll_SystemFunction036]
add rsp, 0x20
jmp 0x14002a38b
xor ecx, ecx
nop word cs:[rax + rax]
test cl, cl
jne 0x14002a3f0
nop word cs:[rax + rax]
mov ecx, dword [0x1415adb50]
add ecx, dword [0x1415adb54]
or ecx, 0x9917da57
add ecx, 0x63b52b7d
imul rdx, rcx, 0x2a493687
shr rdx, 0x20
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 0x1f
cmp ecx, 0x46cbcdb5
ja 0x14002a400
test al, al
je 0x14002a7a8
movups xmm0, xmmword [r15]
movups xmm1, xmmword [r15 + 0x10]
movups xmmword [rbx + 0x10], xmm1
movups xmmword [rbx], xmm0
lea r14, [r12 + 0x10]
mov rcx, qword [0x1415d3938]
xor eax, eax
nop word [rax + rax]
test al, al
jne 0x14002a460
nop word cs:[rax + rax]
mov eax, dword [0x1415adbb0]
or eax, dword [0x1415adbb4]
mov edx, eax
not edx
and edx, 0x99e8f679
mov r8d, eax
and r8d, 0x66170986
imul r8d, edx
mov edx, eax
and edx, 0x99e8f679
or eax, 0x99e8f679
imul eax, edx
add eax, r8d
mov edx, eax
and edx, 0xdce38386
and eax, 0xa20300
add eax, eax
sub edx, eax
cmp edx, 0x64f5f8af
je 0x14002a470
test rcx, rcx
jne 0x14002a57a
mov eax, dword [0x1415adbb8]
xor edx, edx
div dword [0x1415adbbc]
mov ecx, eax
not ecx
and ecx, 0x4163acee
mov edx, eax
and edx, 0xbe9c5311
imul edx, ecx
mov ecx, eax
and ecx, 0x4163acee
or eax, 0x4163acee
imul eax, ecx
add eax, edx
mov ecx, eax
and ecx, 0x6811dc0
add ecx, ecx
sub eax, ecx
add eax, 0x6811dc0
mov ecx, 0xb91ea12b
imul rcx, rax
shr rcx, 0x3f
cmp ecx, 0xd2266d41
ja 0x14002a876
nop dword [rax + rax]
mov esi, dword [0x1415adbc0]
sub esi, dword [0x1415adbc4]
add esi, 0x74d9637e
mov eax, esi
and eax, 0x762f70dd
or esi, 0x762f70dd
add esi, eax
mov eax, esi
not eax
and eax, 0x56a39638
and esi, 0xa95c69c7
sub esi, eax
sub rsp, 0x20
call fcn.140219b70
add rsp, 0x20
cmp esi, 0xf872c811
ja 0x14002a530
mov rcx, rax
and ecx, 0x4000
mov eax, dword [0x1415adbc8]
xor edx, edx
div dword [0x1415adbcc]
add eax, 0x90484d3f
mov edx, eax
and edx, 0x36e1c3d9
add edx, edx
sub eax, edx
add eax, 0xb6e1c3d9
mov edx, eax
not edx
and edx, 0xeadb97c
mov r8d, eax
and r8d, 0xf1524683
imul r8d, edx
mov edx, eax
and edx, 0xeadb97c
or eax, 0xeadb97c
imul eax, edx
add eax, r8d
cmp eax, 0x6d8dda45
ja 0x14002a580
test rcx, rcx
je 0x14002a6a1
mov eax, dword [0x1415adbf8]
mov ecx, dword [0x1415adbfc]
mov edx, eax
xor edx, ecx
not edx
and edx, ecx
add edx, edx
sub ecx, edx
add eax, ecx
add eax, 0x6c4f6b58
imul rax, rax, 0x4359c781
shr rax, 0x3e
cmp eax, 0xaf3eff81
jbe 0x14002a62a
sub rsp, 0x20
lea r8, [0x14159e8e8]
mov rcx, r14
mov rdx, rbx
call fcn.140219b90
add rsp, 0x20
lea r15, [0x14159e8e8]
nop word cs:[rax + rax]
mov eax, dword [0x1415adc00]
mov ecx, dword [0x1415adc04]
mov edx, eax
not edx
and edx, ecx
mov r8d, ecx
not r8d
and r8d, eax
imul r8d, edx
mov edx, eax
and edx, ecx
or eax, ecx
imul eax, edx
lea esi, [rax + r8]
add esi, 0xfda05b8a
xor esi, 0x4014403
or esi, 0x40eeb1e0
sub rsp, 0x20
mov rcx, r14
mov rdx, rbx
mov r8, r15
call fcn.1401194c0
add rsp, 0x20
cmp esi, 0x8b5c90be
je 0x14002a640
jmp 0x14002aae0
mov eax, dword [0x1415adbd0]
or eax, dword [0x1415adbd4]
xor eax, 0x27e32574
lea ecx, [rax - 0xa81c930]
not ecx
or ecx, 0x9dd1e133
add eax, ecx
add eax, 0xf57e36d1
cmp eax, 0x15d800eb
jbe 0x14002a6e0
movaps xmm0, xmmword [rbx]
movaps xmmword [r12 + 0x10], xmm0
nop word [rax + rax]
mov eax, dword [0x1415adbd8]
add eax, dword [0x1415adbdc]
movzx ecx, al
and eax, 0x10200004
xor eax, 4
or ecx, eax
or ecx, 0x61d9bf18
and ecx, 0x71f9bf1c
movaps xmm1, xmmword [rbx]
movaps xmm0, xmmword [rbx + 0x10]
movaps xmmword [r12 + 0x10], xmm1
cmp ecx, 0xc4116278
ja 0x14002a6e0
xor eax, eax
test al, al
je 0x14002a726
movaps xmmword [r12 + 0x20], xmm0
mov rcx, r12
add rcx, 0x30
nop dword [rax]
mov eax, dword [0x1415adbe0]
mov edx, dword [0x1415adbe4]
mov r8d, eax
and r8d, edx
add r8d, r8d
add eax, edx
sub eax, r8d
mov edx, eax
xor edx, 0x145a0088
xor eax, 0x3c7b2098
and edx, 0x145ed3ce
add edx, edx
sub edx, eax
or edx, 0xcab24808
movaps xmmword [r12 + 0x20], xmm0
cmp edx, 0x71cb01d5
jb 0x14002a730
mov eax, dword [0x1415adbe8]
xor edx, edx
div dword [0x1415adbec]
lea edx, [rax + 0x47d1804]
not edx
or edx, 0x2d08e4d5
add eax, edx
add eax, 0x47d1805
cmp eax, 0xfff1bc23
jbe 0x14002aa71
jmp 0x14002aad5
add r14d, 0x80000000
nop
mov eax, dword [0x1415adb58]
mov ecx, dword [0x1415adb5c]
mov edx, eax
and edx, ecx
xor eax, ecx
lea eax, [rax + rdx*2]
or eax, 0x723a4177
add eax, 0x95384565
and eax, 0x9ffffff8
xor eax, 0xb9cd6928
cmp eax, 0x4dc0365a
jb 0x14002a7b0
mov eax, dword [0x1415adb64]
add eax, dword [0x1415adb60]
mov ecx, eax
not ecx
or ecx, 0xfffbdde5
or eax, 0xe1a4ef5b
and eax, ecx
cmp eax, 0xf35096c4
je 0x14002a7e0
nop word cs:[rax + rax]
mov eax, dword [0x1415adb68]
sub eax, dword [0x1415adb6c]
or eax, 0x61815afd
add eax, 0x309c98e4
mov ecx, eax
and ecx, 0x821c4c2
xor eax, 0x4921c4da
lea eax, [rax + rcx*2]
cmp eax, 0xbaa09e02
jb 0x14002a810
test r14d, r14d
je 0x14002a43c
mov eax, dword [0x1415adb70]
add eax, dword [0x1415adb74]
mov ecx, eax
xor ecx, 0x8a56b1ae
and eax, 0x75a94e51
add eax, eax
sub eax, ecx
xor eax, 0xe8f8f5
add eax, 0x6bf4a54e
cmp eax, 0xbd5989be
jae 0x14002a888
jmp 0x14002a8b4
sub rsp, 0x20
call fcn.14024ab60
add rsp, 0x20
jmp 0x14002a530
mov eax, dword [0x1415adb78]
mov ecx, dword [0x1415adb7c]
add eax, ecx
add eax, 0x67a7e102
or eax, 0x9474304c
imul eax, eax, 0x91401295
movzx ecx, byte [0x1415d3950]
cmp eax, 0xe80a865d
jbe 0x14002a8bd
movzx eax, byte [0x1415d3950]
jmp 0x14002a888
mov eax, dword [0x1415adb80]
mov ecx, dword [0x1415adb84]
mov edx, eax
xor edx, ecx
not ecx
and ecx, eax
add ecx, ecx
sub ecx, edx
imul eax, ecx, 0xc152dd28
or eax, 0x6902f924
mov ecx, eax
xor ecx, 0xd7a54892
and eax, 0x285ab76c
add eax, eax
sub eax, ecx
cmp eax, 0xd963f96b
je 0x14002a961
mov eax, dword [0x1415adb88]
mov ecx, dword [0x1415adb8c]
mov edx, ecx
not edx
mov r8d, eax
and r8d, edx
or edx, eax
not edx
imul edx, r8d
mov r8d, eax
and r8d, ecx
or eax, ecx
imul eax, r8d
add eax, edx
mov esi, eax
not esi
or eax, 0x7064ac25
or esi, 0xf9b53da
and esi, eax
not esi
add esi, 0x8541d355
not esi
and esi, 0x47b2f0f1
sub rsp, 0x20
mov edx, 4
xor ecx, ecx
call fcn.1401b5e70
add rsp, 0x20
cmp esi, 0xd60b488
jne 0x14002a977
sub rsp, 0x20
mov edx, 4
xor ecx, ecx
call fcn.1401b5e70
add rsp, 0x20
jmp 0x14002a8f8
mov rbx, rax
nop word [rax + rax]
mov eax, dword [0x1415adb90]
or eax, dword [0x1415adb94]
mov ecx, eax
xor ecx, 0x50c91dc5
and eax, 0x2f36e23a
add eax, eax
sub eax, ecx
and eax, 0x599c016c
add eax, 0x8cf8a52
cmp eax, 0xc0e3f52e
ja 0x14002a980
test rbx, rbx
je 0x14002a9c5
mov dword [rbx], r14d
xor eax, eax
test al, al
je 0x14002abfd
jmp 0x14002ac73
mov eax, dword [0x1415adb98]
mov ecx, dword [0x1415adb9c]
add eax, ecx
add eax, 0x5cddeaf
mov ecx, eax
and ecx, 0x63e49bfc
xor eax, 0xe3e49bfc
lea eax, [rax + rcx*2]
and eax, 0xbc179648
cmp eax, 0xed6c3050
je 0x14002aa2e
mov eax, dword [0x1415adba0]
imul eax, dword [0x1415adba4]
mov ecx, eax
or ecx, 0x210e4402
not eax
and eax, 0x4aa12090
and ecx, 0xa55e5667
or ecx, eax
mov eax, 0x8c87b6ed
imul rax, rcx
shr rax, 0x3f
ud2
ud2
mov eax, dword [0x1415adbf0]
mov edx, dword [0x1415adbf4]
mov r8d, eax
not r8d
and r8d, edx
not edx
and edx, eax
sub edx, r8d
mov eax, edx
not eax
and eax, 0x3ce6551b
mov r8d, edx
and r8d, 0xc319aae4
imul r8d, eax
mov eax, edx
and eax, 0x3ce6551b
or edx, 0x3ce6551b
imul edx, eax
lea eax, [rdx + r8]
add eax, 0x2264bb92
imul rax, rax, 0x7b673bf
shr rax, 0x3a
xorps xmm0, xmm0
movaps xmmword [rcx], xmm0
cmp eax, 0xe621eed8
jb 0x14002aae0
xorps xmm0, xmm0
movaps xmmword [rcx], xmm0
jmp 0x14002aa71
mov eax, dword [0x1415adc08]
and eax, dword [0x1415adc0c]
mov ecx, eax
xor ecx, 0x8a7fcde7
and eax, 0x75803218
add eax, eax
sub eax, ecx
mov ecx, eax
not ecx
mov edx, eax
or edx, 0x4f0fcac4
mov r8d, edx
and r8d, 0xbbddc02c
and ecx, 0x203513
imul ecx, r8d
and edx, 0x44223fd3
or eax, 0x4f2fffd7
imul eax, edx
add eax, ecx
cmp eax, 0xa6fa308
je 0x14002aae0
mov eax, dword [0x1415adc10]
mov ecx, dword [0x1415adc14]
mov edx, eax
xor edx, ecx
not ecx
and ecx, eax
add ecx, ecx
sub ecx, edx
not ecx
or ecx, 0xa1c1b0f8
mov eax, ecx
not eax
and ecx, 0xa0d45d49
mov edx, eax
and edx, 0x5e2a0206
imul edx, ecx
mov ecx, eax
and ecx, 0x144d01
or eax, 0xa0d45d49
imul eax, ecx
add eax, edx
xor eax, 0xa644d0c8
cmp eax, 0x7543c31f
jb 0x14002abe2
mov eax, dword [0x1415adc18]
xor edx, edx
div dword [0x1415adc1c]
mov ecx, eax
xor ecx, 0xd078adb1
xor eax, 0x50e4afea
add eax, ecx
and ecx, 0x7f63fda4
sub eax, ecx
mov ecx, eax
xor ecx, 0x5a09710
add ecx, eax
and eax, 0xfa5f68ef
sub ecx, eax
movaps xmm0, xmmword [r14]
movaps xmm1, xmmword [r14 + 0x10]
movaps xmm2, xmmword [r14 + 0x20]
movaps xmmword [rdi + 0x20], xmm2
movaps xmmword [rdi + 0x10], xmm1
movaps xmmword [rdi], xmm0
cmp ecx, 0xad61ea9d
jne 0x14002ac92
movaps xmm0, xmmword [r14]
movaps xmm1, xmmword [r14 + 0x10]
movaps xmm2, xmmword [r14 + 0x20]
movaps xmmword [rdi + 0x20], xmm2
movaps xmmword [rdi + 0x10], xmm1
movaps xmmword [rdi], xmm0
jmp 0x14002ab87
mov eax, dword [0x1415adc20]
xor edx, edx
div dword [0x1415adc24]
mov r14d, eax
not eax
mov ecx, r14d
and ecx, 0x442169e5
and eax, 0xbbde961a
imul eax, ecx
mov ecx, r14d
and ecx, 0xbbde961a
or r14d, 0xbbde961a
imul r14d, ecx
add r14d, eax
mov eax, r14d
xor eax, 0xbf6dafd6
or r14d, 0x40925028
and r14d, eax
add r14d, 0xec8a219d
mov rcx, qword [0x1415d3918]
sub rsp, 0x20
xor edx, edx
mov r8, rbx
call fcn.140219910
add rsp, 0x20
cmp r14d, 0x7b74650d
jbe 0x14002ac92
mov rcx, qword [0x1415d3918]
sub rsp, 0x20
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
jmp 0x14002abfd
mov qword [rdi + 0x40], 0
mov rax, 0xffffffffffffff00
add rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
sub rsp, 0x20
mov rcx, rdi
mov rdx, qword [rbp - 0x18]
call fcn.140119620
add rsp, 0x20
movaps xmm6, xmmword [rbp - 0x10]
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret