Function at 0x1400f2d70
Capabilities:
Access peb ldr_data
Encode data using xor
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xe0
movaps xmmword [rsp + 0xd0], xmm6
xor eax, eax
test al, al
jne 0x1400f2dd8
mov eax, dword [0x141dc7da0]
xor edx, edx
div dword [0x141dc7da4]
mov ebx, eax
add ebx, 0x36ca6d26
and ebx, 0xbc72bdeb
xorps xmm0, xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x70], xmm0
lea rsi, [rsp + 0x60]
xor ecx, ecx
mov rdx, rsi
mov r8d, 0x20
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
cmp ebx, 0xabb1bfe9
jbe 0x1400f2e00
xorps xmm0, xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
lea rdx, [rsp + 0x60]
xor ecx, ecx
mov r8d, 0x20
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
jmp 0x1400f2d8b
mov edi, eax
cmp eax, 0xc0000000
jb 0x1400f2ef1
mov eax, dword [0x141dc7da8]
xor edx, edx
div dword [0x141dc7dac]
add eax, 0x96bb2334
or eax, 0x7cd4c95d
xor eax, 0x3f37d619
cmp eax, 0x58cd5edd
jae 0x1400f2e41
lea rcx, [rsp + 0x60]
mov edx, 0x20
call qword [sym.imp.ADVAPI32.dll_SystemFunction036]
lea rbx, [rsp + 0x60]
mov r14, qword [sym.imp.ADVAPI32.dll_SystemFunction036]
nop dword [rax]
mov eax, dword [0x141dc7db0]
imul eax, dword [0x141dc7db4]
imul ebp, eax, 0x417aaf6e
add ebp, 0x9a7746b0
and ebp, 0xd7de77e6
mov rcx, rbx
mov edx, 0x20
call r14
cmp ebp, 0x3dc3c182
jb 0x1400f2e50
test al, al
jne 0x1400f2ef1
add edi, 0x80000000
nop dword [rax]
mov eax, dword [0x141dc7db8]
or eax, dword [0x141dc7dbc]
add eax, 0xf2b3a78e
xor eax, 0x43440014
or eax, 0x9c8ae6c8
cmp eax, 0x69d2593a
je 0x1400f2e90
nop word cs:[rax + rax]
mov eax, dword [0x141dc7dc0]
xor eax, dword [0x141dc7dc4]
imul rax, rax, 0x65867aaf
shr rax, 0x3d
xor eax, 0xae36c1e7
imul eax, eax, 0x1b580602
cmp eax, 0x1067c6a5
je 0x1400f2ec0
test edi, edi
jne 0x1400f2fda
movaps xmm0, xmmword [rsp + 0x60]
movaps xmm1, xmmword [rsp + 0x70]
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
lea rdi, [rsp + 0xa0]
mov rcx, qword [0x141dd7fe8]
nop word cs:[rax + rax]
mov eax, dword [0x141dc7de8]
xor edx, edx
div dword [0x141dc7dec]
imul eax, eax, 0xb1aade76
and eax, 0xb4b41cc8
add eax, 0x48ec5267
cmp eax, 0x853530ad
jb 0x1400f2f20
nop word cs:[rax + rax]
mov eax, dword [0x141dc7df0]
xor eax, dword [0x141dc7df4]
xor eax, 0x20582020
or eax, 0x56a3178f
cmp eax, 0x3414d537
jb 0x1400f2f50
test rcx, rcx
je 0x1400f2fa9
nop word cs:[rax + rax]
mov eax, dword [0x141dc7e10]
add eax, dword [0x141dc7e14]
and eax, 0x10006905
cmp eax, 0xb234e728
je 0x1400f2f80
and ecx, 0x4000
xor eax, eax
test al, al
jne 0x1400f2fa0
jmp 0x1400f3110
mov eax, dword [0x141dc7df8]
add eax, dword [0x141dc7dfc]
or eax, 0xd3d8b293
xor eax, 0x376dfb19
imul rax, rax, 0x73928c3
shr rax, 0x3a
cmp eax, 0x97e4c48a
ja 0x1400f30be
jmp 0x1400f30a5
movzx eax, byte [0x141dd7ff8]
mov eax, dword [0x141dc7dc8]
xor eax, dword [0x141dc7dcc]
and eax, 0x36d8b808
add eax, 0x4f8bcbc5
imul rax, rax, 0x15bd709
shr rax, 0x38
cmp eax, 0xbcb7be62
ja 0x1400f3036
mov eax, dword [0x141dc7dd0]
xor edx, edx
div dword [0x141dc7dd4]
xor eax, 0x294e16d6
imul esi, eax, 0x48d7a4b6
mov edx, 4
xor ecx, ecx
call fcn.1400beea0
cmp esi, 0x11877abc
jne 0x1400f3044
mov edx, 4
xor ecx, ecx
call fcn.1400beea0
jmp 0x1400f3009
mov ecx, 0x89689387
nop dword [rax]
mov edx, dword [0x141dc7dd8]
or edx, dword [0x141dc7ddc]
or edx, 0x6cfc6659
imul rdx, rcx
shr rdx, 0x3e
or edx, 0x5ac4fb9c
cmp edx, 0xf5cd006a
ja 0x1400f3050
test rax, rax
jne 0x1400f30a1
ud2
mov dword [rax], edi
ud2
mov ebx, dword [0x141dc7e00]
xor ebx, dword [0x141dc7e04]
call fcn.1400f98e0
cmp ebx, 0x7a68f804
jne 0x1400f30c5
call fcn.1400f98e0
jmp 0x1400f30a5
mov rcx, rax
and ecx, 0x4000
xor eax, eax
mov edx, dword [0x141dc7e08]
add edx, dword [0x141dc7e0c]
xor edx, 0x20dc727e
imul edx, edx, 0x8a735ed8
add edx, 0xe8d75468
cmp edx, 0x52b09b56
ja 0x1400f30d0
xor edx, edx
nop dword [rax + rax]
test dl, dl
jne 0x1400f3100
nop word cs:[rax + rax]
mov edx, dword [0x141dc7e18]
imul edx, dword [0x141dc7e1c]
xor edx, 0x26656bcf
imul edx, edx, 0xf94713cb
cmp edx, 0x5285d8a2
je 0x1400f3110
or rcx, rax
je 0x1400f314c
lea r8, [0x141db6280]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.14006efe0
jmp 0x1400f31b9
movaps xmm1, xmmword [rsp + 0x20]
movaps xmm0, xmmword [rsp + 0x30]
mov eax, dword [0x141dc7e20]
add eax, dword [0x141dc7e24]
imul rax, rax, 0x508ed1d1
shr rax, 0x3c
not eax
and eax, 0x8500445d
cmp eax, 0x40bad8d9
je 0x1400f319c
mov eax, dword [0x141dc7e28]
imul eax, dword [0x141dc7e2c]
add eax, 0xf2a8bc7
movaps xmmword [rsp + 0xa0], xmm1
cmp eax, 0x13cbf8cf
jae 0x1400f31a6
movaps xmmword [rsp + 0xa0], xmm1
jmp 0x1400f317b
movaps xmmword [rsp + 0xb0], xmm0
xorps xmm0, xmm0
movaps xmmword [rsp + 0xc0], xmm0
movaps xmm0, xmmword [rdi]
movaps xmm1, xmmword [rdi + 0x10]
movaps xmm2, xmmword [rdi + 0x20]
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x70], xmm1
movaps xmmword [rsp + 0x80], xmm2
mov eax, dword [0x141dc7e30]
xor edx, edx
div dword [0x141dc7e34]
lea rdi, [rsp + 0x98]
shr eax, 2
imul rax, rax, 0x460d92bf
shr rax, 0x3c
xor eax, 0x9531fd87
imul eax, eax, 0xd3f5995b
cmp eax, 0x1f7ddac2
jae 0x1400f3270
movaps xmm0, xmmword [rsp + 0x60]
movaps xmm1, xmmword [rsp + 0x70]
movaps xmm2, xmmword [rsp + 0x80]
movups xmmword [rdi + 0x20], xmm2
movups xmmword [rdi + 0x10], xmm1
movups xmmword [rdi], xmm0
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x50], rax
movups xmm0, xmmword [rsp + 0x90]
movups xmm1, xmmword [rsp + 0xa0]
movups xmm2, xmmword [rsp + 0xb0]
movaps xmmword [rsp + 0x40], xmm2
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
movzx eax, byte [0x141dd7ff8]
mov edx, 0x170
xor ecx, ecx
call fcn.1400beea0
mov ebx, 0x8a1915b5
nop word cs:[rax + rax]
mov eax, dword [0x141dc7e38]
sub eax, dword [0x141dc7e3c]
and eax, 0x4ec2c615
imul rax, rbx
shr rax, 0x3c
imul ebp, eax, 0x7ff7899a
movaps xmm0, xmmword [rsp + 0x60]
movaps xmm1, xmmword [rsp + 0x70]
movaps xmm2, xmmword [rsp + 0x80]
movups xmmword [rdi + 0x20], xmm2
movups xmmword [rdi + 0x10], xmm1
movups xmmword [rdi], xmm0
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x50], rax
movups xmm0, xmmword [rsp + 0x90]
movups xmm1, xmmword [rsp + 0xa0]
movups xmm2, xmmword [rsp + 0xb0]
movaps xmmword [rsp + 0x40], xmm2
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
movzx eax, byte [0x141dd7ff8]
mov edx, 0x170
xor ecx, ecx
call fcn.1400beea0
cmp ebp, 0xe3ca98a4
jb 0x1400f3280
test rax, rax
je 0x1400f30a3
mov qword [rax], 1
mov qword [rax + 8], 1
xorps xmm0, xmm0
movaps xmmword [rax + 0x10], xmm0
movaps xmmword [rax + 0x20], xmm0
movaps xmmword [rax + 0x30], xmm0
movaps xmmword [rax + 0x40], xmm0
movaps xmmword [rax + 0x50], xmm0
movaps xmmword [rax + 0x60], xmm0
movaps xmmword [rax + 0x70], xmm0
movaps xmmword [rax + 0x80], xmm0
movaps xmmword [rax + 0x90], xmm0
movaps xmmword [rax + 0xa0], xmm0
movaps xmmword [rax + 0xb0], xmm0
movaps xmmword [rax + 0xc0], xmm0
movaps xmmword [rax + 0xd0], xmm0
movaps xmmword [rax + 0xe0], xmm0
movaps xmmword [rax + 0xf0], xmm0
movaps xmmword [rax + 0x100], xmm0
mov qword [rax + 0x110], 0x40
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movaps xmm2, xmmword [rsp + 0x40]
movups xmmword [rax + 0x118], xmm0
movups xmmword [rax + 0x128], xmm1
movups xmmword [rax + 0x138], xmm2
mov rcx, qword [rsp + 0x50]
mov qword [rax + 0x148], rcx
mov qword [rax + 0x150], 0x10000
mov qword [rax + 0x158], 0x10000
mov qword [rax + 0x160], 0
mov ecx, dword [0x141dd7ffc]
mov rdx, qword gs:[0x58]
mov rdx, qword [rdx + rcx*8]
mov rcx, qword [rdx + 0x18]
mov rdi, qword [rdx + 0x20]
mov qword [rdx + 0x18], 1
mov qword [rdx + 0x20], rax
cmp rcx, 1
je 0x1400f35ed
test rcx, rcx
jne 0x1400f37d0
nop word [rax + rax]
mov eax, dword [0x141dc7e40]
xor edx, edx
div dword [0x141dc7e44]
add eax, 0xe9fc1b01
or eax, 0x680ef437
cmp eax, 0xf49d0d63
je 0x1400f3430
mov eax, dword [0x141dd7ffc]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rcx, qword [rax + 0x40]
nop dword [rax]
mov eax, dword [0x141dc7e48]
xor edx, edx
div dword [0x141dc7e4c]
and eax, 0x30c50180
add eax, 0x9feeb616
cmp eax, 0x5fd7fded
jb 0x1400f3470
test rcx, rcx
jne 0x1400f3819
mov eax, dword [0x141dc7e50]
or eax, dword [0x141dc7e54]
imul eax, eax, 0x692b5795
or eax, 0xebec8264
imul rcx, rax, 0x30fe6a6b
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1e
cmp eax, 0x7fdba0bf
jbe 0x1400f34f0
mov eax, dword [0x141dd7ffc]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov qword [rax + 0x40], 0xffffffffffffffff
nop dword [rax + rax]
mov eax, dword [0x141dd7ffc]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov ecx, dword [0x141dc7e58]
imul ecx, dword [0x141dc7e5c]
or ecx, 0xd8450d1b
xor ecx, 0xc385e2db
imul rcx, rcx, 0x975bfe9
shr rcx, 0x39
mov qword [rax + 0x40], 0xffffffffffffffff
cmp ecx, 0x15663013
ja 0x1400f34f0
mov rax, qword [0x1400ff600]
mov eax, dword [0x141dd7ffc]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rsi, qword [rax + 0x58]
mov rax, qword [rax + 0x48]
xor ecx, ecx
nop word cs:[rax + rax]
test cl, cl
jne 0x1400f3570
cmp rsi, rax
jne 0x1400f36d4
mov eax, dword [0x141dc7e88]
and eax, dword [0x141dc7e8c]
add eax, 0xb94165a0
xor eax, 0xd85b5c96
cmp eax, 0x18e3b341
jae 0x1400f35a0
call fcn.140089320
nop
mov eax, dword [0x141dc7e90]
and eax, dword [0x141dc7e94]
imul edi, eax, 0xbeac3287
add edi, 0x2cec4f09
and edi, 0xb0d9fb
call fcn.140089320
cmp edi, 0xc9152781
ja 0x1400f35a0
mov eax, dword [0x141dd7ffc]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rcx, qword [rax + 0x40]
inc rcx
jmp 0x1400f36d6
mov eax, 0xb111b6bf
nop word cs:[rax + rax]
mov ecx, dword [0x141dc7ea8]
add ecx, dword [0x141dc7eac]
imul ecx, ecx, 0x8f0e0f13
imul rcx, rax
shr rcx, 0x3e
cmp ecx, 0xe3fef651
je 0x1400f3600
mov rax, qword [rdi]
dec rax
mov qword [rdi], rax
nop dword [rax + rax]
mov ecx, dword [0x141dc7eb0]
or ecx, dword [0x141dc7eb4]
and ecx, 0x8c19b782
add ecx, 0xf123f45c
and ecx, 0x85192f10
cmp ecx, 0xd5e9afd1
je 0x1400f3630
test rax, rax
jne 0x1400f37d0
dec qword [rdi + 8]
jne 0x1400f37d0
mov rsi, qword [0x141dd7fe0]
mov eax, dword [0x141dc7eb8]
sub eax, dword [0x141dc7ebc]
add eax, 0x5186dae7
cmp eax, 0x98229ecc
jbe 0x1400f3696
mov rcx, rsi
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax]
mov eax, dword [0x141dc7ec0]
and eax, dword [0x141dc7ec4]
imul eax, eax, 0x89d4f703
or eax, 0xdd2bb545
imul ebp, eax, 0xed03dac5
mov rcx, rsi
xor edx, edx
mov r8, rdi
call rbx
cmp ebp, 0xb9e63b56
je 0x1400f36a0
jmp 0x1400f37d0
xor ecx, ecx
mov eax, dword [0x141dc7e98]
xor eax, dword [0x141dc7e9c]
imul eax, eax, 0x213222af
shr eax, 5
imul rax, rax, 0x13f8705
shr rax, 0x33
add eax, 0xf56721db
cmp eax, 0x7a88d602
jae 0x1400f374c
mov eax, dword [0x141dd7ffc]
mov rdx, qword gs:[0x58]
mov rax, qword [rdx + rax*8]
mov rdx, qword [rax + 0x50]
mov r8, rsi
shl r8, 4
lea r9, [rax + 0x18]
mov qword [rdx + r8], r9
lea r9, [0x14006ee00]
mov qword [rdx + r8 + 8], r9
lea rdx, [rsi + 1]
mov qword [rax + 0x58], rdx
mov qword [rax + 0x40], rcx
mov r8, rsi
shl r8, 4
inc rsi
lea r9, [0x14006ee00]
nop dword [rax]
mov eax, dword [0x141dc7ea0]
xor edx, edx
div dword [0x141dc7ea4]
mov edx, dword [0x141dd7ffc]
mov r10, qword gs:[0x58]
mov rdx, qword [r10 + rdx*8]
mov r10, qword [rdx + 0x50]
lea r11, [rdx + 0x18]
mov qword [r10 + r8], r11
imul rax, rax, 0xd5eb63d
shr rax, 0x3b
imul eax, eax, 0x4f5b7d94
add eax, 0x26382fcf
mov qword [r10 + r8 + 8], r9
mov qword [rdx + 0x58], rsi
mov qword [rdx + 0x40], rcx
cmp eax, 0x3c456c69
jae 0x1400f3760
nop word cs:[rax + rax]
mov eax, dword [0x141dc7ec8]
sub eax, dword [0x141dc7ecc]
imul eax, eax, 0x830475be
add eax, 0x64c71652
cmp eax, 0x4cf0bff3
ja 0x1400f37d0
nop
mov eax, dword [0x141dc7ed0]
or eax, dword [0x141dc7ed4]
cmp eax, 0x7ea481ea
je 0x1400f37f0
movaps xmm6, xmmword [rsp + 0xd0]
add rsp, 0xe0
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov eax, dword [0x141dc7e60]
add eax, dword [0x141dc7e64]
imul rax, rax, 0x7502cdcd
shr rax, 0x3e
imul eax, eax, 0x18857d99
add eax, 0x4491865f
cmp eax, 0x381fb35b
jae 0x1400f385e
mov dword [rsp + 0x20], 0
mov byte [rsp + 0x24], 0
lea rax, [0x141db6ac0]
mov qword [rsp + 0x90], rax
lea rax, [0x141db6ac0]
nop word cs:[rax + rax]
mov ecx, dword [0x141dc7e68]
xor ecx, dword [0x141dc7e6c]
and ecx, 0x58080020
add ecx, 0x33299d49
mov dword [rsp + 0x20], 0
mov byte [rsp + 0x24], 0
mov qword [rsp + 0x90], rax
cmp ecx, 0x865e5d91
ja 0x1400f3870
xor eax, eax
test al, al
jne 0x1400f38e3
mov eax, dword [0x141dc7e70]
or eax, dword [0x141dc7e74]
and eax, 0x993d271d
mov ecx, 0xfcc27967
imul rcx, rax
shr rcx, 0x3c
add ecx, 0x1c0f7ea
mov qword [rsp + 0x98], 1
cmp ecx, 0xb5e2e08
jbe 0x1400f38f1
mov qword [rsp + 0x98], 1
jmp 0x1400f38ab
mov eax, dword [str.z_rfT__]
xor eax, dword [0x141dc7e7c]
add eax, 0x709b5bc2
xor eax, 0x490cfa06
or eax, 0x36730568
cmp eax, 0x1574ea2a
jne 0x1400f3947
mov qword [rsp + 0xa0], rsi
xorps xmm0, xmm0
movups xmmword [rsp + 0xa8], xmm0
lea rcx, [rsp + 0x20]
lea rdx, [rsp + 0x90]
call fcn.140086dc0
mov rcx, rax
call fcn.140087240
mov ecx, 7
int 0x29
xorps xmm6, xmm6
lea rdi, [rsp + 0x20]
lea rbx, [rsp + 0x90]
nop word [rax + rax]
mov eax, dword [0x141dc7e80]
add eax, dword [0x141dc7e84]
and eax, 0xf748b9e
imul ebp, eax, 0xb86c2dc1
mov qword [rsp + 0xa0], rsi
movups xmmword [rsp + 0xa8], xmm6
mov rcx, rdi
mov rdx, rbx
call fcn.140086dc0
mov rcx, rax
call fcn.140087240
mov ecx, 7
int 0x29
cmp ebp, 0xaf40dce7
ja 0x1400f3960
jmp 0x1400f30a3