Function at 0x1400fadf0
Capabilities:
Access peb ldr_data
Encode data using base64
Encode data using xor
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov eax, dword [0x141f383e8]
xor edx, edx
div dword [0x141f383ec]
xor eax, 0xb61f1db0
imul eax, eax, 0x5c0baf46
cmp eax, 0x66487dfb
jae 0x1400fae70
xor eax, eax
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x30
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x40
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x20
call fcn.1400f4d10
sub rsp, rax
nop word cs:[rax + rax]
mov ecx, dword [0x141f383f0]
sub ecx, dword [0x141f383f4]
and ecx, 0xfa7a733
add ecx, 0x58c706f9
or ecx, 0xe196d143
xor eax, eax
call fcn.1400f4d10
sub rsp, rax
mov r13, rsp
mov eax, 0x30
call fcn.1400f4d10
sub rsp, rax
mov rsi, rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov rdi, rsp
mov eax, 0x40
call fcn.1400f4d10
sub rsp, rax
mov r14, rsp
mov eax, 0x20
call fcn.1400f4d10
sub rsp, rax
mov rbx, rsp
cmp ecx, 0x6fe176f3
jb 0x1400fae70
mov eax, 0x20
call fcn.1400f4d10
sub rsp, rax
mov r15, rsp
mov eax, 0x30
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp - 0x10], rsp
mov eax, 0x40
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp - 0x18], rsp
mov eax, 0x40
call fcn.1400f4d10
sub rsp, rax
mov r12, rsp
xorps xmm0, xmm0
movups xmmword [r15 + 0x10], xmm0
movups xmmword [r15], xmm0
sub rsp, 0x20
xor ecx, ecx
mov rdx, r15
mov r8d, 0x20
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
add rsp, 0x20
cmp eax, 0xc0000000
jb 0x1400fb0b9
mov dword [rbp - 4], eax
mov qword [rbp], r12
mov eax, dword [0x141f383f8]
xor eax, dword [0x141f383fc]
or eax, 0x44a47c60
imul eax, eax, 0xbc9b9c5e
or eax, 0x708dc56b
cmp eax, 0x3d7f0ea
jb 0x1400fafc2
mov eax, dword [0x141f38400]
sub eax, dword [0x141f38404]
imul r12, rax, 0x3a8e6c71
shr r12, 0x3d
add r12d, 0xb20a9d07
sub rsp, 0x20
mov rcx, r15
mov edx, 0x20
call qword [sym.imp.ADVAPI32.dll_SystemFunction036]
add rsp, 0x20
cmp r12d, 0x54bb8ec4
jae 0x1400fafe0
sub rsp, 0x20
mov rcx, r15
mov edx, 0x20
call qword [sym.imp.ADVAPI32.dll_SystemFunction036]
add rsp, 0x20
jmp 0x1400faf85
mov ecx, dword [0x141f38408]
xor ecx, dword [0x141f3840c]
shr ecx, 2
imul rcx, rcx, 0x132f879
shr rcx, 0x34
xor ecx, 0xbae6524f
add ecx, 0xbf2c27a5
cmp ecx, 0x44e663f8
jb 0x1400fafe0
xor ecx, ecx
mov r12, qword [rbp]
mov r8d, dword [rbp - 4]
nop dword [rax + rax]
test cl, cl
jne 0x1400fb020
test al, al
jne 0x1400fb0b9
mov eax, dword [0x141f38410]
xor edx, edx
div dword [0x141f38414]
add r8d, 0x80000000
nop word cs:[rax + rax]
mov eax, dword [0x141f38418]
or eax, dword [0x141f3841c]
imul eax, eax, 0x4405eab8
add eax, 0xf38637e9
shr eax, 1
imul rax, rax, 0x124286a3
shr rax, 0x3a
cmp eax, 0x321dcd19
ja 0x1400fb050
nop dword [rax + rax]
mov eax, dword [0x141f38420]
or eax, dword [0x141f38424]
and eax, 0x143fd2f3
xor eax, 0xd11c763c
add eax, 0xb3760749
cmp eax, 0xd111a770
ja 0x1400fb080
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x1400fb0b0
test r8d, r8d
jne 0x1400fb0fc
movups xmm0, xmmword [r15]
movups xmm1, xmmword [r15 + 0x10]
movups xmmword [rbx + 0x10], xmm1
movups xmmword [rbx], xmm0
mov rcx, r12
mov eax, dword [0x141f38450]
imul eax, dword [0x141f38454]
add rcx, 0x10
mov qword [rbp], rcx
imul eax, eax, 0x33c90513
add eax, 0xd4a2c6a
cmp eax, 0xaebde9f9
jbe 0x1400fb220
jmp 0x1400fb258
mov edi, r8d
mov eax, dword [0x141f38428]
add eax, dword [0x141f3842c]
xor eax, 0x236528f0
add eax, 0x3f743be7
cmp eax, 0xff0ca326
ja 0x1400fb145
mov eax, dword [0x141f38430]
add eax, dword [0x141f38434]
and eax, 0xb058eb9b
xor eax, 0xfd3297c
add eax, 0x87766619
movzx ecx, byte [0x141f49078]
cmp eax, 0xa761ccb0
jbe 0x1400fb14e
movzx eax, byte [0x141f49078]
jmp 0x1400fb11c
mov eax, dword [0x141f38438]
sub eax, dword [0x141f3843c]
xor eax, 0xdddc22d6
imul rax, rax, 0x12b18e99
shr rax, 0x3b
and eax, 0xfffffffe
cmp eax, 0x3ef535f3
je 0x1400fb1ae
mov esi, dword [0x141f38440]
or esi, dword [0x141f38444]
add esi, 0x38a5b24
and esi, 0x3022d2e
xor esi, 0x477e40d9
sub rsp, 0x20
mov edx, 4
xor ecx, ecx
call fcn.1400c6170
add rsp, 0x20
cmp esi, 0xba296175
jbe 0x1400fb1c4
sub rsp, 0x20
mov edx, 4
xor ecx, ecx
call fcn.1400c6170
add rsp, 0x20
jmp 0x1400fb174
test rax, rax
jne 0x1400fb1f4
ud2
mov ecx, dword [0x141f384b0]
imul ecx, dword [0x141f384b4]
add ecx, 0x2ba824ae
and ecx, 0xf747ff50
cmp ecx, 0x9788d1f2
jbe 0x1400fb974
jmp 0x1400fb9a7
ud2
mov eax, dword [0x141f38458]
sub eax, dword [0x141f3845c]
add eax, 0xda2d21e5
and eax, 0xf8322f7d
imul rcx, rax, 0x5fdf59f1
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1c
mov rcx, qword [0x141f49068]
cmp eax, 0xa040c103
jbe 0x1400fb261
mov rax, qword [0x141f49068]
jmp 0x1400fb220
test rcx, rcx
je 0x1400fb3c7
and ecx, 0x4000
xor r8d, r8d
nop word cs:[rax + rax]
mov eax, dword [0x141f38470]
or eax, dword [0x141f38474]
imul eax, eax, 0x9e50aa6f
add eax, 0xe0d6ac6f
cmp eax, 0xa2e7be41
jb 0x1400fb280
nop
mov eax, dword [0x141f38478]
xor edx, edx
div dword [0x141f3847c]
imul eax, eax, 0xfda66477
add eax, 0xc782585a
imul rax, rax, 0x25ff0267
shr rax, 0x3d
cmp eax, 0x423ec07a
je 0x1400fb2a0
or rcx, r8
je 0x1400fb36b
mov eax, dword [0x141f38498]
imul eax, dword [0x141f3849c]
and eax, 0x8860080
or eax, 0x3171a75c
imul rax, rax, 0x2b4bdbbd
shr rax, 0x3b
cmp eax, 0x2d71991d
jbe 0x1400fb318
sub rsp, 0x20
lea r8, [0x141f25548]
mov rcx, qword [rbp]
mov rdx, rbx
call fcn.140075cc0
add rsp, 0x20
lea r15, [0x141f25548]
nop
mov eax, dword [0x141f384a0]
xor edx, edx
div dword [0x141f384a4]
mov r12d, eax
and r12d, 0x3425fe9b
xor r12d, 0x7b12c821
add r12d, 0x1b316fc9
sub rsp, 0x20
mov rcx, qword [rbp]
mov rdx, rbx
mov r8, r15
call fcn.140075cc0
add rsp, 0x20
cmp r12d, 0xfe037372
ja 0x1400fb320
jmp 0x1400fb46d
movaps xmm1, xmmword [rbx]
movaps xmm0, xmmword [rbx + 0x10]
mov rax, qword [rbp]
movaps xmmword [rax], xmm1
nop dword [rax]
mov eax, dword [0x141f38480]
sub eax, dword [0x141f38484]
add eax, 0x6630c8fc
or eax, 0x545bf2b0
and eax, 0xd6dbf6b7
cmp eax, 0xa528621d
jb 0x1400fb380
mov eax, dword [0x141f38488]
xor edx, edx
div dword [0x141f3848c]
imul eax, eax, 0xcc4dfa24
add eax, 0x4e884be4
cmp eax, 0x4a43d1a6
jae 0x1400fb41d
jmp 0x1400fb45c
sub rsp, 0x20
call fcn.140101fa0
add rsp, 0x20
mov rcx, rax
and ecx, 0x4000
xor r8d, r8d
mov eax, dword [0x141f38460]
xor eax, dword [0x141f38464]
and eax, 0xdb9b82f3
add eax, 0xe61c55b5
cmp eax, 0xe3172fa7
ja 0x1400fb3e0
nop dword [rax]
mov eax, dword [0x141f38468]
sub eax, dword [0x141f3846c]
and eax, 0xa04a04e2
cmp eax, 0x1722df5
je 0x1400fb400
jmp 0x1400fb2a0
mov eax, dword [0x141f38490]
xor edx, edx
div dword [0x141f38494]
xor eax, 0x4535ffd8
shr eax, 1
mov ecx, 0x85fdcbe3
imul rcx, rax
shr rcx, 0x3e
add ecx, 0x43482365
movaps xmmword [r12 + 0x20], xmm0
xorps xmm1, xmm1
movaps xmmword [r12 + 0x30], xmm1
cmp ecx, 0x42dc7a1e
ja 0x1400fb46d
movaps xmmword [r12 + 0x20], xmm0
xorps xmm1, xmm1
movaps xmmword [r12 + 0x30], xmm1
jmp 0x1400fb41d
mov rax, qword [rbp]
movaps xmm0, xmmword [rax]
movaps xmm1, xmmword [rax + 0x10]
movaps xmm2, xmmword [rax + 0x20]
mov r8, qword [rbp - 0x10]
movaps xmmword [r8 + 0x20], xmm2
movaps xmmword [r8 + 0x10], xmm1
movaps xmmword [r8], xmm0
mov rax, r14
add rax, 8
mov rbx, qword [rbp - 0x18]
nop dword [rax]
mov ecx, dword [0x141f384a8]
mov edx, dword [0x141f384ac]
add ecx, edx
add ecx, 0x1260c3f0
or ecx, 0x479ff938
xor ecx, 0x7695e306
cmp ecx, 0xa0c90329
ja 0x1400fb4a0
movups xmm0, xmmword [r8]
movups xmm1, xmmword [r8 + 0x10]
movups xmm2, xmmword [r8 + 0x20]
movups xmmword [rax + 0x20], xmm2
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
mov rax, qword [r14 + 0x30]
mov qword [rbx + 0x30], rax
movups xmm0, xmmword [r14]
movups xmm1, xmmword [r14 + 0x10]
movups xmm2, xmmword [r14 + 0x20]
movups xmmword [rbx + 0x20], xmm2
movups xmmword [rbx + 0x10], xmm1
movups xmmword [rbx], xmm0
movzx eax, byte [0x141f49078]
sub rsp, 0x20
mov edx, 0x170
xor ecx, ecx
call fcn.1400c6170
add rsp, 0x20
test rax, rax
je 0x1400fb21e
mov ecx, dword [0x141f384c0]
imul ecx, dword [0x141f384c4]
xor ecx, 0x4000010
and ecx, 0x4004012
cmp ecx, 0xb4beaaf7
jne 0x1400fb556
mov qword [rax], 1
mov qword [rax + 8], 1
mov rcx, rax
add rcx, 0x10
nop dword [rax]
mov edx, dword [0x141f384c8]
add edx, dword [0x141f384cc]
mov qword [rax], 1
mov qword [rax + 8], 1
cmp edx, 0x53c6c662
je 0x1400fb560
xorps xmm0, xmm0
movaps xmmword [rcx + 0xf0], xmm0
movaps xmmword [rcx + 0xe0], xmm0
movaps xmmword [rcx + 0xd0], xmm0
movaps xmmword [rcx + 0xc0], xmm0
movaps xmmword [rcx + 0xb0], xmm0
movaps xmmword [rcx + 0xa0], xmm0
movaps xmmword [rcx + 0x90], xmm0
movaps xmmword [rcx + 0x80], xmm0
movaps xmmword [rcx + 0x70], xmm0
movaps xmmword [rcx + 0x60], xmm0
movaps xmmword [rcx + 0x50], xmm0
movaps xmmword [rcx + 0x40], xmm0
movaps xmmword [rcx + 0x30], xmm0
movaps xmmword [rcx + 0x20], xmm0
movaps xmmword [rcx + 0x10], xmm0
movaps xmmword [rcx], xmm0
mov qword [rax + 0x110], 0x40
movups xmm0, xmmword [rbx]
movups xmm1, xmmword [rbx + 0x10]
movups xmm2, xmmword [rbx + 0x20]
movups xmmword [rax + 0x118], xmm0
movups xmmword [rax + 0x128], xmm1
movups xmmword [rax + 0x138], xmm2
mov rcx, qword [rbx + 0x30]
mov qword [rax + 0x148], rcx
mov qword [rax + 0x150], 0x10000
mov qword [rax + 0x158], 0x10000
mov qword [rax + 0x160], 0
mov ecx, dword [0x141f4907c]
mov rdx, qword gs:[0x58]
mov rdx, qword [rdx + rcx*8]
mov rcx, qword [rdx + 0x18]
mov rbx, qword [rdx + 0x20]
mov qword [rdx + 0x18], 1
mov qword [rdx + 0x20], rax
cmp rcx, 1
je 0x1400fb834
test rcx, rcx
jne 0x1400fbba8
nop word [rax + rax]
mov eax, dword [0x141f384d0]
imul eax, dword [0x141f384d4]
xor eax, 0x6142102
and eax, 0xe14a54e
xor eax, 0xb84e1c8d
cmp eax, 0x491734a2
jb 0x1400fb680
nop word cs:[rax + rax]
mov eax, dword [0x141f384d8]
xor eax, dword [0x141f384dc]
imul eax, eax, 0x87060a1f
or eax, 0x4a51e6ab
xor eax, 0x3c47a024
cmp eax, 0xbc4b84e6
ja 0x1400fb6b0
mov eax, dword [0x141f4907c]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0x40], 0
jne 0x1400fb95f
mov eax, dword [0x141f4907c]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov qword [rax + 0x40], 0xffffffffffffffff
mov rcx, qword [0x140108608]
mov rsi, qword [rax + 0x58]
cmp rsi, qword [rax + 0x48]
jne 0x1400fb926
mov eax, dword [0x141f384e8]
and eax, dword [0x141f384ec]
or eax, 0x5f1d62b1
add eax, 0xe2155fab
or eax, 0xa6ad4b54
cmp eax, 0xd1c71865
jne 0x1400fb75c
sub rsp, 0x20
call fcn.1400907b0
add rsp, 0x20
mov edi, 0xc4440abb
nop word cs:[rax + rax]
mov ebx, dword [0x141f384f0]
xor ebx, dword [0x141f384f4]
imul rbx, rdi
shr rbx, 0x3e
add ebx, 0x91ccb6e2
xor ebx, 0x4991761a
sub rsp, 0x20
call fcn.1400907b0
add rsp, 0x20
cmp ebx, 0x7ba38fce
jb 0x1400fb770
mov eax, dword [0x141f384f8]
xor edx, edx
div dword [0x141f384fc]
nop word cs:[rax + rax]
mov eax, dword [0x141f38500]
xor edx, edx
div dword [0x141f38504]
xor eax, 0x9398d21f
add eax, 0xa99d4530
imul rax, rax, 0x752dd443
shr rax, 0x3e
cmp eax, 0xec2cd09e
ja 0x1400fb7c0
mov eax, dword [0x141f4907c]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rcx, qword [rax + 0x40]
inc rcx
nop word [rax + rax]
mov eax, dword [0x141f38508]
xor edx, edx
div dword [0x141f3850c]
or eax, 0x44210404
and eax, 0x44354454
cmp eax, 0x9fde03a3
je 0x1400fb810
jmp 0x1400fb928
mov rcx, qword [rbx]
mov eax, dword [0x141f38520]
xor edx, edx
div dword [0x141f38524]
dec rcx
and eax, 0x380b70af
cmp eax, 0x124eb31e
jne 0x1400fb860
mov qword [rbx], rcx
nop word [rax + rax]
mov eax, dword [0x141f38528]
and eax, dword [0x141f3852c]
or eax, 0xf7ffffff
mov qword [rbx], rcx
cmp eax, 0x7a68815
jb 0x1400fb860
test rcx, rcx
jne 0x1400fbba8
nop word cs:[rax + rax]
mov eax, dword [0x141f38530]
xor edx, edx
div dword [0x141f38534]
xor eax, 0x2fe5082b
add eax, 0xb89c1ba4
cmp eax, 0x21d279c1
jb 0x1400fb890
mov rcx, qword [rbx + 8]
dec rcx
mov qword [rbx + 8], rcx
mov eax, dword [0x141f38538]
xor edx, edx
div dword [0x141f3853c]
nop dword [rax + rax]
mov eax, dword [0x141f38540]
and eax, dword [0x141f38544]
add eax, 0x77aed813
or eax, 0xcbb9be57
cmp eax, 0x1c82a80
je 0x1400fb8d0
test rcx, rcx
jne 0x1400fbba8
mov rsi, qword [0x141f49060]
mov eax, dword [0x141f38548]
xor edx, edx
div dword [0x141f3854c]
imul eax, eax, 0x90317fa0
add eax, 0xfa744f26
cmp eax, 0x2fcc4e22
jae 0x1400fbb1f
jmp 0x1400fbb59
xor ecx, ecx
mov eax, dword [0x141f38510]
imul eax, dword [0x141f38514]
mov edx, 0xbfdd2231
imul rdx, rax
shr rdx, 0x3e
xor edx, 0x10020681
or edx, 0xa82d7954
cmp edx, 0xa7a35dbf
jae 0x1400fba59
jmp 0x1400fbad0
mov dword [rdi], 0
mov byte [rdi + 4], 0
xor eax, eax
test al, al
je 0x1400fb9ab
jmp 0x1400fba15
mov ecx, dword [str._5]
and ecx, dword [0x141f384bc]
imul ecx, ecx, 0xd2152cfe
mov edx, 0x95dd08f7
imul rdx, rcx
shr rdx, 0x3f
imul ecx, edx, 0x1777c73b
mov dword [rax], edi
cmp ecx, 0x178094b8
jbe 0x1400fb21e
mov dword [rax], edi
jmp 0x1400fb974
mov eax, dword [0x141f384e0]
xor eax, dword [0x141f384e4]
xor eax, 0xb4ffc754
shr eax, 2
imul rbx, rax, 0x43d9ea0d
shr rbx, 0x3c
lea rax, [0x141f25d90]
mov qword [rsi], rax
mov qword [rsi + 8], 1
mov qword [rsi + 0x10], r13
xorps xmm0, xmm0
movups xmmword [rsi + 0x18], xmm0
sub rsp, 0x20
mov rcx, rdi
mov rdx, rsi
call fcn.14008e020
mov rcx, rax
call fcn.14008e440
add rsp, 0x20
mov ecx, 7
int 0x29
cmp ebx, 0x5f575ee
jne 0x1400fb21e
lea rax, [0x141f25d90]
mov qword [rsi], rax
mov qword [rsi + 8], 1
mov qword [rsi + 0x10], r13
xorps xmm0, xmm0
movups xmmword [rsi + 0x18], xmm0
sub rsp, 0x20
mov rcx, rdi
mov rdx, rsi
call fcn.14008e020
mov rcx, rax
call fcn.14008e440
add rsp, 0x20
mov ecx, 7
int 0x29
jmp 0x1400fb9ab
mov eax, dword [0x141f38518]
add eax, dword [0x141f3851c]
and eax, 0x5b8b9cf0
imul rax, rax, 0x356a54cd
shr rax, 0x3b
add eax, 0x2e0239c3
mov rdx, rsi
shl rdx, 4
mov r8d, dword [0x141f4907c]
mov r9, qword gs:[0x58]
mov r8, qword [r9 + r8*8]
mov r9, qword [r8 + 0x50]
lea r10, [r8 + 0x18]
mov qword [r9 + rdx], r10
lea r10, [0x140075b20]
mov qword [r9 + rdx + 8], r10
lea rdx, [rsi + 1]
mov qword [r8 + 0x58], rdx
mov qword [r8 + 0x40], rcx
cmp eax, 0xc3e4a048
jbe 0x1400fbba8
mov eax, dword [0x141f4907c]
mov rdx, qword gs:[0x58]
mov rax, qword [rdx + rax*8]
mov rdx, qword [rax + 0x50]
mov r8, rsi
shl r8, 4
lea r9, [rax + 0x18]
mov qword [rdx + r8], r9
lea r9, [0x140075b20]
mov qword [rdx + r8 + 8], r9
lea rdx, [rsi + 1]
mov qword [rax + 0x58], rdx
mov qword [rax + 0x40], rcx
jmp 0x1400fba59
mov eax, dword [0x141f38550]
xor edx, edx
div dword [0x141f38554]
mov edi, eax
add edi, 0xbda1cd1f
or edi, 0xd53c5741
sub rsp, 0x20
mov rcx, rsi
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
cmp edi, 0x4b5b88ab
jae 0x1400fbb71
sub rsp, 0x20
mov rcx, rsi
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
jmp 0x1400fbb1f
mov ecx, 0xc7a23b05
nop word cs:[rax + rax]
mov eax, dword [0x141f38558]
xor edx, edx
div dword [0x141f3855c]
imul eax, eax, 0x4067249b
imul rax, rcx
shr rax, 0x3d
add eax, 0x45c09377
cmp eax, 0xe35616cb
ja 0x1400fbb80
mov eax, dword [str.7v_t9]
xor edx, edx
div dword [0x141f38564]
mov eax, 0x8c4c7e83
nop dword [rax + rax]
mov ecx, dword [0x141f38568]
sub ecx, dword [0x141f3856c]
xor ecx, 0x38e6650
shr ecx, 1
imul rcx, rax
shr rcx, 0x3e
xor ecx, 0xac28ebbb
cmp ecx, 0xd2f8666b
ja 0x1400fbbc0
nop word [rax + rax]
mov eax, dword [0x141f38570]
sub eax, dword [0x141f38574]
add eax, 0xdab0631d
cmp eax, 0x818a30e3
jb 0x1400fbbf0
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret