Function at 0x140011100
Capabilities:
Encode data using xor
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa0
mov rsi, rdx
mov rdi, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x20
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
mov ebx, eax
nop
mov eax, dword [0x141f2e030]
sub eax, dword [0x141f2e034]
or eax, 0xe5b27c78
imul eax, eax, 0x4052deca
add eax, 0xb54a9823
cmp eax, 0x30302d63
jb 0x140011140
cmp ebx, 0xc0000000
jb 0x1400111c5
xor eax, eax
test al, al
je 0x140011181
lea rcx, [rsp + 0x20]
mov edx, 0x20
call qword [sym.imp.ADVAPI32.dll_SystemFunction036]
lea r14, [rsp + 0x20]
mov r15, qword [sym.imp.ADVAPI32.dll_SystemFunction036]
nop dword [rax]
mov eax, dword [0x141f2e038]
add eax, dword [0x141f2e03c]
imul ebp, eax, 0xc595850
add ebp, 0xcf85c63c
xor ebp, 0x8c22f4b8
mov rcx, r14
mov edx, 0x20
call r15
cmp ebp, 0x9bd113ed
jb 0x140011190
test al, al
je 0x14001121f
mov eax, 0xebd58d6b
nop word [rax + rax]
mov ecx, dword [0x141f2e070]
and ecx, dword [0x141f2e074]
imul ecx, ecx, 0x3b831aee
add ecx, 0x59b2203
imul rcx, rax
shr rcx, 0x3c
cmp ecx, 0xc87e052d
ja 0x1400111d0
mov eax, dword [0x141f2e078]
or eax, dword [0x141f2e07c]
and eax, 0x40302281
imul eax, eax, 0xd7e7135c
cmp eax, 0x97096830
jbe 0x1400113d6
jmp 0x1400113f7
xor ebx, 0x80000000
je 0x1400111c5
mov eax, dword [0x141f2e040]
xor eax, dword [0x141f2e044]
add eax, 0x6a9aa30a
xor eax, 0xc0254284
or eax, 0x3bdabd7b
cmp eax, 0xedc0a916
ja 0x140011273
mov eax, dword [0x141f2e048]
xor eax, dword [0x141f2e04c]
add eax, 0xcdea5f68
and eax, 0x98d2fedd
imul eax, eax, 0xad0cf989
movzx ecx, byte [0x141f49078]
cmp eax, 0xfc6c3921
jbe 0x14001127c
movzx eax, byte [0x141f49078]
jmp 0x140011249
mov eax, dword [0x141f2e050]
imul eax, dword [0x141f2e054]
add eax, 0xd01d75f4
and eax, 0xd94a8b56
cmp eax, 0xe88bcfb2
je 0x1400112d1
mov eax, dword [0x141f2e058]
add eax, dword [0x141f2e05c]
or eax, 0x997daf01
imul eax, eax, 0x545b4ee6
imul r15, rax, 0x51830cc1
shr r15, 0x3d
mov edx, 4
xor ecx, ecx
call fcn.1400c6170
cmp r15d, 0x33916920
jbe 0x1400112df
mov edx, 4
xor ecx, ecx
call fcn.1400c6170
jmp 0x14001129a
mov r14, rax
nop word cs:[rax + rax]
mov eax, dword [0x141f2e060]
xor eax, dword [0x141f2e064]
imul eax, eax, 0xc995e5cc
add eax, 0x198e63aa
cmp eax, 0xae06d808
ja 0x1400112f0
test r14, r14
je 0x1400113a9
mov dword [r14], ebx
mov eax, dword [0x141f2e0d0]
and eax, dword [0x141f2e0d4]
xor eax, 0x456287
add eax, 0xd0577faa
or eax, 0xff078d8e
cmp eax, 0xd5b1f341
jne 0x14001134e
mov rcx, qword [0x141f49060]
xor edx, edx
mov r8, r14
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [sym.imp.KERNEL32.dll_HeapFree]
nop word cs:[rax + rax]
mov eax, dword [0x141f2e0d8]
xor eax, dword [str._DDR]
and eax, 0x4e92de0a
imul ebp, eax, 0x7b633bb6
add ebp, 0xa1ce20f8
mov rcx, qword [0x141f49060]
xor edx, edx
mov r8, r14
call rbx
cmp ebp, 0xb26a4e4
jb 0x140011360
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x1400113a0
jmp 0x140011694
ud2
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x50], xmm1
mov rax, qword [0x141f49068]
xor ecx, ecx
test cl, cl
je 0x140011414
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x50], xmm1
movaps xmmword [rsp + 0x40], xmm0
mov rax, qword [0x141f49068]
jmp 0x1400113d6
lea rbx, [rsp + 0x70]
xor ecx, ecx
nop dword [rax + rax]
test cl, cl
jne 0x140011420
test rax, rax
je 0x140011490
and eax, 0x4000
nop
mov ecx, dword [0x141f2e098]
xor ecx, dword [0x141f2e09c]
add ecx, 0xd3d9342
imul rcx, rcx, 0x4ba5e99f
shr rcx, 0x3e
imul ecx, ecx, 0x52e7e99d
cmp ecx, 0xf957c348
je 0x140011430
xor ecx, ecx
nop dword [rax]
mov edx, dword [0x141f2e0a0]
sub edx, dword [0x141f2e0a4]
imul rdx, rdx, 0x374746cb
shr rdx, 0x3d
xor edx, 0x1000a44b
or edx, 0x88015330
cmp edx, 0x8f74c05
jb 0x140011460
jmp 0x140011520
mov eax, dword [0x141f2e080]
xor eax, dword [0x141f2e084]
or eax, 0x7680830
and eax, 0x577a0c7a
xor eax, 0xeff4b293
cmp eax, 0x6c66f163
jb 0x14001160a
mov eax, dword [0x141f2e088]
and eax, dword [0x141f2e08c]
xor eax, 0x64849094
or eax, 0x9b6a656a
shr eax, 1
imul r14, rax, 0x48ca44f5
shr r14, 0x3b
call fcn.140101fa0
cmp r14d, 0x28ef382f
ja 0x1400114b6
and eax, 0x4000
xor ecx, ecx
nop
mov edx, dword [0x141f2e090]
or edx, dword [0x141f2e094]
and edx, 0x2752b1e4
add edx, 0x6f3d8854
or edx, 0x196ad9e7
cmp edx, 0xdac2e58b
ja 0x1400114f0
nop word cs:[rax + rax]
mov edx, dword [0x141f2e0a8]
imul edx, dword [0x141f2e0ac]
shr edx, 1
imul rdx, rdx, 0x8907e55
shr rdx, 0x33
add edx, 0xf418fed5
xor edx, 0x4b5aa7c2
cmp edx, 0xb9b96330
jb 0x140011520
or rax, rcx
je 0x1400115dc
mov eax, dword [0x141f2e0c0]
xor eax, dword [0x141f2e0c4]
or eax, 0x8048510
and eax, 0xda25c551
cmp eax, 0x6f15840f
jne 0x140011588
lea r8, [0x141f25548]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140075cc0
mov r12d, 0xaa7f24a7
lea r14, [0x141f25548]
lea r15, [rsp + 0x40]
nop word [rax + rax]
mov eax, dword [0x141f2e0c8]
xor edx, edx
div dword [0x141f2e0cc]
and eax, 0x86b09ca3
imul rax, r12
shr rax, 0x3d
imul ebp, eax, 0x3902d66a
mov rcx, rbx
mov rdx, r15
mov r8, r14
call fcn.140075cc0
cmp ebp, 0x3399b6ca
ja 0x1400115a0
jmp 0x140011674
movaps xmm0, xmmword [rsp + 0x40]
movaps xmm1, xmmword [rsp + 0x50]
mov eax, dword [0x141f2e0b0]
or eax, dword [0x141f2e0b4]
or eax, 0x7feaeafb
add eax, 0xa38dc120
and eax, 0xa2bd1c04
cmp eax, 0xe0eb29f5
jne 0x140011614
jmp 0x140011632
call fcn.140101fa0
jmp 0x1400114b6
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x80], xmm1
xorps xmm2, xmm2
movaps xmmword [rsp + 0x90], xmm2
xor eax, eax
test al, al
je 0x140011650
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x80], xmm1
xorps xmm2, xmm2
movaps xmmword [rsp + 0x90], xmm2
jmp 0x140011614
mov eax, dword [0x141f2e0b8]
or eax, dword [0x141f2e0bc]
imul eax, eax, 0x718bff24
xor eax, 0x9e69dd61
imul eax, eax, 0x25d3f995
cmp eax, 0xc2aaf050
je 0x140011650
movaps xmm0, xmmword [rbx]
movaps xmm1, xmmword [rbx + 0x10]
movaps xmm2, xmmword [rbx + 0x20]
movaps xmmword [rdi + 0x20], xmm2
movaps xmmword [rdi + 0x10], xmm1
movaps xmmword [rdi], xmm0
xor eax, eax
nop dword [rax]
test al, al
jne 0x140011690
mov eax, dword [0x141f2e0e0]
sub eax, dword [0x141f2e0e4]
or eax, 0xcf663ddf
imul eax, eax, 0x39a9a020
cmp eax, 0x9c5ef190
je 0x1400116d2
mov eax, dword [0x141f2e0e8]
sub eax, dword [0x141f2e0ec]
add eax, 0x6892374e
mov qword [rdi + 0x40], 0
cmp eax, 0xc30e43d6
jbe 0x1400116e0
mov qword [rdi + 0x40], 0
jmp 0x1400116b2
mov eax, dword [0x141f2e0f0]
imul eax, dword [0x141f2e0f4]
imul eax, eax, 0x25c55d3
or eax, 0x87bd6620
add eax, 0x7a39adb5
cmp eax, 0x1f5908ef
jb 0x1400116e0
mov rax, qword [rdi + 0x30]
add rax, 0xffffffffffffff00
mov qword [rdi + 0x38], rax
mov rcx, rdi
mov rdx, rsi
call fcn.140075dc0
nop
add rsp, 0xa0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret