Function at 0x1400da380
Capabilities:
Encode data using xor
Get memory capacity

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
movaps xmmword [rbp - 0x10], xmm6
mov rdi, rcx
mov eax, dword [0x141dd9150]
add eax, dword [0x141dd9154]
and eax, 0xf5774af
add eax, 0x56ca6143
and eax, 0x6404559c
cmp eax, 0x234af3c8
jne 0x1400da400
mov eax, 0x70
call fcn.1400ef3b0
sub rsp, rax
mov eax, 0x40
call fcn.1400ef3b0
sub rsp, rax
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov eax, 0xd0
call fcn.1400ef3b0
sub rsp, rax
nop
mov ecx, dword [0x141dd9158]
sub ecx, dword [0x141dd915c]
or ecx, 0x245b2f7b
add ecx, 0xb346996
or ecx, 0x96de3af4
mov eax, 0x70
call fcn.1400ef3b0
sub rsp, rax
mov r14, rsp
mov eax, 0x40
call fcn.1400ef3b0
sub rsp, rax
mov r15, rsp
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov rdx, rsp
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov r12, rsp
mov eax, 0xd0
call fcn.1400ef3b0
sub rsp, rax
mov rbx, rsp
cmp ecx, 0x9d68d79c
jb 0x1400da400
mov eax, dword [0x141ddb9bc]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp byte [rax + 0x70], 0
mov qword [rbp - 0x30], rdx
je 0x1400da4e7
mov eax, dword [0x141ddb9bc]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rsi, qword [rax + 0x78]
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x1400da4c0
mov eax, dword [0x141ddb9bc]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + 0x80]
mov qword [rbp - 0x18], rax
jmp 0x1400da5fe
mov eax, dword [0x141dd9160]
xor eax, dword [0x141dd9164]
imul rax, rax, 0x5340a4d7
shr rax, 0x3e
or eax, 0x3ac88384
cmp eax, 0xe5a5c8ed
jbe 0x1400da528
xorps xmm0, xmm0
movups xmmword [r12], xmm0
sub rsp, 0x20
mov edx, 0x10
mov rcx, r12
call qword [sym.imp.bcryptprimitives.dll_ProcessPrng]
add rsp, 0x20
xorps xmm6, xmm6
mov rsi, qword [sym.imp.bcryptprimitives.dll_ProcessPrng]
xor r13d, r13d
nop word cs:[rax + rax]
movups xmmword [r12], xmm6
sub rsp, 0x20
mov edx, 0x10
mov rcx, r12
call rsi
add rsp, 0x20
test r13b, r13b
jne 0x1400da540
mov rsi, qword [r12]
mov r8, qword [r12 + 8]
mov eax, dword [0x141ddb9bc]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov byte [rax + 0x70], 1
mov eax, dword [0x141dd9168]
xor edx, edx
div dword [0x141dd916c]
add eax, 0x513fa972
and eax, 0xdbfbbcd3
cmp eax, 0x41d7d14c
jae 0x1400da5c0
mov eax, dword [0x141ddb9bc]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov qword [rax + 0x80], r8
nop dword [rax + rax]
mov eax, dword [0x141ddb9bc]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov ecx, dword [0x141dd9170]
sub ecx, dword [0x141dd9174]
and ecx, 0x4ea66191
imul ecx, ecx, 0xefa3e456
mov qword [rax + 0x80], r8
cmp ecx, 0xbab15c46
je 0x1400da5c0
mov qword [rbp - 0x18], r8
mov qword [rbp - 0x38], rdi
mov eax, dword [0x141dd9178]
or eax, dword [0x141dd917c]
add eax, 0xdbcbd395
mov ecx, 0x8dbd7d03
imul rcx, rax
shr rcx, 0x3e
cmp ecx, 0x8b1f800b
jbe 0x1400da661
lea rax, [rsi + 1]
mov ecx, dword [0x141ddb9bc]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov qword [rcx + 0x78], rax
movzx eax, byte [0x141ddb9b8]
sub rsp, 0x20
mov edx, 0x58410
xor ecx, ecx
call fcn.1400bf820
add rsp, 0x20
mov r13d, 0xab46f6f5
mov qword [rbp - 0x20], rsi
inc rsi
nop
mov edi, dword [0x141dd9180]
or edi, dword [0x141dd9184]
imul rdi, r13
shr rdi, 0x3e
add edi, 0xe43a41b7
and edi, 0xa0284186
mov eax, dword [0x141ddb9bc]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov qword [rax + 0x78], rsi
movzx eax, byte [0x141ddb9b8]
sub rsp, 0x20
mov edx, 0x58410
xor ecx, ecx
call fcn.1400bf820
add rsp, 0x20
cmp edi, 0x88655585
jb 0x1400da670
mov r12, rax
test rax, rax
je 0x1400da729
add r12, 0x58000
sub rsp, 0x20
mov r8d, 0x410
mov rcx, r12
mov dl, 0xff
call sub.VCRUNTIME140.dll_memset
add rsp, 0x20
movabs rcx, 0x8000000000000000
mov eax, dword [0x141dd9188]
xor edx, edx
div dword [0x141dd918c]
imul eax, eax, 0x64570885
and eax, 0xf3d42ca4
imul eax, eax, 0x3acf3c98
cmp eax, 0xb8eae863
jbe 0x1400da754
jmp 0x1400da7ba
ud2
mov eax, dword [0x141dd9190]
and eax, dword [0x141dd9194]
imul eax, eax, 0x7c021a79
add eax, 0xfaefe1bd
xorps xmm0, xmm0
movups xmmword [rbx + 0x80], xmm0
movups xmmword [rbx + 0x70], xmm0
mov qword [rbx], 0
mov qword [rbx + 8], 8
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], rcx
mov dword [rbx + 0x30], 0
mov byte [rbx + 0x38], 0
mov qword [rbx + 0x40], r12
mov qword [rbx + 0x48], 0x3ff
mov qword [rbx + 0x50], 0x380
cmp eax, 0xf0009100
jbe 0x1400da807
xorps xmm0, xmm0
movups xmmword [rbx + 0x80], xmm0
movups xmmword [rbx + 0x70], xmm0
mov qword [rbx], 0
mov qword [rbx + 8], 8
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], rcx
mov dword [rbx + 0x30], 0
mov byte [rbx + 0x38], 0
mov qword [rbx + 0x40], r12
mov qword [rbx + 0x48], 0x3ff
mov qword [rbx + 0x50], 0x380
jmp 0x1400da754
mov eax, dword [0x141dd9198]
and eax, dword [0x141dd919c]
or eax, 0x1401000
xor eax, 0x28008100
and eax, 0x2d4c9935
cmp eax, 0x8df6e3f1
jbe 0x1400da877
mov qword [rbx + 0x58], 0
mov rax, qword [rbp - 0x20]
mov qword [rbx + 0x60], rax
mov rax, qword [rbp - 0x18]
mov qword [rbx + 0x68], rax
mov qword [rbx + 0x90], 0
movups xmmword [r15], xmm0
movups xmmword [r15 + 0x30], xmm0
movups xmmword [r15 + 0x20], xmm0
movups xmmword [r15 + 0x10], xmm0
mov dword [r15], 0x40
sub rsp, 0x20
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
add rsp, 0x20
mov rax, rbx
add rax, 0x70
mov qword [rbp - 0x28], rax
xorps xmm6, xmm6
mov rsi, qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov r12, qword [rbp - 0x20]
mov r13, qword [rbp - 0x18]
nop word cs:[rax + rax]
mov eax, dword [0x141dd91a0]
or eax, dword [0x141dd91a4]
xor eax, 0x447206fc
imul edi, eax, 0xf561483
add edi, 0x5a0b969c
mov qword [rbx + 0x58], 0
mov qword [rbx + 0x60], r12
mov qword [rbx + 0x68], r13
mov qword [rbx + 0x90], 0
movups xmmword [r15], xmm6
movups xmmword [r15 + 0x30], xmm6
movups xmmword [r15 + 0x20], xmm6
movups xmmword [r15 + 0x10], xmm6
mov dword [r15], 0x40
sub rsp, 0x20
mov rcx, r15
call rsi
add rsp, 0x20
cmp edi, 0x99b38862
ja 0x1400da8a0
test eax, eax
jne 0x1400da919
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
movups xmm0, xmmword [r15 + 8]
mov rax, qword [rbp - 0x28]
movups xmmword [rax], xmm0
nop word cs:[rax + rax]
mov eax, dword [0x141dd91b0]
xor eax, dword [0x141dd91b4]
or eax, 0xffffffdf
cmp eax, 0xa0c2e568
jb 0x1400da930
mov eax, dword [0x141dd91b8]
xor edx, edx
div dword [str.___N]
xor eax, 0x421a0
or eax, 0x73e90455
add eax, 0x465f1592
cmp eax, 0xe521b7fa
mov r15, qword [rbp - 0x30]
ja 0x1400da9cc
mov esi, dword [0x141dd91c0]
xor esi, dword [0x141dd91c4]
xor esi, 0xffae297f
add esi, 0x81b0dbd2
xorps xmm0, xmm0
movups xmmword [r14 + 0x50], xmm0
movups xmmword [r14 + 0x40], xmm0
movups xmmword [r14 + 0x30], xmm0
movups xmmword [r14 + 0x20], xmm0
movups xmmword [r14 + 0x10], xmm0
movups xmmword [r14], xmm0
mov qword [r14 + 0x60], 0
sub rsp, 0x20
mov rcx, r14
mov edx, 0x68
call qword [sym.imp.KERNEL32.dll_K32GetPerformanceInfo]
add rsp, 0x20
cmp esi, 0x12d929a1
jae 0x1400daa0f
xorps xmm0, xmm0
movups xmmword [r14 + 0x50], xmm0
movups xmmword [r14 + 0x40], xmm0
movups xmmword [r14 + 0x30], xmm0
movups xmmword [r14 + 0x20], xmm0
movups xmmword [r14 + 0x10], xmm0
movups xmmword [r14], xmm0
mov qword [r14 + 0x60], 0
sub rsp, 0x20
mov rcx, r14
mov edx, 0x68
call qword [sym.imp.KERNEL32.dll_K32GetPerformanceInfo]
add rsp, 0x20
jmp 0x1400da96e
test eax, eax
je 0x1400dab0c
mov rcx, qword [r14 + 0x50]
xor r10d, r10d
mov r11, 0xffffffffffffffff
nop word cs:[rax + rax]
mov esi, dword [0x141dd91c8]
imul esi, dword [0x141dd91cc]
mov r9, qword [r14 + 0x20]
mov rdx, qword [r14 + 0x10]
sub rdx, r9
cmovb rdx, r10
mov rax, rcx
mul rdx
mov r8, rax
cmovo r8, r11
cmp esi, 0xce0c7baa
je 0x1400daa30
mov r10, qword [r14 + 8]
mov eax, dword [0x141dd91d0]
xor edx, edx
div dword [0x141dd91d4]
or eax, 0x4010000
xor eax, 0x8800008
and eax, 0x2c913649
cmp eax, 0xa367ff20
jbe 0x1400daab4
mov qword [rbx + 0x80], r8
xor edx, edx
mov rax, r10
sub rax, r9
cmovae rdx, rax
mov rax, rcx
mul rdx
mov rdx, 0xffffffffffffffff
cmovno rdx, rax
mov qword [rbx + 0x88], rdx
xor r11d, r11d
mov rsi, 0xffffffffffffffff
nop
mov eax, dword [0x141dd91d8]
or eax, dword [0x141dd91dc]
or eax, 0xf3306f4f
imul rax, rax, 0xa2508bb
shr rax, 0x3b
imul edi, eax, 0xe1f9b592
mov rdx, r10
sub rdx, r9
cmovb rdx, r11
mov rax, rcx
mul rdx
cmovo rax, rsi
mov qword [rbx + 0x80], r8
mov qword [rbx + 0x88], rax
cmp edi, 0xacfdd897
jb 0x1400daac0
sub rsp, 0x20
mov rcx, rbx
mov dl, 1
call fcn.1400c14d0
add rsp, 0x20
mov byte [r15], 1
movabs rsi, 0x202020202020101
mov eax, dword [0x141dd91e0]
sub eax, dword [0x141dd91e4]
imul eax, eax, 0x6c023f80
imul rcx, rax, 0x9e0a799
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1d
and eax, 0xfffffffe
cmp eax, 0xd88f403a
mov rdi, qword [rbp - 0x38]
jbe 0x1400dab88
mov qword [r15 + 1], rsi
sub rsp, 0x20
mov rcx, rbx
mov rdx, r15
call fcn.1400c2580
mov r8d, 0xd0
mov rcx, rdi
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
add rsp, 0x20
xor r14d, r14d
nop dword [rax + rax]
mov qword [r15 + 1], rsi
sub rsp, 0x20
mov rcx, rbx
mov rdx, r15
call fcn.1400c2580
mov r8d, 0xd0
mov rcx, rdi
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
add rsp, 0x20
test r14b, r14b
jne 0x1400dab90
nop dword [rax]
mov eax, dword [0x141dd91e8]
or eax, dword [0x141dd91ec]
xor eax, 0x30051022
or eax, 0xccba4954
cmp eax, 0x792d1e02
jb 0x1400dabc0
movaps xmm6, xmmword [rbp - 0x10]
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret