Function at 0x1400be548
Capabilities:
Contain obfuscated stackstrings
Generate random numbers via winapi

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xf0
mov rax, qword [0x140425b28]
xor rax, rsp
mov qword [rbp + 0x27], rax
xor r12d, r12d
mov dword [rbp - 0x49], 0x73006d
mov ebx, r12d
mov r15, rcx
mov qword [rbp - 0x71], rbx
mov dword [rbp - 0x45], 0x740066
mov dword [rbp - 0x41], 0x73003a
mov dword [rbp - 0x3d], 0x700070
mov dword [rbp - 0x39], 0x63002f
mov dword [rbp - 0x35], 0x630061
mov dword [rbp - 0x31], 0x650068
mov dword [rbp - 0x2d], 0x740073
mov dword [rbp - 0x29], 0x72006f
mov dword [rbp - 0x25], 0x2f0065
mov dword [rbp - 0x21], 0x730025
mov word [rbp - 0x1d], r12w
mov dword [rbp - 0x59], 0x6d0048
mov dword [rbp - 0x55], 0x630061
mov dword [rbp - 0x51], 0x65004b
mov dword [rbp - 0x4d], 0x79
mov qword [rbp - 0x79], r12
cmp dword [rcx + 0x88], r12d
jne 0x1400be7d6
cmp dword [rcx + 0x78], r12d
je 0x1400be7d6
cmp dword [0x14042fb68], 1
lea r13d, [r12 + 0x40]
mov r14d, r12d
je 0x1400be628
mov r14d, 0x8000ffff
jmp 0x1400be663
mov rcx, qword [0x14042e950]
lea r8, [rbp - 0x19]
mov edx, r13d
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x1400be66b
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400be652
mov r14d, 0x80004005
jmp 0x1400be663
movzx r14d, ax
or r14d, 0x80070000
test eax, eax
cmovle r14d, eax
mov ecx, r14d
call fcn.1400790f8
mov ecx, r14d
call fcn.140079118
test r14d, r14d
jns 0x1400be680
mov ecx, r14d
jmp 0x1400be7db
lea r8, [rbp - 0x59]
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 0x71]
call fcn.140078210
mov r14d, eax
test eax, eax
jns 0x1400be6a8
mov ecx, eax
call fcn.1400790f8
mov rbx, qword [rbp - 0x71]
jmp 0x1400be7e0
mov rsi, qword [0x14042ead0]
lea rax, str.__Global__
mov rbx, qword [rbp - 0x71]
mov qword [rbp - 0x69], rax
mov qword [rbp - 0x61], r12
mov rax, qword [rsi]
mov rdi, qword [rax + 0x20]
mov rcx, rdi
call qword [0x1403af620]
mov dword [rsp + 0x30], 1
lea r9, [rbp - 0x19]
mov dword [rsp + 0x28], r12d
lea rdx, [rbp - 0x69]
mov r8, rbx
mov dword [rsp + 0x20], r13d
mov rcx, rsi
call rdi
mov r14d, eax
test eax, eax
jns 0x1400be702
mov ecx, eax
jmp 0x1400be7db
mov rsi, qword [0x14042eac8]
mov rax, qword [rsi]
mov rdi, qword [rax + 0x18]
mov rcx, rdi
call qword [0x1403af620]
lea r8, [rbp - 0x79]
mov edx, r13d
mov rcx, rsi
call rdi
mov r14d, eax
test eax, eax
js 0x1400be6fb
mov rdi, qword [rbp - 0x79]
mov rax, qword [rdi]
mov rsi, qword [rax + 0x20]
mov rcx, rsi
call qword [0x1403af620]
mov r9d, r13d
lea r8, [rbp - 0x19]
xor edx, edx
mov rcx, rdi
call rsi
mov r14d, eax
test eax, eax
js 0x1400be6fb
mov rsi, qword [r15 + 0x70]
lea rdi, [rbp - 0x19]
xor eax, eax
mov rcx, r13
rep stosb byte [rdi], al
test rsi, rsi
je 0x1400be785
mov rax, qword [rsi]
mov rdi, qword [rax + 0x10]
mov rcx, rdi
call qword [0x1403af620]
mov rcx, rsi
call rdi
mov qword [r15 + 0x70], r12
mov rsi, r12
mov r14, qword [rbp - 0x79]
mov qword [rbp - 0x79], r12
test rsi, rsi
je 0x1400be7a7
mov rax, qword [rsi]
mov rdi, qword [rax + 0x10]
mov rcx, rdi
call qword [0x1403af620]
mov rcx, rsi
call rdi
test r14, r14
mov rax, r12
mov rcx, r15
cmovne rax, r14
mov qword [r15 + 0x70], rax
mov dword [r15 + 0x78], r12d
call fcn.1400bee18
mov r14d, eax
test eax, eax
js 0x1400be6fb
mov dword [r15 + 0x7c], 1
jmp 0x1400be7e0
mov r14d, r12d
xor ecx, ecx
call fcn.1400790f8
mov ecx, r14d
call fcn.140079118
mov rdi, qword [rbp - 0x79]
test rdi, rdi
je 0x1400be80a
mov rax, qword [rdi]
mov rsi, qword [rax + 0x10]
mov rcx, rsi
call qword [0x1403af620]
mov rcx, rdi
call rsi
mov qword [rbp - 0x79], r12
test rbx, rbx
je 0x1400be82b
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rbx - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.140079118
mov eax, r14d
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140368700
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret