Function at 0x1400380a0
Capabilities:
Access peb ldr_data
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x14005d010]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x28], rcx
mov ecx, 0xf
mov r12d, ecx
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
mov esi, 0x14
mov eax, dword [rsi + rdi]
mov ebp, 0x20
mov r14d, 0xffffffff
test al, 1
jne 0x140038161
or eax, 1
mov dword [rsi + rdi], eax
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov ecx, eax
mov r9d, ebp
add r9, rdi
mov dword [r9 + 0x1384], r14d
mov dword [r9 + 4], eax
lea edx, [r12 - 0xe]
lea r8, [r9 + 8]
nop dword [rax + rax]
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, edx
mov dword [r8], ecx
inc rdx
lea r8, [r8 + 4]
cmp rdx, 0x270
jb 0x140038130
mov dword [r9], 0x270
mov eax, dword [rsi + rdi]
mov ecx, 0xf
mov ebx, 0x13a8
test al, 2
jne 0x140038181
or eax, 2
mov dword [rsi + rdi], eax
mov qword [rdi + rbx], 0
mov qword [rdi + rbx + 8], 0x19
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], rcx
mov byte [rsp + 0x40], 0
lea rcx, [rsp + 0x40]
call fcn.140042630
add rbp, rdi
lea rax, [rdi + rbx]
mov qword [rsp + 0x28], rax
nop dword [rax]
nop word [rax + rax]
dec r12
mov qword [rsp + 0x20], r12
mov r15, qword [rax + 8]
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
mov rbx, 0xffffffffffffffff
mov r13d, 0x40
dec r13
shr rbx, 1
cmp rbx, r14
ja 0x1400381e1
sub r15, rax
cmp r15, 0xffffffffffffffff
jne 0x14003822d
xor edi, edi
xor esi, esi
nop dword [rax]
lea rcx, [r13 - 1]
shl rdi, cl
add rdi, rdi
nop word [rax + rax]
mov rcx, rbp
call fcn.140043230
mov eax, eax
cmp rax, rbx
ja 0x140038210
or rdi, rax
add rsi, r13
cmp rsi, 0x40
jb 0x140038200
jmp 0x1400382a4
lea r12, [r15 + 1]
xor edi, edi
xor esi, esi
test r15, r15
je 0x140038274
nop word [rax + rax]
lea rcx, [r13 - 1]
shl rdi, cl
add rdi, rdi
nop word [rax + rax]
mov rcx, rbp
call fcn.140043230
mov eax, eax
cmp rax, rbx
ja 0x140038250
or rdi, rax
lea rcx, [r13 - 1]
shl rsi, cl
add rsi, rsi
or rsi, rbx
cmp rsi, r15
jb 0x140038240
xor edx, edx
mov rax, rsi
div r12
mov r8, rdx
mov rcx, rax
xor edx, edx
mov rax, rdi
div r12
cmp rax, rcx
jb 0x140038294
cmp r8, r15
jne 0x140038231
xor edx, edx
mov rax, rdi
div r12
mov rdi, rdx
mov r12, qword [rsp + 0x20]
mov rax, qword [rsp + 0x30]
add rax, rdi
lea rcx, str.QWERTYUIOPASDFGHJKLZXCVBNM
movzx r9d, byte [rax + rcx]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
cmp rcx, rdx
jae 0x1400382ea
lea rax, [rcx + 1]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x40]
cmp rdx, 0x10
cmovae rax, qword [rsp + 0x40]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x1400382f4
lea rcx, [rsp + 0x40]
call fcn.1400430a0
test r12, r12
mov rax, qword [rsp + 0x28]
mov r14d, 0xffffffff
jne 0x1400381c0
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
mov rsi, qword [rsp + 0x50]
sub rax, rsi
cmp rax, 4
jb 0x140038478
lea r15, [rsp + 0x40]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x58]
cmp r14, 0x10
cmovae r15, rdi
mov r12, qword [rsp + 0x38]
xor edx, edx
mov qword [r12], rdx
mov qword [r12 + 0x10], rdx
mov qword [r12 + 0x18], rdx
lea rbp, [rsi + 4]
mov rbx, r12
cmp rbp, 0xf
jbe 0x1400383e7
mov r13, rbp
or r13, 0xf
cmp r13, rcx
jbe 0x14003839c
mov r13, rcx
movabs rax, 0x8000000000000027
mov rcx, rax
call fcn.140043c00
test rax, rax
je 0x1400383c4
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
mov qword [r12], rbx
jmp 0x1400383ed
mov eax, 0x16
cmp r13, rax
cmovb r13, rax
lea rcx, [r13 + 1]
cmp rcx, 0x1000
jb 0x1400383cb
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14003847e
jmp 0x14003837d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x1400383de
call fcn.140043c00
mov rbx, rax
mov qword [r12], rax
jmp 0x1400383ed
mov rbx, rdx
mov qword [r12], rdx
jmp 0x1400383ed
mov r13d, 0xf
mov qword [r12 + 0x10], rbp
mov qword [r12 + 0x18], r13
mov r8, rsi
mov rdx, r15
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov dword [rsi + rbx], 0x6578652e
mov byte [rbx + rbp], 0
cmp r14, 0x10
jb 0x14003844a
lea rdx, [r14 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140038442
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140038442
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.140043b88
mov rax, r12
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400435e0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.140034fb0
nop
call fcn.140034f10
int3