Function at 0x1400e0d80
Capabilities:
Encode data using xor
Get memory capacity

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x10], xmm7
movaps xmmword [rbp], xmm6
mov r14, rcx
mov eax, dword [0x141f46838]
add eax, dword [0x141f4683c]
or eax, 0x431566e5
cmp eax, 0x59d8002e
jne 0x1400e0dd0
mov eax, 0xd0
call fcn.1400f4d10
sub rsp, rax
nop dword [rax + rax]
mov eax, dword [0x141f46840]
and eax, dword [0x141f46844]
and eax, 0x8e164651
imul ecx, eax, 0x60f66cb1
add ecx, 0x1c5e9eba
mov eax, 0xd0
call fcn.1400f4d10
sub rsp, rax
mov r12, rsp
cmp ecx, 0x3f1abe3
jb 0x1400e0dd0
mov rdi, r12
nop dword [rax + rax]
mov eax, dword [0x141f46848]
imul eax, dword [0x141f4684c]
or eax, 0x8209256
and eax, 0xab209bd6
xor eax, 0xb191445d
cmp eax, 0x3630ddef
jb 0x1400e0e10
mov eax, dword [0x141f4907c]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
test byte [rax + 0x70], 1
je 0x1400e0eb7
mov eax, dword [0x141f4907c]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov r13, qword [rax + 0x78]
mov eax, 0x9747fb89
nop
mov ecx, dword [0x141f46860]
or ecx, dword [0x141f46864]
add ecx, 0xb702bcb4
imul rcx, rax
shr rcx, 0x3f
imul ecx, ecx, 0x399ad0ef
cmp ecx, 0x988a11e4
ja 0x1400e0e70
mov eax, dword [0x141f4907c]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rsi, qword [rax + 0x80]
jmp 0x1400e0f7e
xorps xmm0, xmm0
movaps xmmword [rbp - 0x70], xmm0
sub rsp, 0x20
lea rcx, [rbp - 0x70]
mov edx, 0x10
call qword [sym.imp.bcryptprimitives.dll_ProcessPrng]
add rsp, 0x20
mov r13, qword [rbp - 0x70]
mov rsi, qword [rbp - 0x68]
mov eax, dword [0x141f46850]
or eax, dword [0x141f46854]
mov ecx, 0xb3ff7a6d
imul rcx, rax
shr rcx, 0x3e
imul eax, ecx, 0xccb2b113
add eax, 0x4058f74b
cmp eax, 0xbfb2067f
jb 0x1400e0f48
mov eax, dword [0x141f4907c]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov ecx, dword [0x141f46858]
and ecx, dword [0x141f4685c]
and ecx, 0xf1e63004
imul ecx, ecx, 0x23821218
add ecx, 0x9512818
mov byte [rax + 0x70], 1
cmp ecx, 0x3ac308fa
jae 0x1400e0f64
mov eax, dword [0x141f4907c]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov byte [rax + 0x70], 1
jmp 0x1400e0f08
mov eax, dword [0x141f4907c]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov qword [rax + 0x80], rsi
lea rax, [r13 + 1]
mov ecx, dword [0x141f4907c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov qword [rcx + 0x78], rax
movzx eax, byte [0x141f49078]
sub rsp, 0x20
mov edx, 0x58410
xor ecx, ecx
call fcn.1400c6170
add rsp, 0x20
test rax, rax
je 0x1400e0fea
mov rbx, rax
mov qword [rbp - 0x78], r14
mov eax, dword [0x141f46868]
xor edx, edx
div dword [0x141f4686c]
or eax, 0x136e36b5
imul eax, eax, 0xaf3847d1
and eax, 0xda855088
cmp eax, 0x3508e018
jae 0x1400e1010
jmp 0x1400e105e
ud2
mov eax, dword [0x141f46870]
xor edx, edx
div dword [0x141f46874]
mov r15d, eax
add r15d, 0x78eb7c0f
xor r15d, 0x61d016d8
add r15d, 0xb4973fde
lea r14, [rbx + 0x58000]
sub rsp, 0x20
mov r8d, 0x410
mov rcx, r14
mov dl, 0xff
call sub.VCRUNTIME140.dll_memset
add rsp, 0x20
cmp r15d, 0xae95b421
jae 0x1400e107c
lea rcx, [rbx + 0x58000]
sub rsp, 0x20
mov r8d, 0x410
mov dl, 0xff
call sub.VCRUNTIME140.dll_memset
add rsp, 0x20
jmp 0x1400e1010
xorps xmm0, xmm0
movups xmmword [rdi + 0x80], xmm0
movups xmmword [rdi + 0x70], xmm0
mov qword [rdi], 0
mov qword [rdi + 8], 8
mov qword [rdi + 0x10], 0
movabs rax, 0x8000000000000000
mov qword [rdi + 0x18], rax
mov dword [rdi + 0x30], 0
mov byte [rdi + 0x38], 0
mov qword [rdi + 0x40], r14
mov qword [rdi + 0x48], 0x3ff
mov qword [rdi + 0x50], 0x380
mov qword [rdi + 0x58], 0
mov qword [rdi + 0x60], r13
mov qword [rdi + 0x68], rsi
mov qword [rdi + 0x90], 0
movaps xmmword [rbp - 0x70], xmm0
movaps xmmword [rbp - 0x40], xmm0
movaps xmmword [rbp - 0x50], xmm0
movaps xmmword [rbp - 0x60], xmm0
mov dword [rbp - 0x70], 0x40
sub rsp, 0x20
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
add rsp, 0x20
test eax, eax
jne 0x1400e1154
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
nop word cs:[rax + rax]
mov eax, dword [0x141f46880]
or eax, dword [0x141f46884]
imul eax, eax, 0x7d98f091
imul rax, rax, 0x7e0854d9
shr rax, 0x3e
cmp eax, 0xc1c6f04c
je 0x1400e1130
add r12, 0x70
nop dword [rax + rax]
mov eax, dword [0x141f46888]
xor edx, edx
div dword [0x141f4688c]
xor eax, 0xf6ac1af6
imul eax, eax, 0xa808b6ea
cmp eax, 0x6d704fa5
je 0x1400e1160
movups xmm6, xmmword [rbp - 0x68]
mov eax, dword [0x141f46890]
or eax, dword [0x141f46894]
imul eax, eax, 0x15cf55a5
or eax, 0x3fee2150
xor eax, 0x34ce2dc2
cmp eax, 0xd7bf75ed
jbe 0x1400e11e6
movups xmmword [r12], xmm6
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
movaps xmmword [rbp - 0x30], xmm0
movaps xmmword [rbp - 0x40], xmm0
movaps xmmword [rbp - 0x50], xmm0
movaps xmmword [rbp - 0x60], xmm0
movaps xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x10], 0
sub rsp, 0x20
lea rcx, [rbp - 0x70]
mov edx, 0x68
call qword [sym.imp.KERNEL32.dll_K32GetPerformanceInfo]
add rsp, 0x20
xorps xmm7, xmm7
lea rbx, [rbp - 0x70]
mov rsi, qword [sym.imp.KERNEL32.dll_K32GetPerformanceInfo]
nop word cs:[rax + rax]
mov eax, dword [0x141f46898]
or eax, dword [0x141f4689c]
imul r14d, eax, 0x556ca491
or r14d, 0x83df567c
movups xmmword [r12], xmm6
movaps xmmword [rbp - 0x20], xmm7
movaps xmmword [rbp - 0x30], xmm7
movaps xmmword [rbp - 0x40], xmm7
movaps xmmword [rbp - 0x50], xmm7
movaps xmmword [rbp - 0x60], xmm7
movaps xmmword [rbp - 0x70], xmm7
mov qword [rbp - 0x10], 0
sub rsp, 0x20
mov rcx, rbx
mov edx, 0x68
call rsi
add rsp, 0x20
cmp r14d, 0x40c07155
jb 0x1400e1200
mov ecx, 0xb6d14379
mov rbx, qword [rbp - 0x78]
nop word cs:[rax + rax]
mov edx, dword [0x141f468a0]
sub edx, dword [0x141f468a4]
add edx, 0xbfab016c
imul rdx, rcx
shr rdx, 0x3f
or edx, 0x78b02f5a
cmp edx, 0x543ea38e
jb 0x1400e1270
test eax, eax
je 0x1400e13f0
mov eax, dword [0x141f468a8]
xor edx, edx
div dword [0x141f468ac]
imul r10, rax, 0x5ea349
shr r10, 0x36
add r10d, 0x496568a1
or r10d, 0x26dbf5d6
mov r9, qword [rbp - 0x50]
mov rax, qword [rbp - 0x60]
sub rax, r9
mov edx, 0
cmovae rdx, rax
mov rcx, qword [rbp - 0x20]
mov rax, rcx
mul rdx
seto r11b
cmp r10d, 0x23bb0e44
jb 0x1400e12a0
mov r8, rax
mov eax, dword [0x141f468b0]
xor edx, edx
div dword [0x141f468b4]
add eax, 0xbbd511ea
or eax, 0xb368cf3c
xor eax, 0x50ac8031
cmp eax, 0xe3362c8e
jae 0x1400e132e
test r11b, r11b
mov rax, 0xffffffffffffffff
cmove rax, r8
mov qword [rdi + 0x80], rax
mov r10, qword [rbp - 0x68]
mov rax, 0xffffffffffffffff
xor edx, edx
nop dword [rax + rax]
test r11b, r11b
mov rsi, r8
cmovne rsi, rax
mov qword [rdi + 0x80], rsi
test dl, dl
jne 0x1400e1340
mov eax, dword [0x141f468b8]
mov edx, dword [0x141f468bc]
add eax, edx
add eax, 0xf458d1ff
xor eax, 0x3190240c
and eax, 0x3990ae0c
cmp eax, 0x98e078ba
ja 0x1400e13ca
mov eax, dword [0x141f468c0]
xor r8d, r8d
xor edx, edx
div dword [0x141f468c4]
xor eax, 0xb18e75ea
add eax, 0x3d1e508a
imul r11, rax, 0x2b9cac35
shr r11, 0x3a
mov rax, r10
sub rax, r9
cmovae r8, rax
mov rax, rcx
mul r8
mov rdx, 0xffffffffffffffff
cmovno rdx, rax
mov qword [rdi + 0x88], rdx
cmp r11d, 0x976d23bc
jbe 0x1400e13f0
xor edx, edx
mov rax, r10
sub rax, r9
cmovae rdx, rax
mov rax, rcx
mul rdx
mov rdx, 0xffffffffffffffff
cmovno rdx, rax
mov qword [rdi + 0x88], rdx
jmp 0x1400e1379
sub rsp, 0x20
mov rcx, rdi
mov dl, 1
call fcn.1400c78a0
add rsp, 0x20
mov byte [rbp - 0x70], 1
movabs rax, 0x202020202020101
mov qword [rbp - 0x6f], rax
sub rsp, 0x20
lea rdx, [rbp - 0x70]
mov rcx, rdi
call fcn.1400c8a10
mov r8d, 0xd0
mov rcx, rbx
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
add rsp, 0x20
movaps xmm6, xmmword [rbp]
movaps xmm7, xmmword [rbp + 0x10]
lea rsp, [rbp + 0x28]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret