Function at 0x1400dd270
Capabilities:
Encode data using xor
Get memory capacity

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
movaps xmmword [rbp - 0x10], xmm6
mov eax, dword [0x141ddc090]
sub eax, dword [0x141ddc094]
add eax, 0x786312e3
xor eax, 0x8e96ba21
cmp eax, 0x164358bb
jae 0x1400dd2f0
mov eax, 0x70
call fcn.1400f1350
sub rsp, rax
mov eax, 0x40
call fcn.1400f1350
sub rsp, rax
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov eax, 0xd0
call fcn.1400f1350
sub rsp, rax
nop word [rax + rax]
mov edx, dword [0x141ddc098]
or edx, dword [0x141ddc09c]
add edx, 0x34cff199
and edx, 0xe3cf26cc
mov eax, 0x70
call fcn.1400f1350
sub rsp, rax
mov r14, rsp
mov eax, 0x40
call fcn.1400f1350
sub rsp, rax
mov r15, rsp
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov r9, rsp
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov r12, rsp
mov eax, 0xd0
call fcn.1400f1350
sub rsp, rax
mov rsi, rsp
cmp edx, 0xf4ded945
ja 0x1400dd2f0
mov rbx, rsi
mov eax, dword [0x141dde6fc]
mov rdx, qword gs:[0x58]
mov rax, qword [rdx + rax*8]
movzx r8d, byte [rax + 0x70]
nop
mov eax, dword [0x141ddc0a0]
xor edx, edx
div dword [0x141ddc0a4]
cmp eax, 0x212aaaa1
je 0x1400dd380
test r8b, 1
mov qword [rbp - 0x30], rcx
mov qword [rbp - 0x28], r9
je 0x1400dd3f8
mov eax, dword [0x141dde6fc]
mov rdx, qword gs:[0x58]
mov rax, qword [rdx + rax*8]
mov r13, qword [rax + 0x78]
mov rdx, qword [rax + 0x80]
nop word cs:[rax + rax]
mov eax, dword [0x141ddc0d0]
xor eax, dword [0x141ddc0d4]
imul eax, eax, 0x25729b8b
or eax, 0x61b60e45
add eax, 0x804c8f33
cmp eax, 0x94049d8c
jb 0x1400dd3d0
jmp 0x1400dd578
mov eax, dword [0x141ddc0a8]
xor eax, dword [0x141ddc0ac]
shr eax, 1
mov ecx, 0x87690bef
imul rcx, rax
shr rcx, 0x3d
xor ecx, 0xce76c17
add ecx, 0x944cb3c3
cmp ecx, 0xa523a89d
jbe 0x1400dd445
xorps xmm0, xmm0
movups xmmword [r12], xmm0
sub rsp, 0x20
mov edx, 0x10
mov rcx, r12
call qword [sym.imp.bcryptprimitives.dll_ProcessPrng]
add rsp, 0x20
xorps xmm6, xmm6
mov rdi, qword [sym.imp.bcryptprimitives.dll_ProcessPrng]
nop
mov eax, dword [0x141ddc0b0]
xor edx, edx
div dword [0x141ddc0b4]
or eax, 0x3c59f5f7
imul r13d, eax, 0x4fc403b
add r13d, 0x11e3bf39
movups xmmword [r12], xmm6
sub rsp, 0x20
mov edx, 0x10
mov rcx, r12
call rdi
add rsp, 0x20
cmp r13d, 0xe2c4b3f4
ja 0x1400dd450
mov eax, dword [str._rM_]
xor eax, dword [0x141ddc0bc]
xor eax, 0x14202000
and eax, 0x76fa200e
add eax, 0xcf120273
cmp eax, 0xe3cef656
jae 0x1400dd4cd
mov eax, dword [0x141dde6fc]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov byte [rax + 0x70], 1
mov r13, qword [r12]
mov rdx, qword [r12 + 8]
nop word cs:[rax + rax]
mov eax, dword [0x141dde6fc]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov ecx, dword [0x141ddc0c0]
sub ecx, dword [0x141ddc0c4]
xor ecx, 0xc988035a
and ecx, 0xc989dbda
mov byte [rax + 0x70], 1
cmp ecx, 0x9de7b27e
je 0x1400dd4e0
mov eax, dword [0x141ddc0c8]
or eax, dword [0x141ddc0cc]
add eax, 0x4e42202b
or eax, 0x9581dff9
and eax, 0xd7a7fffb
cmp eax, 0x218c399
jb 0x1400dd55c
mov eax, dword [0x141dde6fc]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov qword [rax + 0x80], rdx
xor eax, eax
test al, al
je 0x1400dd578
mov eax, dword [0x141dde6fc]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov qword [rax + 0x80], rdx
jmp 0x1400dd53c
mov qword [rbp - 0x18], rdx
lea rax, [r13 + 1]
mov ecx, dword [0x141dde6fc]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov qword [rcx + 0x78], rax
movzx eax, byte [0x141dde6f8]
sub rsp, 0x20
mov edx, 0x58410
xor ecx, ecx
call fcn.1400c29b0
add rsp, 0x20
test rax, rax
je 0x1400dd734
mov r12, rax
mov qword [rbp - 0x20], r13
movabs rdi, 0x8000000000000000
mov eax, dword [0x141ddc0d8]
sub eax, dword [0x141ddc0dc]
or eax, 0x10c80052
xor eax, 0xac05091
or eax, 0x85242f2c
cmp eax, 0xeb31c516
jbe 0x1400dd659
lea r13, [r12 + 0x58000]
sub rsp, 0x20
mov r8d, 0x410
mov rcx, r13
mov dl, 0xff
call sub.VCRUNTIME140.dll_memset
add rsp, 0x20
xorps xmm0, xmm0
movups xmmword [rbx + 0x70], xmm0
movups xmmword [rbx + 0x80], xmm0
mov qword [rbx], 0
mov qword [rbx + 8], 8
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], rdi
mov dword [rbx + 0x30], 0
mov byte [rbx + 0x38], 0
mov qword [rbx + 0x40], r13
mov qword [rbx + 0x48], 0x3ff
mov qword [rbx + 0x50], 0x380
add r12, 0x58000
add rsi, 0x70
xorps xmm6, xmm6
nop word [rax + rax]
mov r13d, dword [0x141ddc0e0]
imul r13d, dword [0x141ddc0e4]
add r13d, 0x36b35e10
sub rsp, 0x20
mov r8d, 0x410
mov rcx, r12
mov dl, 0xff
call sub.VCRUNTIME140.dll_memset
add rsp, 0x20
movups xmmword [rbx + 0x70], xmm6
movups xmmword [rbx + 0x80], xmm6
mov qword [rbx], 0
mov qword [rbx + 8], 8
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], rdi
mov dword [rbx + 0x30], 0
mov byte [rbx + 0x38], 0
mov qword [rbx + 0x40], r12
mov qword [rbx + 0x48], 0x3ff
mov qword [rbx + 0x50], 0x380
cmp r13d, 0xab50a499
ja 0x1400dd670
mov qword [rbx + 0x58], 0
mov rax, qword [rbp - 0x20]
mov qword [rbx + 0x60], rax
mov rax, qword [rbp - 0x18]
mov qword [rbx + 0x68], rax
mov qword [rbx + 0x90], 0
xorps xmm0, xmm0
movups xmmword [r15], xmm0
movups xmmword [r15 + 0x30], xmm0
movups xmmword [r15 + 0x20], xmm0
movups xmmword [r15 + 0x10], xmm0
mov dword [r15], 0x40
xor eax, eax
test al, al
je 0x1400dd736
jmp 0x1400dd76a
ud2
mov eax, dword [0x141ddc0e8]
and eax, dword [0x141ddc0ec]
imul r12d, eax, 0x5695fee6
add r12d, 0x3d41a509
sub rsp, 0x20
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
add rsp, 0x20
cmp r12d, 0xcbeaa765
jbe 0x1400dd77d
sub rsp, 0x20
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
add rsp, 0x20
jmp 0x1400dd736
test eax, eax
mov rdi, qword [rbp - 0x28]
jne 0x1400dd808
xor eax, eax
test al, al
jne 0x1400dd7cb
mov eax, dword [0x141ddc0f0]
mov ecx, dword [0x141ddc0f4]
lea r12d, [rax + rcx]
add r12d, 0xde54322d
and r12d, 0xf2b214fb
add r12d, 0xa9c734b0
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
cmp r12d, 0x3cc72b50
jae 0x1400dd7db
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
jmp 0x1400dd78f
mov ecx, 0xb660ffef
mov eax, dword [0x141ddc0f8]
xor edx, edx
div dword [0x141ddc0fc]
imul eax, eax, 0xb45dca33
add eax, 0xdefbbef9
imul rax, rcx
shr rax, 0x3c
cmp eax, 0x540aad0c
ja 0x1400dd7e0
movups xmm0, xmmword [r15 + 8]
mov eax, dword [0x141ddc100]
xor eax, dword [0x141ddc104]
movups xmmword [rsi], xmm0
add eax, 0x42638dd2
xor eax, 0x7599ef08
cmp eax, 0xecf0eede
ja 0x1400dd891
mov esi, dword [0x141ddc108]
or esi, dword [0x141ddc10c]
or esi, 0x3627571e
add esi, 0x3e320170
and esi, 0x84f2f8e4
xorps xmm0, xmm0
movups xmmword [r14 + 0x50], xmm0
movups xmmword [r14 + 0x40], xmm0
movups xmmword [r14 + 0x30], xmm0
movups xmmword [r14 + 0x20], xmm0
movups xmmword [r14 + 0x10], xmm0
movups xmmword [r14], xmm0
mov qword [r14 + 0x60], 0
sub rsp, 0x20
mov rcx, r14
mov edx, 0x68
call qword [sym.imp.KERNEL32.dll_K32GetPerformanceInfo]
add rsp, 0x20
cmp esi, 0x4b5a3bc4
jbe 0x1400dd8e0
xorps xmm0, xmm0
movups xmmword [r14 + 0x50], xmm0
movups xmmword [r14 + 0x40], xmm0
movups xmmword [r14 + 0x30], xmm0
movups xmmword [r14 + 0x20], xmm0
movups xmmword [r14 + 0x10], xmm0
movups xmmword [r14], xmm0
mov qword [r14 + 0x60], 0
sub rsp, 0x20
mov rcx, r14
mov edx, 0x68
call qword [sym.imp.KERNEL32.dll_K32GetPerformanceInfo]
add rsp, 0x20
jmp 0x1400dd82d
mov ecx, dword [0x141ddc110]
or ecx, dword [0x141ddc114]
xor ecx, 0x3b261e78
imul ecx, ecx, 0xa126656c
or ecx, 0xceeb75f2
cmp ecx, 0xea3e1c7e
je 0x1400dd8e0
test eax, eax
je 0x1400dd9d3
nop
mov eax, dword [0x141ddc118]
and eax, dword [0x141ddc11c]
xor eax, 0x870160
and eax, 0x3ea721e8
imul eax, eax, 0xecd0d2a3
cmp eax, 0x95219cf6
je 0x1400dd910
mov eax, dword [0x141ddc120]
and eax, dword [0x141ddc124]
xor eax, 0x3a5aebb0
add eax, 0x3c45e4a7
mov ecx, 0xc8366669
imul rcx, rax
shr rcx, 0x3e
cmp ecx, 0x35a949c1
ja 0x1400dd99c
mov rcx, qword [r14 + 0x50]
mov r10, qword [r14 + 0x20]
mov r8, qword [r14 + 8]
mov rdx, qword [r14 + 0x10]
xor r11d, r11d
sub rdx, r10
cmovb rdx, r11
mov rax, rcx
mul rdx
mov r9, 0xffffffffffffffff
cmovo rax, r9
mov qword [rbx + 0x80], rax
sub r8, r10
cmovb r8, r11
test r11b, r11b
je 0x1400dd9c2
mov rcx, qword [r14 + 0x10]
xor eax, eax
sub rcx, qword [r14 + 0x20]
cmovae rax, rcx
mul qword [r14 + 0x50]
mov rcx, 0xffffffffffffffff
cmovno rcx, rax
mov qword [rbx + 0x80], rcx
jmp 0x1400dd95e
mov rax, rcx
mul r8
cmovo rax, r9
mov qword [rbx + 0x88], rax
sub rsp, 0x20
mov rcx, rbx
mov dl, 1
call fcn.1400c4270
add rsp, 0x20
mov byte [rdi], 1
movabs rax, 0x202020202020101
mov qword [rdi + 1], rax
mov eax, dword [0x141ddc128]
imul eax, dword [0x141ddc12c]
or eax, 0x6352422b
imul eax, eax, 0x7aac3675
add eax, 0xe6e25748
cmp eax, 0xb243abfd
jbe 0x1400dda30
sub rsp, 0x20
mov rcx, rbx
mov rdx, rdi
call fcn.1400c5270
add rsp, 0x20
nop dword [rax]
mov esi, dword [0x141ddc130]
or esi, dword [0x141ddc134]
or esi, 0xcddaa7d9
and esi, 0xdffea7db
sub rsp, 0x20
mov rcx, rbx
mov rdx, rdi
call fcn.1400c5270
add rsp, 0x20
cmp esi, 0xcc57626e
jb 0x1400dda30
sub rsp, 0x20
mov r8d, 0xd0
mov rcx, qword [rbp - 0x30]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
add rsp, 0x20
movaps xmm6, xmmword [rbp - 0x10]
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret