Function at 0x180030c74
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], rbx
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x238]
sub rsp, 0x300
mov r9d, 0xce
mov r12, rdx
mov rdi, rcx
mov ecx, 0x2a
mov edx, 0xcb
lea r10d, [r9 + 0x18]
lea eax, [rcx - 0x11]
mov word [rsp + 0x46], dx
lea edx, [rcx - 1]
mov word [rsp + 0x62], r10w
lea r10d, [rcx + 0x15]
mov word [rsp + 0x54], ax
lea eax, [rcx + 0x5e]
mov word [rsp + 0x3c], cx
mov word [rsp + 0x48], dx
lea rcx, [rbp - 0x70]
lea r8d, [r9 + 0x32]
xor edx, edx
mov word [rsp + 0x7e], ax
mov dword [rsp + 0x30], 0xf90006
mov dword [rsp + 0x34], 0xf90074
mov dword [rsp + 0x38], 0xcc002a
mov dword [rsp + 0x3e], 0x600c0
mov dword [rsp + 0x42], 0x3300f2
mov dword [rsp + 0x4a], 0x3900ca
mov word [rsp + 0x4e], r9w
mov dword [rsp + 0x50], 0xf90068
mov dword [rsp + 0x56], 0x2e00c4
mov dword [rsp + 0x5a], 0x3600c4
mov dword [rsp + 0x5e], 0x3d00ca
mov dword [rsp + 0x64], 0xc40032
mov dword [rsp + 0x68], 0xc20034
mov word [rsp + 0x6c], r10w
mov dword [rsp + 0x6e], 0x3300e9
mov dword [rsp + 0x72], 0x2e00d6
mov dword [rsp + 0x76], 0x3400c0
mov dword [rsp + 0x7a], 0x2800c0
mov dword [rbp - 0x80], 0xe3001c
mov dword [rbp - 0x7c], 0xe3001c
mov dword [rbp - 0x78], 0xe30077
mov dword [rbp - 0x74], 0xca005a
call sub.msvcrt.dll_memset
xor ebx, ebx
mov esi, 0xb0
mov r15d, 0xa5005a
mov eax, ebx
xor dword [rsp + rax*2 + 0x30], r15d
add rax, 2
cmp rax, rsi
jl 0x180030da8
mov edx, 8
mov r8d, 0x130
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [r12], rax
test rax, rax
jne 0x180030dea
lea rdx, str.error_0_n
lea ecx, [rax + 0x7f]
call fcn.180030818
mov dil, bl
jmp 0x180031249
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [rbp + 0x92]
movzx r13d, word [rbp + 0x90]
imul r13d, eax
movzx eax, word [rbp + 0x96]
mov rcx, rdi
imul r13d, eax
call fcn.1800314a8
mov r14, rax
test rax, rax
jne 0x180030ffc
lea rdx, str.error_2_n
mov ecx, 0x91
call fcn.180030818
lea edi, [r14 + 1]
mov eax, 0xf9
lea edx, [rax - 0x2e]
mov word [rbp + 0xc2], ax
lea ecx, [rdi + 0x29]
mov word [rbp + 0xb6], dx
lea edx, [rdi + 0x28]
mov word [rbp + 0xac], cx
mov word [rbp + 0xb8], dx
lea edx, [rax - 0x2f]
lea eax, [rdi + 0x18]
mov word [rbp + 0xc4], ax
lea eax, [rcx + 0x5e]
mov word [rbp + 0xce], dx
mov word [rbp + 0xee], ax
lea eax, [rdi + 0x76]
lea edx, [rdi + 0x3c]
mov word [rbp + 0x100], ax
mov word [rbp + 0xd0], dx
lea eax, [rdi + 0x7f]
mov word [rbp + 0x102], ax
lea eax, [rdi + 0x69]
mov edx, 0xe6
mov word [rbp + 0x104], ax
lea eax, [rcx + 0x6a]
mov word [rbp + 0xd2], dx
mov word [rbp + 0x106], ax
lea eax, [rdi + 0x21]
lea edx, [rdi + 0x3e]
mov word [rbp + 0x108], ax
lea eax, [rcx + 0x7b]
mov word [rbp + 0xdc], dx
mov word [rbp + 0x10a], ax
lea eax, [rdi + 0x66]
lea rcx, [rbp + 0x110]
mov word [rbp + 0x10c], ax
lea eax, [rdi + 0x4a]
xor edx, edx
mov r8d, 0xf0
mov dword [rbp + 0xa0], 0xf90006
mov dword [rbp + 0xa4], 0xf90074
mov word [rbp + 0x10e], ax
mov dword [rbp + 0xa8], 0xcc002a
mov dword [rbp + 0xae], 0x600c0
mov dword [rbp + 0xb2], 0x3300f2
mov dword [rbp + 0xba], 0x3900ca
mov dword [rbp + 0xbe], 0x6800ce
mov dword [rbp + 0xc6], 0x2e00c4
mov dword [rbp + 0xca], 0x3600c4
mov dword [rbp + 0xd4], 0xc40032
mov dword [rbp + 0xd8], 0xc20034
mov dword [rbp + 0xde], 0x3300e9
mov dword [rbp + 0xe2], 0x2e00d6
mov dword [rbp + 0xe6], 0x3400c0
mov dword [rbp + 0xea], 0x2800c0
mov dword [rbp + 0xf0], 0x95007f
mov dword [rbp + 0xf4], 0xdd0068
mov dword [rbp + 0xf8], 0x95007f
mov dword [rbp + 0xfc], 0xdd0068
call sub.msvcrt.dll_memset
xor dword [rbp + rbx*2 + 0xa0], r15d
add rbx, 2
cmp rbx, rsi
jl 0x180030fc8
mov dword [rsp + 0x28], 0xdddddddd
or r9d, 0xffffffff
lea r8, [rbp + 0xa0]
mov dword [rsp + 0x20], 0xeeeeeeee
mov rdx, rsi
jmp 0x18003123f
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
mov edi, 1
mov esi, ebx
movzx eax, byte [rax]
mov r15d, edi
test eax, eax
jle 0x180031036
mov r12d, eax
mov edx, esi
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
add esi, edi
imul r15d, dword [rax]
cmp esi, r12d
jl 0x180031019
mov r12, qword [rbp + 0x248]
mov rcx, qword [rbp + 0x240]
mov r8, r14
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, r13d
mov esi, r13d
mov ecx, r15d
shr esi, 0xc
mov r9d, 0xfff
and eax, r9d
and ecx, r9d
and esi, r9d
add esi, eax
mov r11d, r15d
mov r8d, 0x80808081
mov eax, r8d
mov dword [rsp + 0x30], 0xf90006
mov dword [rsp + 0x34], 0xf90074
imul r11d, r13d
shr r13d, 0x14
mov dword [rsp + 0x38], 0xcc002a
mov dword [rsp + 0x3e], 0x600c0
add esi, r13d
mov r13d, r15d
shr r15d, 0x14
shr r13d, 0xc
mov dword [rsp + 0x42], 0x3300f2
mov dword [rsp + 0x4a], 0x3900ca
mul esi
shr edx, 7
and r13d, r9d
mov eax, r8d
add r13d, ecx
mov ecx, 0x2a
mov dword [rsp + 0x4e], 0x6800ce
imul edx, edx, 0xff
sub esi, edx
add r13d, r15d
mov dword [rsp + 0x56], 0x2e00c4
mov word [rsp + 0x3c], cx
mov dword [rsp + 0x5a], 0x3600c4
mov dword [rsp + 0x64], 0xc40032
mul r13d
shr edx, 7
mov eax, r11d
mov dword [rsp + 0x68], 0xc20034
shr eax, 0x10
mov dword [rsp + 0x6e], 0x3300e9
mov dword [rsp + 0x72], 0x2e00d6
imul edx, edx, 0xff
sub r13d, edx
movzx r14d, al
mov eax, r11d
shr eax, 8
movzx eax, al
add r14d, eax
movzx eax, r11b
shr r11d, 0x18
add r14d, eax
mov eax, 0x88888889
add r14d, r11d
mul r14d
mov eax, 0xf9
mov word [rsp + 0x52], ax
shr edx, 3
imul edx, edx, 0xf
sub r14d, edx
lea edx, [rax - 0x2e]
mov word [rsp + 0x46], dx
lea edx, [rcx - 1]
mov word [rsp + 0x48], dx
lea edx, [rax - 0x2f]
lea eax, [rcx - 0x11]
mov word [rsp + 0x5e], dx
lea edx, [rcx + 0x13]
mov word [rsp + 0x54], ax
mov word [rsp + 0x60], dx
mov edx, 0xe6
mov word [rsp + 0x62], dx
lea edx, [rcx + 0x15]
mov word [rsp + 0x6c], dx
lea eax, [rcx + 0x5e]
xor edx, edx
mov r8d, 0xf0
mov word [rsp + 0x7e], ax
lea eax, [rcx + 0x4d]
mov dword [rsp + 0x76], 0x3400c0
mov word [rbp - 0x70], ax
lea eax, [rcx + 0x56]
mov dword [rsp + 0x7a], 0x2800c0
mov word [rbp - 0x6e], ax
lea eax, [rcx + 0x40]
mov dword [rbp - 0x80], 0x95007f
mov word [rbp - 0x6c], ax
lea eax, [rcx + 0x6a]
mov dword [rbp - 0x7c], 0xdd0068
mov word [rbp - 0x6a], ax
lea eax, [rcx - 8]
mov dword [rbp - 0x78], 0x95007f
mov word [rbp - 0x68], ax
lea eax, [rcx + 0x7b]
mov dword [rbp - 0x74], 0xdd0068
mov word [rbp - 0x66], ax
lea eax, [rcx + 0x3d]
mov word [rbp - 0x64], ax
lea eax, [rcx + 0x21]
lea rcx, [rbp - 0x60]
mov word [rbp - 0x62], ax
call sub.msvcrt.dll_memset
mov edx, 0xb0
xor dword [rsp + rbx*2 + 0x30], 0xa5005a
add rbx, 2
cmp rbx, rdx
jl 0x18003121c
mov dword [rsp + 0x28], r14d
mov r9d, esi
lea r8, [rsp + 0x30]
mov dword [rsp + 0x20], r13d
mov rcx, qword [r12]
call qword [sym.imp.msvcrt.dll__snwprintf]
mov r8, qword [r12]
lea rdx, [0x18003a400]
mov ecx, 0xbd
call fcn.180030818
mov rbx, qword [rsp + 0x358]
mov al, dil
add rsp, 0x300
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret