Function at 0x1400d7e70
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
nop word cs:[rax + rax]
mov eax, dword [0x141ddb330]
or eax, dword [0x141ddb334]
and eax, 0xd4901e47
cmp eax, 0xa6aa869f
je 0x1400d7e90
test rdi, rdi
je 0x1400d7f2e
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
mov ecx, eax
nop dword [rax]
mov eax, dword [0x141ddb340]
xor edx, edx
div dword [0x141ddb344]
add eax, 0xf5d99d5c
and eax, 0x24ed84e5
cmp eax, 0xdca18d7b
je 0x1400d7ec0
nop
mov eax, dword [0x141ddb348]
sub eax, dword [0x141ddb34c]
imul eax, eax, 0x54a7fbbc
and eax, 0x9526ec54
cmp eax, 0xfee83d82
ja 0x1400d7ee0
test ecx, ecx
je 0x1400d7f6d
mov eax, dword [0x141ddb360]
and eax, dword [0x141ddb364]
or eax, 0xea656ac7
imul eax, eax, 0x24266d3b
add eax, 0xf31410ec
cmp eax, 0x1f7cd896
jae 0x1400d7fc9
jmp 0x1400d7ff2
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov eax, 0xabc25fcb
mov ecx, dword [0x141ddb338]
xor ecx, dword [0x141ddb33c]
or ecx, 0x46ee4803
xor ecx, 0xe0d4528d
imul rcx, rax
shr rcx, 0x3f
cmp ecx, 0x739d879b
je 0x1400d7f40
jmp 0x1400d83b9
mov ecx, dword [0x141ddb350]
or ecx, dword [0x141ddb354]
movabs rax, 0x8000000000000000
imul ecx, ecx, 0xe5f14f1b
add ecx, 0x1a66f3df
cmp ecx, 0x14a005df
jae 0x1400d7fa0
mov qword [rsi], rax
nop word [rax + rax]
mov ecx, dword [0x141ddb358]
or ecx, dword [0x141ddb35c]
mov qword [rsi], rax
cmp ecx, 0xa2a6e249
je 0x1400d7fa0
mov al, 1
nop dword [rax]
test al, al
je 0x1400d7fc0
jmp 0x1400d83b9
mov ebx, dword [0x141ddb368]
or ebx, dword [0x141ddb36c]
add ebx, 0x820cb8c1
or ebx, 0xb3b5fd5e
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
cmp ebx, 0x3eb8ad6e
jae 0x1400d7ffd
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
jmp 0x1400d7fc9
mov ebp, eax
mov ebx, eax
nop word cs:[rax + rax]
mov eax, dword [0x141ddb370]
and eax, dword [0x141ddb374]
or eax, 0x7663ee39
imul rax, rax, 0x48711607
shr rax, 0x3d
or eax, 0x4e8c02d8
cmp eax, 0xf8487036
je 0x1400d8010
nop dword [rax + rax]
mov eax, dword [0x141ddb378]
xor edx, edx
div dword [0x141ddb37c]
imul eax, eax, 0x9f63768b
or eax, 0x376e06aa
cmp eax, 0xb2588ed2
je 0x1400d8040
test ebp, ebp
je 0x1400d81f0
mov eax, dword [0x141ddb380]
or eax, dword [0x141ddb384]
add eax, 0x132ef61c
and eax, 0x4adf9196
cmp eax, 0xdea1b56a
jbe 0x1400d80a0
mov ecx, 8
mov rdx, rbx
call fcn.1400c29b0
nop word cs:[rax + rax]
mov eax, dword [0x141ddb388]
xor edx, edx
div dword [0x141ddb38c]
and eax, 0xad7693dd
imul r15d, eax, 0xc92ab6e0
mov ecx, 8
mov rdx, rbx
call fcn.1400c29b0
cmp r15d, 0x4e749375
jb 0x1400d80a0
mov r14, rax
test rax, rax
je 0x1400d8292
xor eax, eax
test al, al
je 0x1400d80f0
mov ecx, ebp
mov rdx, r14
mov r8, rdi
call qword [sym.imp.ADVAPI32.dll_CopySid]
mov r15, qword [sym.imp.ADVAPI32.dll_CopySid]
nop word [rax + rax]
mov eax, dword [0x141ddb3c0]
or eax, dword [0x141ddb3c4]
imul r12d, eax, 0xf02c66c2
add r12d, 0xb000fffd
and r12d, 0x67cb563b
mov ecx, ebp
mov rdx, r14
mov r8, rdi
call r15
cmp r12d, 0x3d1763e9
jb 0x1400d8100
nop word cs:[rax + rax]
mov ecx, dword [0x141ddb3c8]
sub ecx, dword [0x141ddb3cc]
add ecx, 0x98e1e335
or ecx, 0x86279488
imul rcx, rcx, 0x19394213
shr rcx, 0x3c
cmp ecx, 0xbe431b26
je 0x1400d8140
test eax, eax
je 0x1400d8224
movzx eax, byte [r14]
xor ecx, ecx
nop dword [rax]
test cl, cl
jne 0x1400d8180
cmp al, 1
jne 0x1400d8266
mov qword [rsi], rbx
mov eax, dword [0x141ddb3e0]
imul eax, dword [0x141ddb3e4]
add eax, 0x7a30cd57
or eax, 0x553830b3
xor eax, 0xc38d2919
cmp eax, 0x9a4bcc97
jae 0x1400d81c0
mov qword [rsi + 8], r14
nop word cs:[rax + rax]
mov eax, dword [0x141ddb3e8]
and eax, dword [0x141ddb3ec]
and eax, 0x3ea8145b
imul eax, eax, 0x1c1b82c3
or eax, 0xc99eeee2
mov qword [rsi + 8], r14
cmp eax, 0xca4d5a0c
jb 0x1400d81c0
mov qword [rsi + 0x10], rbx
jmp 0x1400d83b9
mov edx, 1
xor ecx, ecx
mov r8, rdi
call qword [sym.imp.ADVAPI32.dll_CopySid]
test eax, eax
jne 0x1400d8312
mov eax, dword [0x141ddb3a8]
xor eax, dword [0x141ddb3ac]
cmp eax, 0xda6f2c8
jne 0x1400d8314
jmp 0x1400d833e
call qword [sym.imp.KERNEL32.dll_GetLastError]
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rsi, qword [0x141dde6e0]
mov eax, dword [str.Aw_]
imul eax, dword [0x141ddb3d4]
imul eax, eax, 0x261a693c
add eax, 0xdbff9cbc
cmp eax, 0x17fac8dd
jae 0x1400d8381
jmp 0x1400d83a9
ud2
mov eax, dword [0x141ddb390]
and eax, dword [0x141ddb394]
imul eax, eax, 0x1b83f8f4
shr eax, 2
imul rax, rax, 0x254c2eb5
shr rax, 0x3a
cmp eax, 0xd940a0bf
jbe 0x1400d82c0
ud2
mov eax, dword [0x141ddb398]
xor edx, edx
div dword [0x141ddb39c]
imul eax, eax, 0xe0c679f6
add eax, 0x68a411de
ud2
ud2
mov eax, dword [0x141ddb3b0]
sub eax, dword [0x141ddb3b4]
and eax, 0x50080404
or eax, 0xaaf338e2
imul edi, eax, 0x99827eab
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp edi, 0x3e05bcdf
jne 0x1400d8346
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400d8314
movabs rax, 0x8000000000000000
mov qword [rsi], rax
nop word cs:[rax + rax]
mov eax, dword [str._Ht:]
imul eax, dword [0x141ddb3bc]
imul eax, eax, 0x53bb4359
add eax, 0xf13ad096
cmp eax, 0x8c009271
ja 0x1400d8360
jmp 0x1400d83b9
mov eax, dword [0x141ddb3d8]
xor eax, dword [0x141ddb3dc]
imul edi, eax, 0x5f43e79e
mov rcx, rsi
xor edx, edx
mov r8, r14
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp edi, 0xff634916
jne 0x1400d83b9
mov rcx, rsi
xor edx, edx
mov r8, r14
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1400d8381
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret