Function at 0x1803f0930
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x308
lea rbp, [rsp + 0x80]
mov eax, 0x30
call fcn.180698e80
sub rsp, rax
mov rbx, rsp
mov eax, 0x20
call fcn.180698e80
sub rsp, rax
mov rsi, rsp
lea rax, [0x1806b6336]
mov qword [rbp + 0x258], rax
lea rax, [rbp + 0x258]
mov rcx, qword [rbp + 0x258]
movabs rax, 0xcf2c3c8cf9cafcc5
mov qword [rbp + 0x250], rax
lea rax, [rbp + 0x250]
mov rdx, qword [rbp + 0x250]
sub rsp, 0x20
call fcn.1802f29a0
add rsp, 0x20
mov edi, dword [rax]
movzx r14d, word [rax + 4]
movzx eax, byte [rax + 6]
shl eax, 0x10
or r14d, eax
mov al, byte [0x1807afe04]
sub rsp, 0x20
mov ecx, 7
mov edx, 1
call fcn.1804caf90
add rsp, 0x20
mov rcx, rax
cmp rcx, 0
jne 0x1803f0a03
sub rsp, 0x20
mov ecx, 1
mov edx, 7
call fcn.18063bc30
add rsp, 0x20
ud2
mov eax, dword [0x1807971f8]
imul eax, dword [0x1807971fc]
xor eax, 0x2b43a43e
add eax, 0xe43a8647
mov r8d, 0x56945957
xor edx, edx
div r8d
cmp eax, 0x13bbd70b
je 0x1803f21d3
mov eax, dword [0x180797200]
mov edx, dword [0x180797204]
lea eax, [rax + rdx + 0x3bf35da8]
imul rax, rax, 0x7969c05f
shr rax, 0x3e
mov edx, r14d
shr edx, 0x10
xor dl, 0x14
movzx r8d, dl
shl r8, 0x30
mov r9d, r14d
shr r9d, 8
xor r9b, 0x17
movzx r9d, r9b
shl r9, 0x28
or r8, r9
mov r9b, r14b
xor r9b, 0xfd
movzx r9d, r9b
shl r9, 0x20
or r8, r9
mov r9d, edi
xor r9d, 0x44925bae
mov byte [rcx + 6], dl
shr r8, 0x20
mov word [rcx + 4], r8w
mov dword [rcx], r9d
cmp eax, 0xda8b530e
jae 0x1803f21d3
jmp 0x1803f0aad
mov eax, dword [0x180797208]
xor edx, edx
div dword [0x18079720c]
xor eax, 0x37c29510
mov r8d, 0x9c18459
xor edx, edx
div r8d
add eax, 0x5ce78688
cmp eax, 0x77d217c4
je 0x1803f222f
jmp 0x1803f0add
mov eax, dword [0x180797210]
xor eax, dword [0x180797214]
and eax, 0xe8d0da89
imul eax, eax, 0x983219ee
add eax, 0x3ec7f596
mov qword [rsi], 7
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], 7
cmp eax, 0x8343719f
je 0x1803f0add
jmp 0x1803f0b15
lea rcx, [rbp + 0x190]
sub rsp, 0x20
mov rdx, rsi
call fcn.180455cb0
add rsp, 0x20
mov r8, qword [rbp + 0x190]
mov rcx, qword [rbp + 0x198]
movabs rax, 0x8000000000000007
cmp r8, rax
jne 0x1803f0bd4
mov qword [rbp + 0x1b8], rcx
lea rax, [rbp + 0xc8]
add rax, 0x20
mov dword [rbp + 0xc8], 0
mov dword [rbp + 0xcc], 0
movaps xmm0, xmmword [0x1806c5e70]
movups xmmword [rax], xmm0
mov qword [rbp + 0xd8], 0
mov dword [rbp + 0xe0], 0
mov dword [rbp + 0xd0], 0
lea rcx, [rbp - 0x80]
lea rdx, [rbp + 0x1b8]
lea r8, [rbp + 0xc8]
sub rsp, 0x20
call fcn.180506020
add rsp, 0x20
movabs rax, 0x8000000000000007
cmp qword [rbp - 0x80], rax
je 0x1803f14dc
jmp 0x1803f1535
mov eax, dword [0x180797218]
xor eax, dword [0x18079721c]
sub eax, 0x4ae35a7c
sub eax, 0xf3ac76b
mov r9d, 0xa28aac2c
xor edx, edx
div r9d
cmp eax, 0x736ede35
je 0x1803f2253
mov eax, dword [0x180797220]
or eax, dword [0x180797224]
imul edx, eax, 0x94f0e5bc
sub edx, 0x51ab4621
add edx, 0xd817ae61
mov rax, qword [rbp + 0x1a0]
mov qword [rbx + 0x10], rax
mov rax, qword [rbp + 0x1a8]
mov qword [rbx + 0x18], rax
mov rax, qword [rbp + 0x1b0]
mov qword [rbx + 0x20], rax
mov qword [rbx], r8
mov r14, rbx
add r14, 8
mov qword [rbx + 8], rcx
mov qword [rbp + 0x240], rbx
lea rax, [0x1803ea640]
mov qword [rbp + 0x248], rax
lea rax, [0x1806c60c0]
mov qword [rbp + 0xf8], rax
lea rax, [rbp + 0xf8]
add rax, 8
cmp edx, 0x37b1ccc
jb 0x1803f2253
jmp 0x1803f0c89
mov qword [rax], 1
mov qword [rbp + 0x118], 0
lea rax, [rbp + 0x240]
mov qword [rbp + 0x108], rax
mov qword [rbp + 0x110], 1
lea rcx, [rbp + 0x168]
lea rdx, [rbp + 0xf8]
sub rsp, 0x20
call fcn.180686890
add rsp, 0x20
mov rsi, qword [rbp + 0x168]
mov rdi, qword [rbp + 0x170]
mov r8, qword [rbp + 0x178]
lea rcx, [rbp - 0x58]
sub rsp, 0x20
mov rdx, rdi
mov r9d, 3
call fcn.1805f4be0
add rsp, 0x20
cmp rsi, 0
je 0x1803f0d75
mov eax, dword [0x180797228]
xor eax, dword [0x18079722c]
add eax, 0x7c096959
mov ecx, 0x363f62c6
xor edx, edx
div ecx
sub eax, 0xd10e773d
cmp eax, 0xbcf8b57f
je 0x1803f22af
mov eax, dword [0x180797230]
add eax, dword [0x180797234]
or eax, 0x7ce8baa6
or eax, 0xee926997
imul r15d, eax, 0xa24a4787
sub rsp, 0x20
mov rcx, rdi
mov rdx, rsi
mov r8d, 1
call fcn.1804cafa0
add rsp, 0x20
cmp r15d, 0x55f318f0
je 0x1803f22af
jmp 0x1803f0d73
jmp 0x1803f0d75
sub rsp, 0x20
mov ecx, 5
xor edx, edx
call fcn.1806652f0
add rsp, 0x20
mov r8, qword [rbx]
movabs rax, 0x7ffffffffffffffe
mov rcx, r8
add rcx, rax
mov rax, rcx
sub rax, 5
mov eax, 1
cmovb rax, rcx
test rax, rax
je case.0x1803f0e99.0
jmp 0x1803f0db7
mov rcx, rax
sub rcx, 1
je 0x1803f1106
jmp 0x1803f0dc6
add rax, 0xfffffffffffffffe
sub rax, 2
jb case.0x1803f0e99.0
jmp 0x1803f0dd6
mov eax, dword [0x180797238]
or eax, dword [0x18079723c]
add eax, 0x4fb96f72
mov ecx, 0x82af9d83
xor edx, edx
div ecx
sub eax, 0x5e8c7531
cmp eax, 0xd2778060
jae 0x1803f22d5
mov eax, dword [0x180797240]
or eax, dword [str.k_nVx]
xor eax, 0x6f2a81d5
imul eax, eax, 0xc5e21a1e
or eax, 0x938838d0
mov rcx, qword [r14]
cmp eax, 0x3e860641
je 0x1803f22d5
jmp 0x1803f0e2c
mov eax, dword [0x180797248]
imul eax, dword [0x18079724c]
sub eax, 0x84a3bc2
xor eax, 0x8c8909b
add eax, 0xe978dcbb
cmp eax, 0x1dc8356c
jb 0x1803f22e2
jmp 0x1803f0e55
mov edx, dword [0x180797250]
sub edx, dword [0x180797254]
sub edx, 0xea4ab403
and edx, 0xea5bcbdc
and edx, 0x1af42fe9
mov rax, rcx
and rax, 3
cmp edx, 0x8e02ae6a
ja 0x1803f0e55
mov rdx, rax
sub rdx, 3
ja 0x1803f0e9b
lea rdx, [0x1806c64bc]
movsxd rax, dword [rdx + rax*4]
add rax, rdx
jmp rax
mov eax, dword [0x180797258]
or eax, dword [0x18079725c]
add eax, 0xa331ac23
or eax, 0x6c6bce
and eax, 0xcebc7bd7
cmp eax, 0xd75712f9
jae 0x1803f22ef
jmp 0x1803f0ec3
mov eax, dword [0x180797260]
xor eax, dword [0x180797264]
imul eax, eax, 0xcbaf15d4
and eax, 0xd7e7aa08
and eax, 0x29db7663
cmp eax, 0x4b39e6b1
ja 0x1803f0ec3
ud2
shr rcx, 0x20
cmp ecx, 0x29
setb al
jmp case.0x1803f0e99.0
mov rsi, rcx
add rsi, 0xffffffffffffffff
mov rdi, qword [rcx - 1]
mov eax, dword [0x180797268]
imul eax, dword [0x18079726c]
mov r8d, 0x45ad63ab
xor edx, edx
div r8d
imul eax, eax, 0x957093a
imul eax, eax, 0xbb847fd1
cmp eax, 0xc9d6fbd4
je 0x1803f2300
jmp 0x1803f0f33
mov eax, dword [0x180797270]
add eax, dword [0x180797274]
sub eax, 0x3b684ba1
mov r8d, 0xa54de5e7
xor edx, edx
div r8d
sub eax, 0x946ba681
mov rdx, rcx
add rdx, 7
cmp eax, 0xce58e57c
jae 0x1803f0f33
jmp 0x1803f0f64
mov rbx, qword [rdx]
mov r14, qword [rbx]
cmp r14, 0
je 0x1803f0fd3
mov eax, dword [0x180797278]
or eax, dword [0x18079727c]
and eax, 0x2e37df89
add eax, 0xfa51eb34
or eax, 0xb9965289
cmp eax, 0xc6a80e78
jae 0x1803f230d
mov eax, dword [0x180797280]
imul eax, dword [0x180797284]
or eax, 0xd43ec7c
sub eax, 0x8fae1e5b
imul r15d, eax, 0xf605bf1f
sub rsp, 0x20
mov rcx, rdi
call r14
add rsp, 0x20
cmp r15d, 0x2e9ea4d0
ja 0x1803f230d
jmp 0x1803f0fd1
jmp 0x1803f0fd3
mov eax, dword [0x180797288]
sub eax, dword [0x18079728c]
imul eax, eax, 0x69daa1b7
or eax, 0x1ca0a476
sub eax, 0x79f045f7
cmp eax, 0x188b1420
jb 0x1803f232c
jmp 0x1803f0ffc
mov eax, dword [0x180797290]
or eax, dword [0x180797294]
or eax, 0xbb9192b4
add eax, 0xdab7146f
and eax, 0x44c79544
mov rdx, qword [rbx + 8]
mov r8, qword [rbx + 0x10]
cmp eax, 0xd29f817
jae 0x1803f0ffc
jmp 0x1803f1028
cmp rdx, 0
je 0x1803f1040
sub rsp, 0x20
mov rcx, rdi
call fcn.1804cafa0
add rsp, 0x20
jmp 0x1803f1040
mov eax, dword [0x180797298]
xor eax, dword [0x18079729c]
add eax, 0xf1563b03
mov ecx, 0x60ad96e
xor edx, edx
div ecx
xor eax, 0x3dfb6ecc
cmp eax, 0x91e23645
je 0x1803f2339
mov eax, dword [0x1807972a0]
xor edx, edx
div dword [0x1807972a4]
mov edi, eax
xor edi, 0x4fdafafd
add edi, 0x4e039068
or edi, 0x47b1043c
sub rsp, 0x20
mov rcx, rsi
mov edx, 0x18
mov r8d, 8
call fcn.1804cafa0
add rsp, 0x20
cmp edi, 0xf4dbd6df
jae 0x1803f2339
jmp 0x1803f10b5
mov eax, dword [0x1807972a8]
or eax, dword [0x1807972ac]
add eax, 0xad725635
sub eax, 0xaf7f793f
and eax, 0x72ce612
cmp eax, 0xbed85ef9
jae 0x1803f2365
jmp 0x1803f10dd
mov eax, dword [0x1807972b0]
imul eax, dword [0x1807972b4]
add eax, 0xb4cb9424
imul eax, eax, 0x67c751d9
xor eax, 0xce51f8b6
cmp eax, 0x8d1910af
jbe 0x1803f10dd
jmp case.0x1803f0e99.0
movabs rax, 0x8000000000000002
cmp r8, rax
setl al
test al, 1
jne case.0x1803f0e99.0
jmp 0x1803f1120
cmp r8, 0
sete cl
mov eax, dword [0x1807972b8]
sub eax, dword [0x1807972bc]
sub eax, 0x5cce4164
xor eax, 0x5be84a92
add eax, 0x8629f37d
cmp eax, 0x4ccb3160
ja 0x1803f2376
jmp 0x1803f114f
mov eax, dword [0x1807972c0]
xor eax, dword [0x1807972c4]
or eax, 0x7e89fddf
mov r9d, 0xa93af4b8
xor edx, edx
div r9d
add eax, 0xe5217f4
cmp eax, 0xedecff4a
jae 0x1803f114f
test cl, 1
jne case.0x1803f0e99.0
jmp 0x1803f1182
mov eax, dword [0x1807972c8]
or eax, dword [0x1807972cc]
mov ecx, 0x96b234ca
xor edx, edx
div ecx
add eax, 0x80ada159
and eax, 0x2f3a9d4
cmp eax, 0xc2dd146f
jae 0x1803f2387
mov eax, dword [0x1807972d0]
add eax, dword [0x1807972d4]
mov ecx, 0x3e671bb1
xor edx, edx
div ecx
and eax, 0x375870e4
or eax, 0xb908f694
mov rcx, qword [r14]
cmp eax, 0x8f91a36f
je 0x1803f2387
jmp 0x1803f11db
sub rsp, 0x20
mov rdx, r8
mov r8d, 1
call fcn.1804cafa0
add rsp, 0x20
mov eax, dword [0x1807972d8]
imul eax, dword [0x1807972dc]
imul eax, eax, 0x5970a935
or eax, 0x3b9bede6
mov ecx, 0x9fbe2a4d
xor edx, edx
div ecx
cmp eax, 0xe2da825c
jae 0x1803f2398
jmp 0x1803f121f
mov eax, dword [0x1807972e0]
sub eax, dword [0x1807972e4]
and eax, 0x8fd88a4
mov ecx, 0x8702500e
xor edx, edx
div ecx
or eax, 0x2c29d4cd
cmp eax, 0xdf10d079
jae 0x1803f121f
jmp case.0x1803f0e99.0
mov eax, dword [0x1807972e8]
xor edx, edx
div dword [0x1807972ec]
sub eax, 0x5c1e4c93
or eax, 0xcf69ccc0
add eax, 0x7e08e706
cmp eax, 0xe8bf825e
je 0x1803f23a9
jmp 0x1803f1271
mov eax, dword [0x1807972f0]
or eax, dword [0x1807972f4]
add eax, 0xecb60ea3
imul eax, eax, 0x2473335b
xor eax, 0xe3d438ad
cmp eax, 0x2bad7386
je 0x1803f1271
jmp 0x1803f1296
jmp 0x1803f1298
mov eax, dword [0x1807972f8]
and eax, dword [0x1807972fc]
imul eax, eax, 0xec60e082
or eax, 0x812de9be
or eax, 0x50e9f391
cmp eax, 0xe748285f
je 0x1803f23b6
mov eax, dword [0x180797300]
or eax, dword [0x180797304]
and eax, 0x168ccfd1
xor eax, 0x98098deb
or eax, 0xe2ac0917
lea r12, [rbp + 0x128]
add r12, 0x30
cmp eax, 0x4aef2fb9
jb 0x1803f23b6
jmp 0x1803f12f2
lea r13, [rbp + 0x128]
add r13, 0x38
lea rdi, [rbp + 0x128]
add rdi, 8
lea r15, [rbp + 0x128]
add r15, 0x10
lea rax, [rbp + 0x128]
add rax, 0x18
mov qword [rbp + 0x1c8], rax
lea rax, [rbp + 0x128]
add rax, 0x20
mov qword [rbp + 0x1d0], rax
lea rax, [rbp + 0x128]
add rax, 0x28
mov qword [rbp + 0x1d8], rax
lea rax, [rbp - 8]
add rax, 0x20
mov qword [rbp + 0x1e0], rax
lea rax, [rbp - 8]
add rax, 0x88
mov qword [rbp + 0x1e8], rax
lea rax, [rbp - 8]
add rax, 0x38
mov qword [rbp + 0x1f0], rax
lea rax, [rbp - 8]
add rax, 0x58
mov qword [rbp + 0x1f8], rax
lea r14, [rbp - 8]
add r14, 0x60
lea rax, [rbp - 8]
add rax, 0x68
mov qword [rbp + 0x200], rax
lea rax, [rbp - 8]
add rax, 0x70
mov qword [rbp + 0x208], rax
lea rax, [rbp - 8]
add rax, 0x78
mov qword [rbp + 0x210], rax
lea rax, [rbp - 8]
add rax, 0x80
mov qword [rbp + 0x218], rax
lea rbx, [rbp - 8]
add rbx, 0xa8
lea rax, [rbp + 0x180]
add rax, 8
mov qword [rbp + 0x220], rax
lea rcx, [rbp - 8]
lea rdx, str.C:Program_FilesWindows_NTidentity_provider.exe
sub rsp, 0x20
mov r8d, 0x31
call fcn.180667500
add rsp, 0x20
lea rcx, [rbp - 0x48]
lea rdx, [rbp - 8]
sub rsp, 0x20
call fcn.180671f30
add rsp, 0x20
cmp qword [rbp - 0x48], 2
je 0x1803f21cf
lea rax, [rbp - 8]
add rax, 8
mov qword [rbp + 0x228], rax
lea rax, [rbp - 8]
add rax, 0x28
mov qword [rbp + 0x268], rax
lea rax, [rbp - 8]
add rax, 0x30
mov qword [rbp + 0x230], rax
mov eax, dword [0x180797308]
add eax, dword [0x18079730c]
and eax, 0x2458a25a
add eax, 0xe898f2b8
and eax, 0xf90511c
cmp eax, 0x5d400605
jae 0x1803f23c7
mov eax, dword [0x180797310]
xor edx, edx
div dword [0x180797314]
add eax, 0x1b6ee136
or eax, 0xeaad1764
add eax, 0x87847444
lea rcx, [rbp - 8]
add rcx, 0x40
cmp eax, 0xb16f5897
ja 0x1803f23c7
mov qword [rbp + 0x238], rcx
jmp 0x1803f14b4
mov qword [rbp + 0x270], r15
mov qword [rbp + 0x280], r14
mov qword [rbp + 0x1c0], r12
mov qword [rbp + 0x260], rdi
mov qword [rbp + 0x278], rbx
jmp 0x1803f158e
mov eax, dword [0x180797318]
sub eax, dword [0x18079731c]
and eax, 0x9d2e0624
mov ecx, 0xdd625987
xor edx, edx
div ecx
xor eax, 0x152d05dc
cmp eax, 0xe1223c0e
ja 0x1803f23d8
mov eax, dword [0x180797320]
xor edx, edx
div dword [0x180797324]
and eax, 0x1c8bf666
xor eax, 0xa5f082d4
xor eax, 0x4ba256eb
cmp eax, 0xacc149c5
jb 0x1803f23d8
jmp 0x1803f1530
jmp 0x1803f1298
mov eax, dword [0x180797328]
xor edx, edx
div dword [0x18079732c]
or eax, 0xa9607549
imul eax, eax, 0xe3ff129b
mov ecx, 0x810f4201
xor edx, edx
div ecx
cmp eax, 0x583cb946
ja 0x1803f23e5
mov eax, dword [0x180797330]
xor eax, dword [0x180797334]
and eax, 0x95fffe83
sub eax, 0x35db1567
or eax, 0xecaf992b
ud2
lea rcx, [rbp + 0x128]
lea rdx, [rbp - 0x48]
sub rsp, 0x20
mov r8d, 0x40
call fcn.1806a7400
add rsp, 0x20
lea rcx, [rbp + 0x180]
lea rdx, [rbp + 0x128]
sub rsp, 0x20
call fcn.180671fa0
add rsp, 0x20
mov rcx, qword [r12]
mov rbx, qword [r13]
sub rsp, 0x20
call qword [sym.imp.kernel32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.kernel32.dll_CloseHandle]
add rsp, 0x20
cmp qword [rbp + 0x128], 0
je 0x1803f1657
mov eax, dword [0x180797338]
xor eax, dword [0x18079733c]
or eax, 0x89d011dd
imul eax, eax, 0x508475a9
imul eax, eax, 0xb9cfe658
cmp eax, 0x5eac135c
jae 0x1803f23f4
mov eax, dword [0x180797340]
add eax, dword [0x180797344]
sub eax, 0x6d18cc38
mov ecx, 0xa561d31a
xor edx, edx
div ecx
and eax, 0x9d2c696c
mov rcx, qword [rdi]
cmp eax, 0xd1c1ece9
je 0x1803f23f4
jmp 0x1803f1647
sub rsp, 0x20
call qword [sym.imp.kernel32.dll_CloseHandle]
add rsp, 0x20
jmp 0x1803f1657
mov rax, qword [r15]
cmp rax, 0
sete cl
mov eax, dword [0x180797348]
imul eax, dword [0x18079734c]
sub eax, 0x58d14761
add eax, 0x8bacb39e
imul eax, eax, 0xb7826c08
cmp eax, 0x4c1653ae
je 0x1803f2405
jmp 0x1803f168b
mov eax, dword [0x180797350]
and eax, dword [0x180797354]
mov r8d, 0xe7b12f6f
xor edx, edx
div r8d
and eax, 0x5e58ec15
imul eax, eax, 0xe16e2bb1
cmp eax, 0x7f3be429
je 0x1803f168b
test cl, 1
jne 0x1803f16d5
jmp 0x1803f16bb
mov rax, qword [rbp + 0x1c8]
mov rcx, qword [rax]
sub rsp, 0x20
call qword [sym.imp.kernel32.dll_CloseHandle]
add rsp, 0x20
jmp 0x1803f16d5
mov rax, qword [rbp + 0x1d0]
mov rax, qword [rax]
cmp rax, 0
sete al
mov ecx, dword [0x180797358]
sub ecx, dword [0x18079735c]
and ecx, 0xa9e56cf1
and ecx, 0xb3f2f4cd
imul ecx, ecx, 0xa76e7698
cmp ecx, 0x1210aa22
jb 0x1803f2416
mov ecx, dword [0x180797360]
sub ecx, dword [0x180797364]
xor ecx, 0x65f36e1f
or ecx, 0x6864f7c8
xor ecx, 0xff217775
cmp ecx, 0xa2d374e3
ja 0x1803f2416
test al, 1
jne 0x1803f17a7
jmp 0x1803f1740
mov rax, qword [rbp + 0x1d8]
mov rcx, qword [rax]
sub rsp, 0x20
call qword [sym.imp.kernel32.dll_CloseHandle]
add rsp, 0x20
mov eax, dword [0x180797368]
xor eax, dword [0x18079736c]
and eax, 0x14959b2e
and eax, 0xc9d13dff
and eax, 0xa7d7b1b4
cmp eax, 0xdbb31c84
je 0x1803f2423
mov eax, dword [0x180797370]
xor eax, dword [0x180797374]
xor eax, 0x38ea7496
imul eax, eax, 0x84cfe17e
xor eax, 0xda4b2804
cmp eax, 0x533ffc9e
jbe 0x1803f2423
jmp 0x1803f17a7
mov eax, dword [0x180797378]
xor edx, edx
div dword [0x18079737c]
add eax, 0xe561930c
xor eax, 0xcac7e605
mov ecx, 0xa9827e91
xor edx, edx
div ecx
cmp eax, 0x9f4bdad
je 0x1803f2434
jmp 0x1803f17d5
mov eax, dword [0x180797380]
add eax, dword [0x180797384]
and eax, 0x72aa72da
mov ecx, 0xa1c287ee
xor edx, edx
div ecx
add eax, 0xa22ffa41
cmp eax, 0xfd4f2d9
jbe 0x1803f17d5
jmp 0x1803f17fd
mov eax, dword [0x180797388]
add eax, dword [0x18079738c]
or eax, 0x9fcab005
or eax, 0xe0c47980
mov ecx, 0xf8c225da
xor edx, edx
div ecx
cmp eax, 0xaa05ac28
jae 0x1803f2445
mov eax, dword [0x180797390]
xor eax, dword [0x180797394]
xor eax, 0x99d375fe
add eax, 0xb9091af2
sub eax, 0xa591283b
mov rbx, qword [rbp - 8]
cmp eax, 0x1afca0c9
jbe 0x1803f2445
jmp 0x1803f1853
cmp rbx, 0
je 0x1803f18d5
mov rax, qword [rbp + 0x228]
mov r14, qword [rax]
mov eax, dword [str.ka4B_Jt]
sub eax, dword [0x18079739c]
or eax, 0x9f3e02e1
xor eax, 0x67099601
and eax, 0x2d1314
cmp eax, 0x7e63ebc
ja 0x1803f2452
mov eax, dword [0x1807973a0]
xor eax, dword [0x1807973a4]
xor eax, 0x4a8e23c9
or eax, 0xf02d2f9d
imul esi, eax, 0x4f6d1887
sub rsp, 0x20
mov rcx, r14
mov rdx, rbx
mov r8d, 1
call fcn.1804cafa0
add rsp, 0x20
cmp esi, 0x77a08979
ja 0x1803f2452
jmp 0x1803f18cc
mov r14, qword [rbp + 0x280]
jmp 0x1803f18d5
mov eax, dword [0x1807973a8]
or eax, dword [0x1807973ac]
and eax, 0x38949240
sub eax, 0x8b0d0253
and eax, 0x94e7132c
cmp eax, 0xadc07dd2
je 0x1803f247c
mov rbx, qword [rbp + 0x278]
jmp 0x1803f1904
mov eax, dword [0x1807973b0]
sub eax, dword [0x1807973b4]
xor eax, 0x215db69e
or eax, 0xd93d9130
and eax, 0x545279b0
cmp eax, 0x541402fe
ja 0x1803f1904
mov r12, r13
jmp 0x1803f192b
mov rax, qword [rbp + 0x268]
mov rdi, qword [rax]
mov rax, qword [rbp + 0x230]
mov r13, qword [rax]
cmp r13, 0
sete al
test al, 1
jne 0x1803f1a0f
jmp 0x1803f1950
xor esi, esi
jmp 0x1803f1954
mov rax, rsi
add rsi, 1
imul rax, rax, 0x28
mov r15, rdi
add r15, rax
add r15, 8
mov rbx, qword [r15]
cmp rbx, 0
je 0x1803f19f0
add r15, 8
mov eax, dword [0x1807973b8]
imul eax, dword [0x1807973bc]
add eax, 0x6cbce90c
add eax, 0x8ed47bb1
xor eax, 0x3f5d545d
cmp eax, 0x4aa68237
jbe 0x1803f2489
jmp 0x1803f199f
mov eax, dword [0x1807973c0]
xor eax, dword [0x1807973c4]
and eax, 0x4f9afeed
mov ecx, 0x8f19173b
xor edx, edx
div ecx
mov r14d, eax
xor r14d, 0x2db1802c
mov rcx, qword [r15]
sub rsp, 0x20
mov rdx, rbx
mov r8d, 1
call fcn.1804cafa0
add rsp, 0x20
cmp r14d, 0xb169ab76
je 0x1803f199f
jmp 0x1803f19e7
mov r14, qword [rbp + 0x280]
jmp 0x1803f19f0
cmp rsi, r13
sete al
test al, 1
jne 0x1803f19ff
jmp 0x1803f1954
mov r15, qword [rbp + 0x270]
mov rbx, qword [rbp + 0x278]
jmp 0x1803f1a0f
mov rax, qword [rbp + 0x1e0]
mov rax, qword [rax]
cmp rax, 0
sete cl
mov r13, r12
mov rdi, qword [rbp + 0x260]
test cl, 1
mov r12, qword [rbp + 0x1c0]
jne 0x1803f1ad8
jmp 0x1803f1a3c
mov rcx, qword [rbp + 0x268]
mov rbx, qword [rcx]
imul r14, rax, 0x28
mov eax, dword [0x1807973c8]
imul eax, dword [0x1807973cc]
sub eax, 0x26816261
mov ecx, 0x3201db1e
xor edx, edx
div ecx
or eax, 0xe921a2e9
cmp eax, 0xdfc151a0
je 0x1803f24af
jmp 0x1803f1a77
mov eax, dword [0x1807973d0]
sub eax, dword [0x1807973d4]
mov ecx, 0x17602199
xor edx, edx
div ecx
mov r15d, eax
add r15d, 0x7744b4e9
or r15d, 0x4f598fac
sub rsp, 0x20
mov rcx, rbx
mov rdx, r14
mov r8d, 8
call fcn.1804cafa0
add rsp, 0x20
cmp r15d, 0x2c0c0aa4
jbe 0x1803f1a77
jmp 0x1803f1ac1
mov r15, qword [rbp + 0x270]
mov r14, qword [rbp + 0x280]
mov rbx, qword [rbp + 0x278]
jmp 0x1803f1ad8
sub rsp, 0x20
mov rcx, qword [rbp + 0x1e8]
call fcn.180462800
add rsp, 0x20
mov rax, qword [rbp + 0x1f0]
mov rdx, qword [rax]
mov eax, dword [0x1807973d8]
xor eax, dword [0x1807973dc]
and eax, 0xd70d5f45
add eax, 0x7b0a0d2d
add eax, 0x5fd1c893
cmp eax, 0x9365faf8
je 0x1803f24d9
mov ecx, dword [0x1807973e0]
sub ecx, dword [0x1807973e4]
add ecx, 0xaf06ed25
or ecx, 0xdc5e2480
xor ecx, 0x4fea8531
movabs rax, 0x8000000000000000
cmp rdx, rax
sete al
cmp ecx, 0xfeb1df3c
jae 0x1803f24d9
test al, 1
jne 0x1803f1b88
jmp 0x1803f1b5c
cmp rdx, 0
sete al
test al, 1
jne 0x1803f1b88
jmp 0x1803f1b69
mov rax, qword [rbp + 0x238]
mov rcx, qword [rax]
sub rsp, 0x20
mov r8d, 1
call fcn.1804cafa0
add rsp, 0x20
jmp 0x1803f1b88
mov rax, qword [rbp + 0x1f8]
mov eax, dword [rax]
mov ecx, eax
sub ecx, 4
jb 0x1803f1c5f
jmp 0x1803f1b9e
sub eax, 6
je 0x1803f1c5f
jmp 0x1803f1ba9
mov eax, dword [0x1807973e8]
sub eax, dword [0x1807973ec]
or eax, 0x8acb97d9
xor eax, 0x21facd8
sub eax, 0x6fa2ad31
cmp eax, 0xe24f449
je 0x1803f24ea
jmp 0x1803f1bd1
mov eax, dword [0x1807973f0]
or eax, dword [0x1807973f4]
xor eax, 0x4f7d42f7
xor eax, 0x3bd9990a
xor eax, 0xccf40da0
mov rcx, qword [r14]
cmp eax, 0x193c8d5
je 0x1803f1bd1
jmp 0x1803f1bf8
sub rsp, 0x20
call qword [sym.imp.kernel32.dll_CloseHandle]
add rsp, 0x20
mov eax, dword [0x1807973f8]
imul eax, dword [0x1807973fc]
add eax, 0x60705cc9
mov ecx, 0x3c4c0355
xor edx, edx
div ecx
or eax, 0x675e057c
cmp eax, 0x6f688d49
jae 0x1803f24f7
mov eax, dword [0x180797400]
xor edx, edx
div dword [0x180797404]
and eax, 0xc8c27f43
add eax, 0x77d1a897
mov ecx, 0xda4fcbb9
xor edx, edx
div ecx
cmp eax, 0x7ed6c85e
jae 0x1803f24f7
jmp 0x1803f1c5f
mov rax, qword [rbp + 0x200]
mov ecx, dword [rax]
mov eax, dword [0x180797408]
sub eax, dword [0x18079740c]
sub eax, 0x7ded457b
sub eax, 0x8c3c850
add eax, 0x3c68b29a
cmp eax, 0x8fd5ee67
jb 0x1803f2504
jmp 0x1803f1c90
mov eax, dword [0x180797410]
xor edx, edx
div dword [0x180797414]
xor eax, 0x6f8cada3
xor eax, 0x6a9a7eb8
sub eax, 0x22227172
cmp eax, 0x92fa96b
jbe 0x1803f1c90
mov eax, ecx
sub eax, 4
jb 0x1803f1cde
jmp 0x1803f1cbd
sub ecx, 6
je 0x1803f1cde
jmp 0x1803f1cc4
mov rax, qword [rbp + 0x208]
mov rcx, qword [rax]
sub rsp, 0x20
call qword [sym.imp.kernel32.dll_CloseHandle]
add rsp, 0x20
jmp 0x1803f1cde
mov eax, dword [0x180797418]
sub eax, dword [0x18079741c]
add eax, 0xf3491a89
imul eax, eax, 0xcdd98a6b
add eax, 0x5f79e17c
cmp eax, 0x8c3ad913
jb 0x1803f2515
jmp 0x1803f1d07
mov eax, dword [0x180797420]
sub eax, dword [0x180797424]
sub eax, 0x5763c8b8
imul eax, eax, 0x67b0482e
or eax, 0xc9b7fa11
mov rcx, qword [rbp + 0x210]
mov ecx, dword [rcx]
cmp eax, 0xbd984d7a
je 0x1803f1d07
jmp 0x1803f1d35
mov eax, dword [0x180797428]
xor eax, dword [0x18079742c]
sub eax, 0x3e8c3b58
xor eax, 0x5bbcc72a
imul eax, eax, 0x42618d00
cmp eax, 0xec3c7b18
je 0x1803f2522
mov eax, dword [0x180797430]
xor edx, edx
div dword [0x180797434]
imul eax, eax, 0x98bde418
or eax, 0xa5f3ea6b
or eax, 0xbc4a3fed
cmp eax, 0x9d86e4df
je 0x1803f2522
mov eax, ecx
sub eax, 4
jb 0x1803f1daf
jmp 0x1803f1d8e
sub ecx, 6
je 0x1803f1daf
jmp 0x1803f1d95
mov rax, qword [rbp + 0x218]
mov rcx, qword [rax]
sub rsp, 0x20
call qword [sym.imp.kernel32.dll_CloseHandle]
add rsp, 0x20
jmp 0x1803f1daf
mov eax, dword [0x180797438]
or eax, dword [0x18079743c]
mov ecx, 0xcc573e3b
xor edx, edx
div ecx
xor eax, 0xe1212172
and eax, 0x59b73461
cmp eax, 0xc43ff051
ja 0x1803f2533
mov esi, dword [0x180797440]
or esi, dword [0x180797444]
or esi, 0xcb74d062
or esi, 0xbe3752bd
or esi, 0xa1caa0fb
sub rsp, 0x20
mov rcx, rbx
call fcn.180461c60
add rsp, 0x20
cmp esi, 0xe54b9b7f
jbe 0x1803f2533
jmp 0x1803f1e15
mov eax, dword [rbp + 0x180]
mov rcx, qword [rbp + 0x220]
mov rcx, qword [rcx]
cmp eax, 0
je case.0x1803f1e51.0
cmp rcx, 0
setne al
mov eax, ecx
and eax, 3
mov rdx, rax
sub rdx, 3
ja case.default.0x1803f1e51
lea rdx, [0x1806c64cc]
movsxd rax, dword [rdx + rax*4]
add rax, rdx
jmp rax
mov eax, dword [0x180797448]
and eax, dword [0x18079744c]
sub eax, 0x996e1553
sub eax, 0xa3e52e50
xor eax, 0x5026ee0f
cmp eax, 0x5b8b3ff4
ja 0x1803f2550
jmp 0x1803f1e7b
mov eax, dword [str._P]
sub eax, dword [0x180797454]
or eax, 0xa6f85fce
and eax, 0xa2299854
sub dword [rdx - 0x1a0d71cb], esp
invalid
cmp eax, 0x77288c4e
jae 0x1803f1e7b
sub dword [rdx - 0x1a0d71cb], esp
invalid
ud2
cmp eax, 0xa4f3a329
je 0x1803f2561
jmp case.0x1803f1e51.0
mov eax, dword [0x1807974b0]
sub eax, dword [0x1807974b4]
sub eax, 0x1f1fa864
imul esi, eax, 0x24478f41
or esi, 0x8f3e19ed
sub rsp, 0x20
mov rcx, rbx
mov edx, 0x18
mov r8d, 8
call fcn.1804cafa0
add rsp, 0x20
cmp esi, 0xc425ceb9
jb 0x1803f20f5
jmp 0x1803f2137
jmp case.0x1803f1e51.0
mov eax, dword [0x1807974b8]
add eax, dword [0x1807974bc]
xor eax, 0x44f14e3f
sub eax, 0x17729031
mov ecx, 0xb415832c
xor edx, edx
div ecx
cmp eax, 0xfcb56c75
jae 0x1803f25db
mov eax, dword [0x1807974c0]
or eax, dword [0x1807974c4]
sub eax, 0x325ce3c4
xor eax, 0x1afbefd2
mov ecx, 0x768e72be
xor edx, edx
div ecx
cmp eax, 0x224cb826
jae 0x1803f25db
jmp 0x1803f218f
lea rcx, [rbp - 8]
lea rdx, str.C:Program_FilesWindows_NTidentity_provider.exe
sub rsp, 0x20
mov r8d, 0x31
call fcn.180667500
add rsp, 0x20
lea rcx, [rbp - 0x48]
lea rdx, [rbp - 8]
sub rsp, 0x20
call fcn.180671f30
add rsp, 0x20
cmp qword [rbp - 0x48], 2
jne 0x1803f158e
jmp 0x1803f21cf
ud2
movq qword [r11 - 0x63a095e6], mm1
mov eax, r14d
shr eax, 0x10
xor al, 0x14
movzx edx, al
shl rdx, 0x30
mov r8d, r14d
shr r8d, 8
xor r8b, 0x17
movzx r8d, r8b
shl r8, 0x28
or rdx, r8
mov r8b, r14b
xor r8b, 0xfd
movzx r8d, r8b
shl r8, 0x20
or rdx, r8
mov r8d, edi
xor r8d, 0x44925bae
mov byte [rcx + 6], al
shr rdx, 0x20
mov word [rcx + 4], dx
mov dword [rcx], r8d
jmp 0x1803f0a30
push rax
out dx, eax
mov bh, 0xae
invalid
sub eax, 0xc748ebef
invalid
std
invalid
ja 0x1803f2238
xchg ecx, eax
mov edx, 0x485b297c
mov eax, dword [rbp + 0x1a0]
mov qword [rbx + 0x10], rax
mov rax, qword [rbp + 0x1a8]
mov qword [rbx + 0x18], rax
mov rax, qword [rbp + 0x1b0]
mov qword [rbx + 0x20], rax
mov qword [rbx], r8
mov qword [rbx + 8], rcx
mov qword [rbp + 0x240], rbx
lea rax, [0x1803ea640]
mov qword [rbp + 0x248], rax
lea rax, [0x1806c60c0]
mov qword [rbp + 0xf8], rax
jmp 0x1803f0c00
and al, 0x6b
xchg ebp, eax
mov word [rax], fs
pushfq
loopne 0x1803f22c1
sub rsp, 0x20
mov rcx, rdi
mov rdx, rsi
mov r8d, 1
call fcn.1804cafa0
add rsp, 0x20
jmp 0x1803f0d2e
invalid
xchg ecx, eax
jp 0x1803f2258
pop rsp
invalid
cmp al, byte [rbx - 0x2f175b89]
nop
xor ebp, ecx
jmp 0x1803f22ed
invalid
jo 0x1803f2315
mov ecx, 0x99ff6ba3
mov ch, 0xa8
jne 0x1803f2377
movabs dword [0x5c7d75a8b599ff6b], eax
pop rsp
jmp 0x1803f0ec1
mov edx, 0x5726346e
jae 0x1803f22d2
jmp 0x1803f22f2
mov esp, 0xf46b154d
fcomp dword [rdx]
adc edi, dword [rsi + rcx*8 - 0x7cb71338]
in al, dx
and byte [rax - 0x77], cl
stc
mov esp, 0x48ecc8ce
sub esp, 0x20
sub rsp, 0x20
mov rcx, rdi
call r14
add rsp, 0x20
jmp 0x1803f0f96
fstp xword [rdx]
lea esi, [rbp + rax*8 - 0x165a2b80]
shr esp, 0xff
invalid
mov ebx, 0x29d2cf9b
mov bh, 0x49
pop rdx
movsb byte [rdi], byte [rsi]
loope 0x1803f2319
sub rsp, 0x20
mov rcx, rsi
mov edx, 0x18
mov r8d, 8
call fcn.1804cafa0
add rsp, 0x20
jmp 0x1803f106a
imul edx, dword [0x12d2a63b2], 0x857193d2
movabs r12, 0x63fce7ffffed65e9
mov al, byte [rcx]
loope 0x1803f2343
out 0xfc, eax
cld
invalid
adc qword [rax - 0x4e], 0xffffffffedc6e944
invalid
invalid
jmp 0x1803f11ac
pop rsp
lodsd eax, dword [rsi]
leave
cmp ebx, edx
sub dword [rbp + 0x13a835c7], ecx
out dx, al
jmp 0x1803f121d
xchg esi, eax
adc eax, 0x3c8dfde9
invalid
rcr dword [rdi - 0x38], cl
invalid
div byte [rcx - 0x7d]
xchg ebp, eax
jmp 0x1803f2393
insd dword [rdi], dx
jbe 0x1803f2424
out dx, al
sub byte [rbp - 0xede17], r13b
invalid
in eax, dx
jrcxz 0x1803f243e
add byte [rax], ah
cmc
push 0xffffffffe90b0f79
outsb dx, byte [rsi]
int1
invalid
mov ebx, 0x8402a576
movabs al, byte [0x13e9c1106e95c446]
invalid
xor bh, byte [0x1a54f99e8]
sub al, 0x33
shl dword [rcx + 0x73e9893e], 0xf2
invalid
movabs al, byte [0xe9ceea8fddf06724]
in eax, dx
invalid
in eax, 0xf3
jnp 0x1803f2460
jnp 0x1803f2460
ror byte [rsi], 1
out 0x3f, al
push rcx
int3
adc al, byte [rdx]
cqo
xor al, 0xf7
stc
in eax, dx
xchg edx, eax
sbb edi, dword [0x173ce0d96]
cmp eax, 0xf38ee953
invalid
scasb al, byte [rdi]
cwde
mov dl, 0xc6
and esi, dword [rdi - 0xc2a1682]
invalid
sbb eax, 0x3ed76660
cmp dword [rbx + riz*4], edi
mov edi, 0x485c2874
sub esp, 0x20
mov rcx, r14
in al, dx
and byte [rcx + rcx*4 - 0xf], cl
mov rdx, rbx
mov r8d, 1
call fcn.1804cafa0
add rsp, 0x20
jmp 0x1803f1889
xor eax, ebx
clc
int 0x96
invalid
invalid
invalid
fcomp dword [rcx]
invalid
invalid
repne insb byte [rdi], dx
or dword [rcx + 0x4bc0499], eax
jmp 0x1803f1c31
cdq
add al, 0xbc
add al, 0xe9
sub eax, 0x45fffff7
invalid
invalid
je 0x1803f24fb
add al, 0x3f
sub bl, byte [rdi + 0x6e]
jmp 0x1803f1d05
mov byte [rdi], ch
cli
sar esi, 1
lahf
mov esi, 0x37d8353c
sub ecx, ebp
sub eax, edi
invalid
push rsi
invalid
int1
jmp 0x18db64600
jno 0x1803f25da
paddq mm0, qword [rbp - 0x16fe524c]
invalid
add al, 0x40
or cl, ch
lodsb al, byte [rsi]
cli
invalid
push qword [rsi - 0x32]
jbe 0x1803f25ab
invalid