Function at 0x1400d5310
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
test rdx, rdx
je 0x1400d5451
mov rbx, rdx
mov eax, dword [0x141dd7140]
imul eax, dword [0x141dd7144]
imul eax, eax, 0x2f12cf87
or eax, 0xc0cec804
and eax, 0xd5efdb4c
cmp eax, 0x3e63ad4b
jae 0x1400d5358
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
mov rdi, qword [sym.imp.ADVAPI32.dll_IsValidSid]
nop
mov eax, dword [0x141dd7148]
xor edx, edx
div dword [0x141dd714c]
imul eax, eax, 0xb614ab02
add eax, 0xa1c68933
imul r14, rax, 0x4f056c51
shr r14, 0x39
mov rcx, rbx
call rdi
cmp r14d, 0x333f16d2
ja 0x1400d5360
mov ecx, eax
nop word cs:[rax + rax]
mov eax, dword [0x141dd7150]
add eax, dword [0x141dd7154]
imul eax, eax, 0xf2c97302
imul rax, rax, 0x7d8706a7
shr rax, 0x3e
cmp eax, 0x5f9ca7d2
je 0x1400d53a0
nop word cs:[rax + rax]
mov eax, dword [0x141dd7158]
xor edx, edx
div dword [0x141dd715c]
xor eax, 0x430a0502
or eax, 0xb4b12ae5
cmp eax, 0x80ef181d
jb 0x1400d53d0
test ecx, ecx
je 0x1400d5463
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov ebp, eax
mov r14d, eax
nop word cs:[rax + rax]
mov eax, dword [0x141dd7168]
and eax, dword [0x141dd716c]
imul rcx, rax, 0x1214f68f
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1f
imul eax, eax, 0x1de9d02c
add eax, 0xe618fd77
cmp eax, 0x141ebf28
jb 0x1400d5410
test ebp, ebp
je 0x1400d5495
xor eax, eax
test al, al
je 0x1400d54bb
jmp 0x1400d54e6
movabs rax, 0x8000000000000000
mov qword [rsi], rax
jmp 0x1400d59ca
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov eax, dword [0x141dd7160]
xor edx, edx
div dword [0x141dd7164]
imul eax, eax, 0x6bd28ea0
xor eax, 0xddb5ab4e
cmp eax, 0x9bc2660e
jb 0x1400d5470
jmp 0x1400d59ca
mov eax, dword [0x141dd7190]
xor eax, dword [0x141dd7194]
add eax, 0x81f0caa8
xor eax, 0x8162497d
cmp eax, 0x42067774
jbe 0x1400d55b1
jmp 0x1400d55db
mov eax, dword [0x141dd7170]
xor edx, edx
div dword [0x141dd7174]
imul r15d, eax, 0x57160a3b
mov ecx, 8
mov rdx, r14
call fcn.1400bf230
cmp r15d, 0x8089e14e
jne 0x1400d54f5
mov ecx, 8
mov rdx, r14
call fcn.1400bf230
jmp 0x1400d54bb
mov rdi, rax
nop dword [rax + rax]
mov eax, dword [0x141dd7178]
or eax, dword [0x141dd717c]
imul eax, eax, 0x90e2bb9c
add eax, 0x798ada80
or eax, 0xc10269b8
cmp eax, 0x9af22f50
jb 0x1400d5500
nop word cs:[rax + rax]
mov eax, dword [0x141dd7180]
sub eax, dword [str.geme]
add eax, 0x452e4dfa
and eax, 0x951a6e97
cmp eax, 0x57d4e9b9
je 0x1400d5530
test rdi, rdi
je 0x1400d558c
mov eax, dword [0x141dd71c0]
or eax, dword [0x141dd71c4]
imul rcx, rax, 0x172f33d9
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
xor ecx, ecx
bt eax, 0x1e
adc ecx, 0x92bccc17
cmp ecx, 0x85c835e8
jae 0x1400d574b
jmp 0x1400d5787
ud2
mov edi, dword [0x141dd7198]
xor edi, dword [0x141dd719c]
xor edi, 0x6406fa1c
mov edx, 1
xor ecx, ecx
mov r8, rbx
call qword [sym.imp.ADVAPI32.dll_CopySid]
cmp edi, 0x4e9d1d1c
jae 0x1400d55ed
mov edx, 1
xor ecx, ecx
mov r8, rbx
call qword [sym.imp.ADVAPI32.dll_CopySid]
jmp 0x1400d55b1
test eax, eax
jne 0x1400d56ce
mov eax, dword [0x141dd71a0]
xor edx, edx
div dword [0x141dd71a4]
add eax, 0xc8692302
and eax, 0x724beb0b
cmp eax, 0xc14569f3
jne 0x1400d561a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop word cs:[rax + rax]
mov eax, dword [0x141dd71a8]
and eax, dword [0x141dd71ac]
xor eax, 0xfca20350
imul eax, eax, 0x24dc6182
imul rbx, rax, 0x7d29171f
shr rbx, 0x3e
call rdi
cmp ebx, 0xcbb70061
ja 0x1400d5630
movabs rax, 0x8000000000000000
mov ecx, dword [0x141dd71b0]
or ecx, dword [0x141dd71b4]
or ecx, 0xc9dc1452
mov edx, 0xc82199c1
imul rdx, rcx
shr rdx, 0x3e
and edx, 0xfffffffe
cmp edx, 0xc78a01e1
jbe 0x1400d56a0
mov qword [rsi], rax
nop word cs:[rax + rax]
mov ecx, dword [0x141dd71b8]
and ecx, dword [0x141dd71bc]
xor ecx, 0xb2022a08
and ecx, 0xbfeabe48
add ecx, 0xbae7b82a
mov qword [rsi], rax
cmp ecx, 0xca965877
jbe 0x1400d56a0
jmp 0x1400d59ca
mov eax, dword [0x141dd7200]
and eax, dword [0x141dd7204]
imul eax, eax, 0xabdbed5b
imul rax, rax, 0x6ced935f
shr rax, 0x3e
imul eax, eax, 0xb96cbc3f
cmp eax, 0xf410809a
jne 0x1400d56fa
ud2
mov eax, dword [0x141dd7208]
xor eax, dword [0x141dd720c]
xor eax, 0x24112f22
and eax, 0x2591af36
ud2
mov eax, dword [0x141dd71c8]
imul eax, dword [0x141dd71cc]
imul eax, eax, 0xb9e97c19
imul r15, rax, 0x9125301
shr r15, 0x3b
or r15d, 0xe5dfba52
mov ecx, ebp
mov rdx, rdi
mov r8, rbx
call qword [sym.imp.ADVAPI32.dll_CopySid]
cmp r15d, 0xf9eb985
jae 0x1400d5797
mov ecx, ebp
mov rdx, rdi
mov r8, rbx
call qword [sym.imp.ADVAPI32.dll_CopySid]
jmp 0x1400d574b
mov ecx, 0xd2b63b83
nop dword [rax]
mov edx, dword [0x141dd71d0]
add edx, dword [0x141dd71d4]
imul rdx, rcx
shr rdx, 0x3f
imul edx, edx, 0x63fcc604
cmp edx, 0x40413774
ja 0x1400d57a0
test eax, eax
je 0x1400d58b1
movzx eax, byte [rdi]
xor ecx, ecx
nop
test cl, cl
jne 0x1400d57d0
nop word cs:[rax + rax]
mov ecx, dword [0x141dd71f8]
imul ecx, dword [0x141dd71fc]
imul ecx, ecx, 0xb4b68e93
or ecx, 0x80d1861b
imul ecx, ecx, 0x8df7e07b
cmp ecx, 0xc7f25ed1
je 0x1400d57e0
cmp al, 1
jne 0x1400d58f9
mov eax, dword [0x141dd7218]
xor edx, edx
div dword [0x141dd721c]
mov ecx, 0xc0e9afa5
imul rcx, rax
shr rcx, 0x3c
or ecx, 0x5bf0ad7c
and ecx, 0x5bf0ad7e
cmp ecx, 0x3c4c9386
jne 0x1400d5850
mov qword [rsi], r14
nop word cs:[rax + rax]
mov eax, dword [0x141dd7220]
add eax, dword [0x141dd7224]
or eax, 0xb4bf708f
imul rax, rax, 0x2aa0f357
shr rax, 0x3d
or eax, 0x24e6e2d8
mov qword [rsi], r14
cmp eax, 0x13d97fdc
jb 0x1400d5850
nop dword [rax + rax]
mov eax, dword [0x141dd7228]
or eax, dword [0x141dd722c]
imul eax, eax, 0x941e94e3
or eax, 0x38569b2
imul eax, eax, 0x858560d
cmp eax, 0xed03a20d
ja 0x1400d5880
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], r14
jmp 0x1400d59ca
mov eax, dword [0x141dd71d8]
sub eax, dword [str.e_MjC]
imul eax, eax, 0xb175f7de
and eax, 0xddec614c
cmp eax, 0x36238a79
jne 0x1400d58d5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rbx, qword [sym.imp.KERNEL32.dll_GetLastError]
xor ebp, ebp
nop
call rbx
test bpl, bpl
jne 0x1400d58e0
movabs rax, 0x8000000000000000
xor ecx, ecx
test cl, cl
je 0x1400d5931
jmp 0x1400d5961
ud2
mov ecx, dword [0x141dd71e0]
add ecx, dword [0x141dd71e4]
imul ecx, ecx, 0x75ac7a1e
add ecx, 0xde0e6d20
xor ecx, 0x684af4b
mov qword [rsi], rax
mov rbx, qword [0x141dda6a0]
cmp ecx, 0x4aa3da1b
jbe 0x1400d596d
mov qword [rsi], rax
mov rcx, qword [0x141dda6a0]
jmp 0x1400d5931
mov eax, dword [0x141dd71e8]
add eax, dword [0x141dd71ec]
or eax, 0x659ded82
cmp eax, 0xe14110cc
jne 0x1400d5993
mov rcx, rbx
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rsi, qword [sym.imp.KERNEL32.dll_HeapFree]
nop word [rax + rax]
mov ebp, dword [0x141dd71f0]
or ebp, dword [0x141dd71f4]
add ebp, 0x6d0c4dc4
or ebp, 0xa0b02e14
mov rcx, rbx
xor edx, edx
mov r8, rdi
call rsi
cmp ebp, 0xfb6be5ec
jae 0x1400d59a0
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret