Function at 0x1400b2600
Capabilities:
Encode data using xor
Get file attributes
Get session user name
Set file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x380]
sub rsp, 0x480
mov rax, qword [0x1402e1040]
xor rax, rsp
mov qword [rbp + 0x370], rax
mov rsi, rcx
xor edi, edi
mov dword [rbp + 0x150], edi
mov dword [rsp + 0x38], 0xf7f022c5
mov dword [rsp + 0x3c], 0xfb9fdca6
mov dword [rsp + 0x40], 0x6d9dd00d
mov dword [rsp + 0x44], 0x3093230
mov dword [rsp + 0x48], 0x7012bdb2
mov dword [rsp + 0x4c], 0xb57c3886
mov dword [rsp + 0x50], 0x68348880
mov dword [rsp + 0x54], 0xb0998d3e
mov dword [rsp + 0x58], 0xc3caff54
mov dword [rsp + 0x5c], 0x49519697
mov dword [rsp + 0x60], 0x381801a9
mov qword [rbp + 0x150], rdi
mov rax, qword [rbp + 0x150]
nop word [rax + rax]
mov rax, qword [rbp + 0x150]
mov rcx, qword [rbp + 0x150]
movzx edx, byte [rsp + rcx + 0x38]
sub dl, byte [rsp + rax + 0x4e]
mov byte [rsp + 0x30], dl
movzx ecx, byte [rsp + 0x30]
mov rax, qword [rbp + 0x150]
mov byte [rbp + rax + 0x180], cl
mov rax, qword [rbp + 0x150]
inc rax
mov qword [rbp + 0x150], rax
mov rax, qword [rbp + 0x150]
cmp rax, 0x16
jb 0x1400b26b0
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xe0], xmm1
mov r8d, reloc.WS2_32.dll_setsockopt
lea rdx, [rbp + 0x180]
lea rcx, [rbp + 0xd0]
call fcn.140049eb0
nop
lea rbx, [rbp + 0xd0]
cmp qword [rbp + 0xe8], 0xf
cmova rbx, qword [rbp + 0xd0]
mov dword [rsp + 0x70], 0x8e1d185d
mov dword [rsp + 0x74], 0x18fe454a
mov dword [rsp + 0x78], 0x5ca5e8cf
mov dword [rsp + 0x7c], 0xb5496f21
mov dword [rbp - 0x80], 0x85491d34
mov dword [rbp - 0x7c], 0x8d31b410
mov dword [rbp - 0x78], 0xcb3dec0
mov dword [rbp - 0x74], 0x7b40ae58
mov dword [rbp - 0x70], 0x7a42323d
mov dword [rbp - 0x6c], 0xea72970f
mov dword [rbp - 0x68], 0xbd7a6229
mov dword [rbp - 0x64], 0xedcc3227
mov dword [rbp - 0x60], 0x5404f3a0
mov dword [rbp - 0x5c], 0xa76181fa
mov dword [rbp - 0x58], 0x8b6c9398
mov dword [rbp - 0x54], 0x7036d8b2
mov dword [rbp - 0x50], 0x37ca1767
mov dword [rbp - 0x4c], 0x554557d7
mov dword [rbp - 0x48], 0x64ce8de5
mov dword [rbp - 0x44], 0x6a6b44e5
mov dword [rbp - 0x40], 0x3c21209d
mov dword [rbp - 0x3c], 0xe4831ea6
mov dword [rbp - 0x38], 0x44e8b0f9
mov dword [rbp - 0x34], 0x4e8723ca
mov dword [rbp - 0x30], 0x1316879b
mov dword [rbp - 0x2c], 0x6cf9e7ce
mov dword [rbp - 0x28], 0xcbe734b6
mov dword [rbp - 0x24], 0x5652fc89
mov dword [rbp - 0x20], 0xadf542cb
mov dword [rbp - 0x1c], 0xa429be47
mov dword [rbp - 0x18], 0x965a5d5a
mov dword [rbp - 0x14], 0xd5318f7d
mov dword [rbp - 0x10], 0x6a45a176
mov dword [rbp - 0xc], 0xe03bef8
mov dword [rbp - 8], 0xb0e981ee
mov dword [rbp - 4], 0xe2eb00a0
mov dword [rbp], 0x429e3b82
mov dword [rbp + 4], 0x46524216
mov dword [rbp + 8], 0xd8a19873
mov dword [rbp + 0xc], 0x2278809c
mov dword [rbp + 0x10], 0x5dfd060
mov dword [rbp + 0x14], 0xde51f181
mov dword [rbp + 0x18], 0xfa8c8b0b
mov dword [rbp + 0x1c], 0x1b20d98c
mov dword [rbp + 0x20], 0xd81fb7b3
mov dword [rbp + 0x24], 0x609fdee0
mov dword [rbp + 0x28], 0xb2f98573
mov dword [rbp + 0x2c], 0xc64cd501
mov dword [rbp + 0x30], 0xa365e4a8
mov dword [rbp + 0x34], 0xa028c653
mov dword [rbp + 0x38], 0xf39a3e6b
mov dword [rbp + 0x3c], 0xdc13cc8e
mov dword [rbp + 0x40], 0xa00122be
mov dword [rbp + 0x44], 0xc8825222
mov dword [rbp + 0x48], 0xe59d15ec
mov dword [rbp + 0x4c], 0x347958d1
mov dword [rbp + 0x50], 0xdaef8bae
mov dword [rbp + 0x54], 0x3734f81d
mov dword [rbp + 0x58], 0x4e260031
mov dword [rbp + 0x5c], 0x12716aa
mov dword [rbp + 0x60], 0x63d688f7
mov dword [rbp + 0x64], 0x6c10d9e3
mov dword [rbp + 0x68], 0x72fbae28
mov dword [rbp + 0x6c], 0x3cfc0624
mov dword [rbp + 0x70], 0x42d7b5be
mov dword [rbp + 0x74], 0x947c0ffe
mov dword [rbp + 0x78], 0x60d67f90
mov dword [rbp + 0x7c], 0x32da24be
mov dword [rbp + 0x80], 0x57f3a818
mov dword [rbp + 0x84], 0x96008d7e
mov dword [rbp + 0x88], 0x1d6286ce
mov dword [rbp + 0x8c], 0x6a0a32ce
mov dword [rbp + 0x90], 0xdf4a87cd
mov dword [rbp + 0x94], 0x1950e29e
mov dword [rbp + 0x98], 0xa213a07
mov dword [rbp + 0x9c], 0x566ec326
mov dword [rbp + 0xa0], 0x8605dd5e
mov dword [rbp + 0xa4], 0x7fee8b5d
mov dword [rbp + 0xa8], 0x3247c90f
mov dword [rbp + 0xac], 0xe7f8696
mov dword [rbp + 0xb0], 0xa4cd3a1b
mov dword [rbp + 0xb4], 0x53dfe4d9
mov dword [rbp + 0xb8], 0x2e6f402b
mov dword [rbp + 0xbc], 0xf2bd0b60
mov dword [rbp + 0xc0], 0xf96bf5b
mov dword [rbp + 0xc4], 0x997decd1
mov dword [rbp + 0xc8], 0x1a95231f
mov word [rbp + 0xcc], 0x20ab
mov qword [rbp + 0x150], rdi
mov rax, qword [rbp + 0x150]
nop word [rax + rax]
mov rax, qword [rbp + 0x150]
mov rcx, qword [rbp + 0x150]
movzx edx, byte [rsp + rcx + 0x70]
sub dl, byte [rbp + rax + 0x1f]
mov byte [rsp + 0x30], dl
movzx ecx, byte [rsp + 0x30]
mov rax, qword [rbp + 0x150]
mov byte [rbp + rax + 0x1b0], cl
mov rax, qword [rbp + 0x150]
inc rax
mov qword [rbp + 0x150], rax
mov rax, qword [rbp + 0x150]
cmp rax, 0xaf
jb 0x1400b2a00
xorps xmm0, xmm0
movups xmmword [rbp + 0x158], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x168], xmm1
mov r8d, 0xae
lea rdx, [rbp + 0x1b0]
lea rcx, [rbp + 0x158]
call fcn.140049eb0
lea rdx, [rbp + 0x158]
cmp qword [rbp + 0x170], 0xf
cmova rdx, qword [rbp + 0x158]
mov r9d, 0x41
mov r8, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ebx, eax
lea rcx, [rbp + 0x158]
call fcn.140063ba0
nop
lea rcx, [rbp + 0xd0]
call fcn.140063ba0
mov rdx, qword [rsi]
cmp ebx, 2
jne 0x1400b2ace
mov dword [rdx], ebx
jmp 0x1400b31ab
movzx edx, byte [rdx + 0x54]
lea rcx, [0x1402e3f30]
call fcn.1400a4db0
mov dword [rbp + 0x180], 0x5ba2f87
mov dword [rbp + 0x184], 0x4571203f
mov dword [rbp + 0x188], 0xa3cb5bfa
mov dword [rbp + 0x18c], 0x442dc225
mov dword [rbp + 0x190], 0xd4a255c7
mov dword [rbp + 0x194], 0xdade03b7
mov dword [rbp + 0x198], 0xc0376215
mov word [rbp + 0x19c], 0x2d4f
mov qword [rbp + 0x150], rdi
mov rax, qword [rbp + 0x150]
nop dword [rax + rax]
mov rax, qword [rbp + 0x150]
mov rcx, qword [rbp + 0x150]
movzx edx, byte [rbp + rcx + 0x180]
sub dl, byte [rbp + rax + 0x18f]
mov byte [rsp + 0x30], dl
movzx ecx, byte [rsp + 0x30]
mov rax, qword [rbp + 0x150]
mov byte [rbp + rax + 0x1a0], cl
mov rax, qword [rbp + 0x150]
inc rax
mov qword [rbp + 0x150], rax
mov rax, qword [rbp + 0x150]
cmp rax, 0xf
jb 0x1400b2b40
xorps xmm0, xmm0
movups xmmword [rbp + 0xf0], xmm0
mov qword [rbp + 0x100], rdi
mov qword [rbp + 0x108], rdi
mov r8d, reloc.WLDAP32.dll_Ordinal_14
lea rdx, [rbp + 0x1a0]
lea rcx, [rbp + 0xf0]
call fcn.140049eb0
lea rax, [rbp + 0xf0]
mov qword [rbp + 0x150], rax
mov rcx, qword [0x1402e38c8]
add rcx, 8
lea rax, [rbp + 0xf0]
cmp rcx, rax
je 0x1400b2c0c
lea rdx, [rbp + 0xf0]
cmp qword [rbp + 0x108], 0xf
cmova rdx, qword [rbp + 0xf0]
mov r8, qword [rbp + 0x100]
call fcn.140063da0
nop
lea rcx, [rbp + 0xf0]
call fcn.140063ba0
mov rdx, qword [rsi + 0x10]
sub rdx, qword [rsi + 8]
sar rdx, 4
mov rax, qword [rsi]
movsxd rcx, dword [rax + 0x50]
cmp rcx, rdx
jae 0x1400b319a
mov dword [rbp + 0x150], 0x104
lea rdx, [rbp + 0x150]
lea rcx, [rbp + 0x260]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea rdx, [rbp + 0x158]
call fcn.14008f300
nop
lea r10, [rbp + 0x260]
mov r9d, edi
movzx r8d, byte [rbp + 0x260]
test r8b, r8b
je 0x1400b2cb8
nop word [rax + rax]
movzx edx, r8b
lea r10, [r10 + 1]
sub r8b, 0x41
lea eax, [rdx + 0x20]
movzx ecx, al
cmp r8b, 0x19
cmova ecx, edx
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx r8d, byte [r10]
test r8b, r8b
jne 0x1400b2c80
lea ecx, [r9 + r9*8]
mov eax, ecx
shr eax, 0xb
xor ecx, eax
imul eax, ecx, 0x8001
lea rcx, str..dat
mov qword [rbp + 0x180], rcx
mov qword [rbp + 0x188], 6
mov dword [rbp + 0x1a8], eax
movabs rax, 0x2000000000000000
mov qword [rbp + 0x1a0], rax
mov qword [rbp + 0xd0], 1
lea rax, [rbp + 0x1a0]
mov qword [rbp + 0xd8], rax
movaps xmm0, xmmword [rbp + 0xd0]
movdqa xmmword [rbp + 0xd0], xmm0
movaps xmm1, xmmword [rbp + 0x180]
movdqa xmmword [rbp + 0x180], xmm1
lea r8, [rbp + 0xd0]
lea rdx, [rbp + 0x180]
lea rcx, [rsp + 0x38]
call fcn.140066280
nop
lea rax, [rsp + 0x38]
cmp qword [rsp + 0x50], 0xf
cmova rax, qword [rsp + 0x38]
mov qword [rbp + 0x180], rax
mov rax, qword [rsp + 0x48]
mov qword [rbp + 0x188], rax
call fcn.140171104
movaps xmm0, xmmword [rbp + 0x180]
movdqa xmmword [rbp + 0x180], xmm0
lea r8, [rbp + 0x180]
mov edx, eax
lea rcx, [rbp + 0xd0]
call fcn.1400489a0
mov r14d, 0xfe
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x158]
call fcn.140048c00
nop
lea rcx, [rbp + 0xd0]
call fcn.140063b30
nop
lea rcx, [rsp + 0x38]
call fcn.140063ba0
lea rdx, [rbp + 0x158]
lea rcx, [rsp + 0x38]
call fcn.140061c30
lea rdx, [rsp + 0x38]
call fcn.14008f720
test al, al
je 0x1400b2ea1
mov rax, qword [rsi]
movsxd rdx, dword [rax + 0x50]
mov rcx, qword [rsi + 8]
mov rax, qword [rsi + 0x10]
sub rax, rcx
sar rax, 4
cmp rax, rdx
jbe 0x1400b31dd
add rdx, rdx
mov rdx, qword [rcx + rdx*8]
add rdx, 0x48
lea rcx, [rbp + 0x110]
call fcn.140062060
mov r14d, 0x2ff
lea r10, [rbp + 0x110]
cmp qword [rbp + 0x128], 0xf
cmova r10, qword [rbp + 0x110]
mov r9d, edi
mov r11, qword [rbp + 0x120]
add r11, r10
cmp r10, r11
je 0x1400b2e84
nop
movzx r8d, byte [r10]
lea edx, [r8 - 0x41]
lea eax, [r8 + 0x20]
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
mov eax, r9d
shr eax, 6
xor r9d, eax
inc r10
cmp r10, r11
jne 0x1400b2e50
lea edx, [r9 + r9*8]
mov eax, edx
shr eax, 0xb
xor edx, eax
mov rcx, qword [rsi]
imul eax, edx, 0x8001
cmp eax, dword [rcx + 0x58]
jne 0x1400b2ea1
xor bl, bl
jmp 0x1400b2ea8
mov bl, 1
test bl, r14b
je 0x1400b2eb4
lea rcx, [rbp + 0x110]
call fcn.140063ba0
test bl, bl
je 0x1400b3172
lea rdx, [rbp + 0x180]
lea rcx, [rbp + 0x158]
call fcn.140048e20
nop
cmp qword [rax + 0x18], 0xf
jbe 0x1400b2eda
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
and ebx, 0xfffffffd
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x158]
call fcn.140048e20
cmp qword [rax + 0x18], 0xf
jbe 0x1400b2f03
mov rax, qword [rax]
mov edx, ebx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rsp + 0x38]
call fcn.140063ba0
nop
lea rcx, [rbp + 0x180]
call fcn.140063ba0
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x158]
call fcn.140048e20
mov rbx, rax
lea rdx, [rbp + 0x180]
mov rcx, qword [0x1402e3638]
call fcn.14004e290
mov r14, rax
mov rcx, qword [rsi]
movsxd rdx, dword [rcx + 0x50]
mov r8, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
sub rcx, r8
sar rcx, 4
cmp rcx, rdx
jbe 0x1400b31e3
add rdx, rdx
mov rdx, qword [r8 + rdx*8]
add rdx, 0x48
lea rcx, [rsp + 0x38]
call fcn.140062060
nop
mov qword [rsp + 0x28], rdi
lea rax, [0x1400b3450]
mov qword [rsp + 0x20], rax
mov r9, rbx
mov r8, r14
lea rdx, [rsp + 0x38]
call fcn.140082370
movzx r15d, al
lea rcx, [rsp + 0x38]
call fcn.140063ba0
nop
mov rbx, qword [rbp + 0x180]
test rbx, rbx
je 0x1400b3041
mov r14, qword [rbp + 0x188]
cmp rbx, r14
je 0x1400b2ff1
nop
lea rcx, [rbx + 0x20]
call fcn.140063ba0
mov rcx, rbx
call fcn.140063ba0
add rbx, 0x40
cmp rbx, r14
jne 0x1400b2fd0
mov rbx, qword [rbp + 0x180]
mov rdx, qword [rbp + 0x190]
sub rdx, rbx
and rdx, 0xffffffffffffffc0
mov rax, rbx
cmp rdx, 0x1000
jb 0x1400b3027
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400b3027
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.140172064
mov qword [rbp + 0x180], rdi
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x188], xmm0
lea rcx, [rbp + 0xd0]
call fcn.140063ba0
test r15b, r15b
je 0x1400b3172
lea rdx, [rbp + 0x180]
lea rcx, [rbp + 0x158]
call fcn.140048e20
nop
cmp qword [rax + 0x18], 0xf
jbe 0x1400b3074
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
or ebx, 2
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x158]
call fcn.140048e20
cmp qword [rax + 0x18], 0xf
jbe 0x1400b309d
mov rax, qword [rax]
mov edx, ebx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rsp + 0x38]
call fcn.140063ba0
nop
lea rcx, [rbp + 0x180]
call fcn.140063ba0
mov rax, qword [rsi]
movsxd rdx, dword [rax + 0x50]
mov rcx, qword [rsi + 8]
mov rax, qword [rsi + 0x10]
sub rax, rcx
sar rax, 4
cmp rax, rdx
jbe 0x1400b31d7
add rdx, rdx
mov rdx, qword [rcx + rdx*8]
add rdx, 0x48
lea rcx, [rbp + 0x130]
call fcn.140062060
lea r9, [rbp + 0x130]
cmp qword [rbp + 0x148], 0xf
cmova r9, qword [rbp + 0x130]
mov r10, qword [rbp + 0x140]
add r10, r9
cmp r9, r10
je 0x1400b3150
nop dword [rax + rax]
movzx r8d, byte [r9]
lea edx, [r8 - 0x41]
lea eax, [r8 + 0x20]
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movsx eax, cl
add eax, edi
imul edi, eax, 0x401
mov eax, edi
shr eax, 6
xor edi, eax
inc r9
cmp r9, r10
jne 0x1400b3120
lea ecx, [rdi + rdi*8]
mov eax, ecx
shr eax, 0xb
xor ecx, eax
imul ecx, ecx, 0x8001
mov rax, qword [rsi]
mov dword [rax + 0x58], ecx
lea rcx, [rbp + 0x130]
call fcn.140063ba0
lea rdx, [rbp + 0x158]
lea rcx, [rsp + 0x38]
call fcn.140061c30
lea rdx, [rsp + 0x38]
call fcn.1400a59b0
nop
lea rcx, [rbp + 0x158]
call fcn.140063b30
mov rcx, qword [rsi]
call fcn.1400ad8a0
mov rax, qword [rsi]
mov dword [rax], 2
mov rcx, qword [rbp + 0x370]
xor rcx, rsp
call fcn.140171bd0
lea r11, [rsp + 0x480]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.1400630d0
nop
call fcn.1400630d0
nop
call fcn.1400630d0
int3