Function at 0x1400d4120
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r14, rdx
mov rsi, rcx
nop word cs:[rax + rax]
mov eax, dword [0x141dd4ca8]
xor eax, dword [0x141dd4cac]
add eax, 0x137c2c8a
and eax, 0xdaafb372
imul rax, rax, 0x2bb7bd79
shr rax, 0x3b
cmp eax, 0x3359976f
ja 0x1400d4140
nop dword [rax + rax]
mov eax, dword [0x141dd4cb0]
add eax, dword [0x141dd4cb4]
and eax, 0xe3b88e6
cmp eax, 0x4743c8db
je 0x1400d4170
test r14, r14
je 0x1400d41b1
mov eax, dword [0x141dd4cb8]
xor eax, dword [0x141dd4cbc]
add eax, 0xaab3e77d
or eax, 0xdc8202b5
add eax, 0xe930a328
cmp eax, 0xa226592c
jae 0x1400d41c3
jmp 0x1400d41d2
movabs rax, 0x8000000000000000
mov qword [rsi], rax
jmp 0x1400d46da
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
xor ecx, ecx
test cl, cl
je 0x1400d41dd
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
jmp 0x1400d41c3
test eax, eax
je 0x1400d4236
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov ebp, eax
mov edi, eax
nop
mov eax, dword [0x141dd4cc0]
sub eax, dword [0x141dd4cc4]
imul eax, eax, 0xeea607bf
add eax, 0x74e70581
and eax, 0x13418a57
cmp eax, 0x21ab2d37
ja 0x1400d41f0
test ebp, ebp
je 0x1400d4259
mov eax, dword [0x141dd4cc8]
and eax, dword [0x141dd4ccc]
add eax, 0x419e85cc
and eax, 0x8ec65bc6
cmp eax, 0x877b296a
jne 0x1400d4281
jmp 0x1400d42b3
movabs rax, 0x8000000000000000
mov qword [rsi], rax
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x1400d4250
jmp 0x1400d46da
mov eax, dword [0x141dd4cd8]
xor edx, edx
div dword [0x141dd4cdc]
or eax, 0x15d7f470
add eax, 0x834e6b32
cmp eax, 0x1be6ddf8
jae 0x1400d44d8
jmp 0x1400d450e
mov r15d, dword [0x141dd4cd0]
and r15d, dword [0x141dd4cd4]
add r15d, 0x54b20b41
or r15d, 0xd16a7a50
mov ecx, 8
mov rdx, rdi
call fcn.1400beea0
cmp r15d, 0x4a7bf758
jne 0x1400d42c2
mov ecx, 8
mov rdx, rdi
call fcn.1400beea0
jmp 0x1400d4281
mov rbx, rax
test rax, rax
je 0x1400d44d6
mov ecx, ebp
mov rdx, rbx
mov r8, r14
call qword [sym.imp.ADVAPI32.dll_CopySid]
xor ecx, ecx
nop
test cl, cl
jne 0x1400d42e0
mov ecx, 0xeb89aaed
nop dword [rax]
mov edx, dword [0x141dd4d08]
sub edx, dword [0x141dd4d0c]
and edx, 0xc597a515
imul rdx, rcx
shr rdx, 0x3f
or edx, 0xe8894e9e
cmp edx, 0xb11a1718
jb 0x1400d42f0
test eax, eax
je 0x1400d445c
mov eax, dword [0x141dd4d38]
imul eax, dword [0x141dd4d3c]
add eax, 0x43f3e18c
cmp eax, 0x7a7d903
jb 0x1400d4320
movzx eax, byte [rbx]
nop dword [rax]
mov ecx, dword [0x141dd4d40]
or ecx, dword [0x141dd4d44]
and ecx, 0x1e68bdc
add ecx, 0xd3ef0462
cmp ecx, 0x50897dcb
jb 0x1400d4340
mov ecx, 0x870b2707
nop word cs:[rax + rax]
mov edx, dword [0x141dd4d48]
or edx, dword [0x141dd4d4c]
add edx, 0xde26c635
imul rdx, rcx
shr rdx, 0x3d
or edx, 0xfda04910
cmp edx, 0x1ab7d3b5
jb 0x1400d4370
cmp al, 1
jne 0x1400d4488
mov qword [rsi], rdi
mov eax, dword [0x141dd4d58]
imul eax, dword [0x141dd4d5c]
imul eax, eax, 0xd5e08b9d
add eax, 0xa1bffd4a
shr eax, 3
imul rax, rax, 0x22a8d89b
shr rax, 0x3a
cmp eax, 0x26b49aa9
jbe 0x1400d43e0
mov qword [rsi + 8], rbx
nop word cs:[rax + rax]
mov eax, dword [0x141dd4d60]
or eax, dword [0x141dd4d64]
imul eax, eax, 0xedeee2c4
imul rax, rax, 0x42f572db
shr rax, 0x3d
mov qword [rsi + 8], rbx
cmp eax, 0x5701de9a
ja 0x1400d43e0
mov eax, dword [0x141dd4d68]
and eax, dword [0x141dd4d6c]
xor eax, 0xfb0bd6db
imul eax, eax, 0x2a1db28d
cmp eax, 0x1ea53bd7
jne 0x1400d4430
mov qword [rsi + 0x10], rdi
nop word [rax + rax]
mov eax, dword [0x141dd4d70]
or eax, dword [0x141dd4d74]
and eax, 0x6e96d8cb
imul eax, eax, 0x9608dfef
or eax, 0x1e900561
mov qword [rsi + 0x10], rdi
cmp eax, 0xdc2516c1
je 0x1400d4430
jmp 0x1400d46da
mov eax, dword [0x141dd4d10]
sub eax, dword [0x141dd4d14]
xor eax, 0x6576f071
imul eax, eax, 0x42cb84ed
xor eax, 0x4fc9d3df
cmp eax, 0x56ca18a6
jae 0x1400d4600
jmp 0x1400d462c
mov eax, dword [0x141dd4d78]
sub eax, dword [0x141dd4d7c]
xor eax, 0xd8521574
imul eax, eax, 0x2ccf1c93
add eax, 0x540af32b
cmp eax, 0x73a70dfc
jae 0x1400d44ad
ud2
mov eax, 0xc15b0085
mov ecx, dword [0x141dd4d80]
and ecx, dword [0x141dd4d84]
xor ecx, 0xa11d9267
imul rcx, rax
shr rcx, 0x3e
ud2
ud2
mov edi, dword [0x141dd4ce0]
add edi, dword [str.g_a_TN4]
and edi, 0xe1a45ba4
add edi, 0x285cb30
xor edi, 0x716b21f9
mov edx, 1
xor ecx, ecx
mov r8, r14
call qword [sym.imp.ADVAPI32.dll_CopySid]
cmp edi, 0xd325068f
jbe 0x1400d4520
mov edx, 1
xor ecx, ecx
mov r8, r14
call qword [sym.imp.ADVAPI32.dll_CopySid]
jmp 0x1400d44d8
test eax, eax
jne 0x1400d4544
mov eax, dword [0x141dd4ce8]
or eax, dword [0x141dd4cec]
imul eax, eax, 0x7b933300
add eax, 0x20add65
cmp eax, 0x7ee0528a
jbe 0x1400d4578
jmp 0x1400d45a8
ud2
mov eax, dword [0x141dd4cf0]
xor edx, edx
div dword [0x141dd4cf4]
mov edi, eax
add edi, 0xe40ffb36
or edi, 0x4bde41e0
xor edi, 0x6bfb8e13
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp edi, 0xbe44fdef
jbe 0x1400d45b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400d4578
movabs rax, 0x8000000000000000
mov ecx, dword [0x141dd4cf8]
sub ecx, dword [0x141dd4cfc]
add ecx, 0x9eee1a7e
cmp ecx, 0xc03c48ca
ja 0x1400d45fb
mov ecx, dword [0x141dd4d00]
xor ecx, dword [str.TYxVsF3]
xor ecx, 0x2704080c
or ecx, 0x58eb71f1
mov qword [rsi], rax
cmp ecx, 0x29f2ecc0
jne 0x1400d46da
mov qword [rsi], rax
jmp 0x1400d45d4
mov edi, dword [0x141dd4d18]
or edi, dword [0x141dd4d1c]
add edi, 0xc74d72c2
or edi, 0x565eb33e
add edi, 0x893bf498
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp edi, 0x6ded4b5
jae 0x1400d4634
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400d4600
movabs rdi, 0x8000000000000000
mov eax, dword [0x141dd4d20]
and eax, dword [0x141dd4d24]
xor eax, 0x7140802
and eax, 0x2f970902
imul eax, eax, 0xcaed3cfc
cmp eax, 0x544361f7
ja 0x1400d469a
mov eax, dword [0x141dd4d28]
sub eax, dword [0x141dd4d2c]
add eax, 0xade73cff
xor eax, 0xbf53dccf
imul ebp, eax, 0x3feb4e0f
mov qword [rsi], rdi
mov rcx, qword [0x141dd7fe0]
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp ebp, 0x4a34855c
jbe 0x1400d46c0
mov qword [rsi], rdi
mov rcx, qword [0x141dd7fe0]
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1400d4661
mov eax, dword [0x141dd4d30]
imul eax, dword [0x141dd4d34]
imul eax, eax, 0x9a9fe919
cmp eax, 0xf69f38e
je 0x1400d46c0
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret