Function at 0x1400d5390
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
test rdx, rdx
je 0x1400d549d
mov r14, rdx
mov eax, dword [0x141dd7c30]
sub eax, dword [0x141dd7c34]
add eax, 0x965cbce7
or eax, 0xa9052c23
imul eax, eax, 0x536daf87
cmp eax, 0xed4bd83c
jbe 0x1400d53d7
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
mov rbx, qword [sym.imp.ADVAPI32.dll_IsValidSid]
nop
mov eax, dword [0x141dd7c38]
xor edx, edx
div dword [0x141dd7c3c]
mov edi, eax
mov rcx, r14
call rbx
cmp edi, 0x22782951
je 0x1400d53e0
test eax, eax
je 0x1400d54d8
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov ebp, eax
mov eax, 0x90367ba1
mov ebx, ebp
nop word [rax + rax]
mov ecx, dword [0x141dd7c60]
or ecx, dword [0x141dd7c64]
imul rcx, rax
shr rcx, 0x3d
and ecx, 1
or ecx, 0x4c73b9c8
cmp ecx, 0xc00cd82f
ja 0x1400d5420
nop word cs:[rax + rax]
mov eax, dword [0x141dd7c68]
sub eax, dword [0x141dd7c6c]
or eax, 0x8a315f81
and eax, 0xceb15fb7
cmp eax, 0xd847ff9d
je 0x1400d5450
test ebp, ebp
je 0x1400d550b
mov eax, dword [0x141dd7c70]
mov ecx, dword [0x141dd7c74]
add eax, ecx
add eax, 0x68f4fa0e
or eax, 0xe31f25dd
cmp eax, 0xe0c6054f
jne 0x1400d5658
jmp 0x1400d5691
movabs rax, 0x8000000000000000
mov qword [rsi], rax
nop word [rax + rax]
mov eax, dword [0x141dd7c28]
sub eax, dword [0x141dd7c2c]
imul rax, rax, 0x5b582b3
shr rax, 0x3a
add eax, 0x88b9303
cmp eax, 0xb6e8c2f2
ja 0x1400d54b0
jmp 0x1400d55d0
mov ecx, dword [0x141dd7c48]
xor ecx, dword [0x141dd7c4c]
movabs rax, 0x8000000000000000
imul ecx, ecx, 0x30123de
add ecx, 0xe64591
cmp ecx, 0x91ad9f38
jae 0x1400d5600
jmp 0x1400d5628
mov edx, 1
xor ecx, ecx
mov r8, r14
call qword [sym.imp.ADVAPI32.dll_CopySid]
nop dword [rax + rax]
mov ecx, dword [0x141dd7ca8]
sub ecx, dword [0x141dd7cac]
add ecx, 0xaef402ce
xor ecx, 0x800002a
and ecx, 0x7a01a23f
cmp ecx, 0x6fe55b1c
je 0x1400d5520
xor ecx, ecx
nop dword [rax + rax]
test cl, cl
jne 0x1400d5550
test eax, eax
jne 0x1400d5595
call qword [sym.imp.KERNEL32.dll_GetLastError]
movabs rax, 0x8000000000000000
mov qword [rsi], rax
nop dword [rax + rax]
mov eax, dword [0x141dd7cb0]
and eax, dword [0x141dd7cb4]
or eax, 0x508ee832
imul eax, eax, 0x61183962
add eax, 0x8995b8c2
cmp eax, 0x783ac28e
ja 0x1400d5570
jmp 0x1400d55d0
mov eax, dword [0x141dd7cf8]
imul eax, dword [0x141dd7cfc]
imul eax, eax, 0xf8614523
add eax, 0x4aa6ad6b
and eax, 0xa376a56b
cmp eax, 0x96c9d26
jne 0x1400d5a12
jmp 0x1400d5a1a
mov eax, dword [0x141dd7c40]
sub eax, dword [0x141dd7c44]
imul rax, rax, 0x28246769
shr rax, 0x3c
add eax, 0x95bfc341
cmp eax, 0xe8bed996
ja 0x1400d55d0
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, dword [0x141dd7c50]
or ecx, dword [0x141dd7c54]
imul rcx, rcx, 0x40171cfb
shr rcx, 0x3e
imul ecx, ecx, 0x2ee05378
mov qword [rsi], rax
cmp ecx, 0xc8423be6
jbe 0x1400d5630
mov qword [rsi], rax
jmp 0x1400d5600
mov eax, dword [0x141dd7c58]
add eax, dword [0x141dd7c5c]
imul eax, eax, 0xd0d4e316
add eax, 0x5aadd737
and eax, 0x8cc04ac2
cmp eax, 0x2a33bdfd
jbe 0x1400d5630
jmp 0x1400d55d0
mov eax, dword [0x141dd7c78]
xor edx, edx
div dword [0x141dd7c7c]
imul r15d, eax, 0xe41c195a
add r15d, 0xbf4e2464
and r15d, 0x9b5644e
mov ecx, 8
mov rdx, rbx
call fcn.1400c0180
cmp r15d, 0x1642d816
jbe 0x1400d56a0
mov ecx, 8
mov rdx, rbx
call fcn.1400c0180
jmp 0x1400d5658
mov rdi, rax
mov eax, dword [0x141dd7c80]
xor edx, edx
div dword [0x141dd7c84]
nop word cs:[rax + rax]
mov eax, dword [0x141dd7c88]
and eax, dword [0x141dd7c8c]
and eax, 0x15301a81
add eax, 0x948f2062
cmp eax, 0xe8e712e0
ja 0x1400d56c0
test rdi, rdi
je 0x1400d58f6
mov ecx, ebp
mov rdx, rdi
mov r8, r14
call qword [sym.imp.ADVAPI32.dll_CopySid]
nop word cs:[rax + rax]
mov ecx, dword [0x141dd7cb8]
xor ecx, dword [0x141dd7cbc]
xor ecx, 0x763b790a
add ecx, 0x9fa365ae
and ecx, 0x69acd9a1
cmp ecx, 0x5a1de578
ja 0x1400d5700
test eax, eax
je 0x1400d5836
movzx eax, byte [rdi]
nop word cs:[rax + rax]
mov ecx, dword [0x141dd7cf0]
xor ecx, dword [0x141dd7cf4]
and ecx, 0x9ce0fa68
xor ecx, 0x5e326e72
add ecx, 0xf00d6994
cmp ecx, 0xb986d919
ja 0x1400d5740
cmp al, 1
jne 0x1400d58cb
mov eax, dword [0x141dd7d08]
or eax, dword [0x141dd7d0c]
add eax, 0x88655524
shr eax, 1
imul rax, rax, 0x615c313d
shr rax, 0x38
or eax, 0x1c701c84
cmp eax, 0x3db2fadc
jne 0x1400d57a0
mov qword [rsi], rbx
nop dword [rax + rax]
mov eax, dword [0x141dd7d10]
and eax, dword [0x141dd7d14]
or eax, 0x92f7cf9f
mov qword [rsi], rbx
cmp eax, 0x7956c1d3
je 0x1400d57a0
nop dword [rax + rax]
mov eax, dword [0x141dd7d18]
sub eax, dword [0x141dd7d1c]
add eax, 0x807f42b3
or eax, 0x2e4e9bfa
cmp eax, 0x1a6810de
jb 0x1400d57c0
mov eax, dword [0x141dd7d20]
xor eax, dword [0x141dd7d24]
xor eax, 0xaff1691
add eax, 0xbf65a808
cmp eax, 0x23e92fd4
jae 0x1400d5810
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], rbx
nop word cs:[rax + rax]
mov eax, dword [0x141dd7d28]
xor eax, dword [0x141dd7d2c]
imul eax, eax, 0x83008c40
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], rbx
cmp eax, 0x43706c81
jbe 0x1400d5810
jmp 0x1400d55d0
mov eax, dword [0x141dd7cc0]
imul eax, dword [0x141dd7cc4]
add eax, 0x50e8646
or eax, 0xffbffdee
cmp eax, 0x951dada5
jae 0x1400d585a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rbx, qword [sym.imp.KERNEL32.dll_GetLastError]
nop word cs:[rax + rax]
mov eax, dword [0x141dd7cc8]
sub eax, dword [0x141dd7ccc]
imul ebp, eax, 0xb76ec4a4
add ebp, 0x5371efcd
and ebp, 0x5a8ff7dc
call rbx
cmp ebp, 0x89db3336
ja 0x1400d5870
mov ecx, dword [0x141dd7cd0]
xor ecx, dword [0x141dd7cd4]
movabs rax, 0x8000000000000000
add ecx, 0x629b4785
or ecx, 0xf975eebf
cmp ecx, 0x17253950
jne 0x1400d596f
jmp 0x1400d599e
ud2
mov eax, dword [0x141dd7c90]
or eax, dword [0x141dd7c94]
imul eax, eax, 0x9a6bf3f5
xor eax, 0x600e004
or eax, 0x99be109b
cmp eax, 0x586adc96
jb 0x1400d593e
mov eax, dword [0x141dd7c98]
add eax, dword [0x141dd7c9c]
and eax, 0x1048a111
or eax, 0xee9758ee
imul eax, eax, 0x8e5c9f21
ud2
ud2
mov ecx, dword [0x141dd7cd8]
imul ecx, dword [0x141dd7cdc]
imul ecx, ecx, 0xff0ad39f
and ecx, 0x4cce028d
imul rcx, rcx, 0x7d84229f
shr rcx, 0x3c
mov qword [rsi], rax
cmp ecx, 0x5420f2d4
jbe 0x1400d59a3
mov qword [rsi], rax
jmp 0x1400d596f
mov eax, dword [str.feUrZE_aH]
add eax, dword [0x141dd7ce4]
or eax, 0x10800101
and eax, 0x11900101
cmp eax, 0xfc9f52fa
jne 0x1400d59d2
mov rcx, qword [0x141ddb260]
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rsi, qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax]
mov eax, dword [0x141dd7ce8]
xor eax, dword [0x141dd7cec]
or eax, 0x43b2f4d9
imul ebx, eax, 0x5eb7e925
mov rcx, qword [0x141ddb260]
xor edx, edx
mov r8, rdi
call rsi
cmp ebx, 0x77ceef84
je 0x1400d59e0
jmp 0x1400d55d0
ud2
ud2