Function at 0x14009ede0
Capabilities:
Encode data using xor
Get file attributes
Get session user name
Set file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1e0]
sub rsp, 0x2e0
mov rax, qword [0x1402b3030]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
mov rsi, rcx
xor r13d, r13d
mov dword [rbp - 0x80], r13d
movzx edx, byte [0x1402b54a8]
lea rcx, [0x1402b5af4]
call fcn.140094620
mov dword [rsp + 0x40], 0xe69cc0c
mov dword [rsp + 0x44], 0x9ed117ae
mov dword [rsp + 0x48], 0xfa536e77
mov dword [rsp + 0x4c], 0xc9dd7115
mov dword [rsp + 0x50], 0x43ab0464
mov dword [rsp + 0x54], 0x573763ae
mov dword [rsp + 0x58], 0xb08eea28
mov word [rsp + 0x5c], 0xddfe
mov qword [rsp + 0x38], r13
mov rax, qword [rsp + 0x38]
nop
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x38]
movzx edx, byte [rsp + rcx + 0x40]
sub dl, byte [rsp + rax + 0x4f]
mov byte [rsp + 0x30], dl
movzx ecx, byte [rsp + 0x30]
mov rax, qword [rsp + 0x38]
mov byte [rbp + rax + 0xb0], cl
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp rax, 0xf
jb 0x14009ee80
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp], r13
mov qword [rbp + 8], r13
mov r8d, reloc.WLDAP32.dll_Ordinal_14
lea rdx, [rbp + 0xb0]
lea rcx, [rbp - 0x10]
call fcn.14006a3d0
lea rax, [rbp - 0x10]
mov qword [rsp + 0x38], rax
mov rcx, qword [0x1402b5480]
add rcx, 8
lea rax, [rbp - 0x10]
cmp rcx, rax
je 0x14009ef1a
lea rdx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rdx, qword [rbp - 0x10]
mov r8, qword [rbp]
call fcn.14005ef20
nop
lea rcx, [rbp - 0x10]
call fcn.14005ec80
mov rcx, qword [rsi + 0x10]
sub rcx, qword [rsi + 8]
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 6
mov rax, rdx
shr rax, 0x3f
add rdx, rax
movsxd rax, dword [0x1402b54b8]
cmp rax, rdx
jae 0x14009f5a4
mov dword [rbp + 0xa8], 0x104
lea rdx, [rbp + 0xa8]
lea rcx, [rbp + 0xc0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea rdx, [rbp + 0x88]
call fcn.14007ee90
nop
lea r10, [rbp + 0xc0]
mov r9d, r13d
movzx r8d, byte [rbp + 0xc0]
test r8b, r8b
je 0x14009efd8
nop dword [rax + rax]
movzx edx, r8b
lea r10, [r10 + 1]
sub r8b, 0x41
lea eax, [rdx + 0x20]
movzx ecx, al
cmp r8b, 0x19
cmova ecx, edx
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx r8d, byte [r10]
test r8b, r8b
jne 0x14009efa0
lea ecx, [r9 + r9*8]
mov eax, ecx
shr eax, 0xb
xor ecx, eax
imul eax, ecx, 0x8001
mov dword [rbp + 0x18], eax
movabs rax, 0x2000000000000000
mov qword [rbp + 0x10], rax
mov qword [rbp - 0x70], 1
lea rax, [rbp + 0x10]
mov qword [rbp - 0x68], rax
lea rax, str..dat
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 6
movaps xmm0, xmmword [rbp - 0x70]
movdqa xmmword [rbp - 0x70], xmm0
movaps xmm1, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm1
lea r8, [rbp - 0x70]
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x30]
call fcn.140062280
nop
lea rax, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rax, qword [rbp - 0x30]
mov qword [rbp - 0x50], rax
mov rax, qword [rbp - 0x20]
mov qword [rbp - 0x48], rax
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x60]
call fcn.14006e790
nop
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x88]
call fcn.140048900
nop
lea rcx, [rsp + 0x60]
call fcn.14005ec10
nop
lea rcx, [rbp - 0x30]
call fcn.14005ec80
lea r14, [rbp + 0x88]
cmp qword [rbp + 0xa0], 8
cmovae r14, qword [rbp + 0x88]
mov rdi, qword [rbp + 0x98]
call fcn.14014c97c
mov r15d, eax
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
movdqa xmm1, xmmword [0x140291260]
movdqu xmmword [rbp - 0x60], xmm1
mov byte [rbp - 0x70], 0
mov dword [rbp - 0x80], Ordinal_145
test rdi, rdi
je 0x14009f14e
cmp rdi, 0x7fffffff
ja 0x14009f5e7
mov dword [rsp + 0x20], r13d
xor r9d, r9d
mov r8d, edi
mov rdx, r14
mov ecx, eax
call fcn.14014c9ec
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x14009f5ed
movsxd rdx, ebx
xor r8d, r8d
lea rcx, [rbp - 0x70]
call fcn.14005ece0
lea r9, [rbp - 0x70]
cmp qword [rbp - 0x58], 0x10
cmovae r9, qword [rbp - 0x70]
mov dword [rsp + 0x20], ebx
mov r8d, edi
mov rdx, r14
mov ecx, r15d
call fcn.14014c9ec
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x14009f5f9
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 0x10
cmovae rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov r12d, eax
and r12d, 0xfffffffd
lea r14, [rbp + 0x88]
cmp qword [rbp + 0xa0], 8
cmovae r14, qword [rbp + 0x88]
mov rdi, qword [rbp + 0x98]
call fcn.14014c97c
mov r15d, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [0x140291260]
movdqu xmmword [rsp + 0x70], xmm1
mov byte [rsp + 0x60], 0
mov dword [rbp - 0x80], 0x87f
test rdi, rdi
je 0x14009f229
cmp rdi, 0x7fffffff
ja 0x14009f603
mov dword [rsp + 0x20], r13d
xor r9d, r9d
mov r8d, edi
mov rdx, r14
mov ecx, eax
call fcn.14014c9ec
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x14009f609
movsxd rdx, ebx
xor r8d, r8d
lea rcx, [rsp + 0x60]
call fcn.14005ece0
lea r9, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae r9, qword [rsp + 0x60]
mov dword [rsp + 0x20], ebx
mov r8d, edi
mov rdx, r14
mov ecx, r15d
call fcn.14014c9ec
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x14009f615
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rcx, qword [rsp + 0x60]
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rsp + 0x60]
call fcn.14005ec80
nop
lea rcx, [rbp - 0x70]
call fcn.14005ec80
lea rax, [rbp - 0x50]
mov qword [rsp + 0x38], rax
lea rdx, [rbp - 0x50]
mov rcx, qword [0x1402b5248]
call fcn.14004cec0
mov r12, rax
lea rax, [rbp + 0x40]
mov qword [rbp + 0x10], rax
lea rax, vtable.std::_Func_impl_no_alloc_class__public:_void___cdecl__private:_void___cdecl_CUserInterface::RenderBase_void____ptr64::_28::_lambda_1_::operator___void____ptr64::_5::_lambda_1___int__long_long___int64___long_long___int64__.0
mov qword [rbp + 0x40], rax
lea rax, [rbp + 0x40]
mov qword [rbp + 0x78], rax
mov byte [rbp + 0x80], 1
lea rax, [rbp - 0x30]
mov qword [rbp + 0xb0], rax
lea r14, [rbp + 0x88]
cmp qword [rbp + 0xa0], 8
cmovae r14, qword [rbp + 0x88]
mov rdi, qword [rbp + 0x98]
call fcn.14014c97c
mov r15d, eax
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x30], 0
mov dword [rbp - 0x80], 0x877f
test rdi, rdi
je 0x14009f358
cmp rdi, 0x7fffffff
ja 0x14009f61f
mov dword [rsp + 0x20], r13d
xor r9d, r9d
mov r8d, edi
mov rdx, r14
mov ecx, eax
call fcn.14014c9ec
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x14009f625
movsxd rdx, ebx
xor r8d, r8d
lea rcx, [rbp - 0x30]
call fcn.14005ece0
lea r9, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae r9, qword [rbp - 0x30]
mov dword [rsp + 0x20], ebx
mov r8d, edi
mov rdx, r14
mov ecx, r15d
call fcn.14014c9ec
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x14009f631
movsxd r8, dword [0x1402b54b8]
mov r9, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
sub rcx, r9
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 6
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rdx, r8
jbe 0x14009f63b
lea rdx, [r8 + r8*4]
shl rdx, 5
add r9, 0x40
add rdx, r9
lea rcx, [rbp + 0x20]
call fcn.14005cdb0
nop
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x40]
lea r8, [rbp - 0x30]
lea rdx, [rbp + 0x20]
call fcn.14007bc80
lea r14, [rbp + 0x88]
cmp qword [rbp + 0xa0], 8
cmovae r14, qword [rbp + 0x88]
mov rdi, qword [rbp + 0x98]
call fcn.14014c97c
mov r15d, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [0x140291260]
movdqu xmmword [rsp + 0x70], xmm1
mov byte [rsp + 0x60], 0
mov dword [rbp - 0x80], 0x11777f
test rdi, rdi
je 0x14009f47d
cmp rdi, 0x7fffffff
ja 0x14009f641
mov dword [rsp + 0x20], r13d
xor r9d, r9d
mov r8d, edi
mov rdx, r14
mov ecx, eax
call fcn.14014c9ec
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x14009f647
movsxd rdx, ebx
xor r8d, r8d
lea rcx, [rsp + 0x60]
call fcn.14005ece0
lea r9, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae r9, qword [rsp + 0x60]
mov dword [rsp + 0x20], ebx
mov r8d, edi
mov rdx, r14
mov ecx, r15d
call fcn.14014c9ec
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x14009f653
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov r15d, eax
or r15d, 2
lea r14, [rbp + 0x88]
cmp qword [rbp + 0xa0], 8
cmovae r14, qword [rbp + 0x88]
mov rdi, qword [rbp + 0x98]
call fcn.14014c97c
mov r12d, eax
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
movdqa xmm1, xmmword [0x140291260]
movdqu xmmword [rbp - 0x40], xmm1
mov byte [rbp - 0x50], 0
mov dword [rbp - 0x80], 0x10f777f
test rdi, rdi
je 0x14009f554
cmp rdi, 0x7fffffff
ja 0x14009f65d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
mov r8d, edi
mov rdx, r14
mov ecx, eax
call fcn.14014c9ec
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x14009f663
movsxd rdx, ebx
xor r8d, r8d
lea rcx, [rbp - 0x50]
call fcn.14005ece0
lea r9, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae r9, qword [rbp - 0x50]
mov dword [rsp + 0x20], ebx
mov r8d, edi
mov rdx, r14
mov ecx, r12d
call fcn.14014c9ec
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x14009f5dd
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rcx, qword [rbp - 0x50]
mov edx, r15d
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rbp - 0x50]
call fcn.14005ec80
nop
lea rcx, [rsp + 0x60]
call fcn.14005ec80
lea rdx, [rbp + 0x88]
lea rcx, [rbp + 0x20]
call fcn.140049070
mov rdx, rax
call fcn.1400951f0
nop
lea rcx, [rbp + 0x88]
call fcn.14005ec10
mov rax, qword [rsi]
mov dword [rax], 2
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.14014d450
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
shr rcx, 0x20
call fcn.140046d80
nop
call fcn.140046ab0
int3
shr rbx, 0x20
mov ecx, ebx
call fcn.140046d80
int3
shr rcx, 0x20
call fcn.140046d80
nop
call fcn.140046ab0
int3
shr rbx, 0x20
mov ecx, ebx
call fcn.140046d80
int3
shr rcx, 0x20
call fcn.140046d80
nop
call fcn.140046ab0
int3
shr rbx, 0x20
mov ecx, ebx
call fcn.140046d80
int3
shr rcx, 0x20
call fcn.140046d80
nop
call fcn.14005e3a0
nop
call fcn.140046ab0
int3
shr rbx, 0x20
mov ecx, ebx
call fcn.140046d80
int3
shr rcx, 0x20
call fcn.140046d80
nop
call fcn.140046ab0
int3
shr rbx, 0x20
mov ecx, ebx
call fcn.140046d80
int3