Function at 0x1401e3580
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
nop word cs:[rax + rax]
mov eax, dword [0x1415ce9b8]
or eax, dword [0x1415ce9bc]
mov ecx, eax
not ecx
and ecx, 0x5838bea
mov edx, eax
and edx, 0xfa7c7415
imul edx, ecx
mov ecx, eax
and ecx, 0x5838bea
or eax, 0x5838bea
imul eax, ecx
add eax, edx
shr eax, 3
imul rax, rax, 0x50638a3
shr rax, 0x36
or eax, 0xc51ad56c
cmp eax, 0xcee5db1
jb 0x1401e35a0
test rdi, rdi
je 0x1401e3682
mov eax, dword [0x1415ce9d4]
add eax, dword [str.7_Z6o_G]
or eax, 0x39c27c0e
mov ecx, 0xbc85d4f7
imul rcx, rax
shr rcx, 0x3f
imul eax, ecx, 0x70655e0d
cmp eax, 0xac31d738
jbe 0x1401e3630
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
nop word [rax + rax]
mov eax, dword [0x1415ce9d8]
or eax, dword [0x1415ce9dc]
or eax, 0x79deac17
mov ecx, eax
xor ecx, 0xf7ad623e
and ecx, eax
mov eax, ecx
and eax, 0x8214ee1
add eax, eax
neg eax
lea ebx, [rcx + rax]
add ebx, 0xe8a94ee3
mov rcx, rdi
call fcn.14021c8d0
cmp ebx, 0xefdb8231
ja 0x1401e3630
test eax, eax
je 0x1401e36d0
xor eax, eax
test al, al
je 0x1401e37db
jmp 0x1401e3804
movabs rax, 0x8000000000000000
mov ecx, dword [0x1415ce9c4]
mov edx, ecx
xor edx, edx
not edx
and edx, dword [0x1415ce9c0]
xor edx, ecx
mov ecx, 0xd5dee8b3
imul rcx, rdx
shr rcx, 0x3e
add ecx, 0x55fae0d5
and ecx, 0x1098c00f
xor ecx, 0xa8001c09
cmp ecx, 0xc4922d9c
jne 0x1401e37b3
jmp 0x1401e37d6
movabs rax, 0x8000000000000000
mov ecx, dword [0x1415ce9e0]
mov edx, dword [0x1415ce9e4]
mov r8d, edx
not r8d
mov r9d, ecx
and r9d, r8d
or r8d, ecx
not r8d
imul r8d, r9d
mov r9d, ecx
and r9d, edx
or ecx, edx
imul ecx, r9d
add ecx, r8d
mov edx, ecx
or edx, 0x92378bec
not ecx
or ecx, 0x6dc87413
and ecx, edx
not ecx
imul ecx, ecx, 0x3e71f7d9
cmp ecx, 0x7867949b
jne 0x1401e3730
mov qword [rsi], rax
mov ecx, dword [0x1415ce9e8]
mov edx, dword [0x1415ce9ec]
mov r8d, ecx
and r8d, edx
or ecx, edx
add ecx, r8d
imul rdx, rcx, 0x1bcb491b
shr rdx, 0x20
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 0x1c
or ecx, 0xd2a09e2b
imul rcx, rcx, 0x6b7d2f43
shr rcx, 0x3d
mov qword [rsi], rax
cmp ecx, 0xc7375fb9
ja 0x1401e3730
nop word [rax + rax]
mov eax, dword [0x1415ce9f0]
add eax, dword [0x1415ce9f4]
mov ecx, eax
not ecx
and ecx, 0x694df831
and eax, 0x96b207ce
sub eax, ecx
add eax, 0xa15f6078
xor eax, 0xe9b7e447
cmp eax, 0xda5adbd9
ja 0x1401e3780
jmp 0x1401e3f02
mov ecx, dword [0x1415ce9c8]
mov edx, dword [0x1415ce9cc]
add ecx, edx
add ecx, 0xb52a0fad
mov qword [rsi], rax
cmp ecx, 0x8ba89d6e
jb 0x1401e3f02
mov qword [rsi], rax
jmp 0x1401e37b3
mov ebx, dword [0x1415ce9fc]
add ebx, dword [0x1415ce9f8]
or ebx, 0x5ede6699
and ebx, 0xdede6799
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
cmp ebx, 0x19794558
jne 0x1401e380e
mov rcx, rdi
call fcn.14021c8f0
jmp 0x1401e37db
mov r14d, eax
nop word cs:[rax + rax]
mov eax, dword [0x1415cea00]
mov ecx, dword [0x1415cea04]
not eax
not ecx
or ecx, eax
not ecx
and ecx, 0xfd290e5
add ecx, 0x5905641f
cmp ecx, 0xf866f011
ja 0x1401e3820
nop dword [rax + rax]
mov eax, dword [0x1415cea08]
or eax, dword [0x1415cea0c]
mov ecx, eax
and ecx, 0x37e047cf
xor eax, 0x37e047cf
lea eax, [rax + rcx*2]
imul rax, rax, 0x57a7cd6b
shr rax, 0x3e
or eax, 0xd283c12a
cmp eax, 0x2f2314d1
je 0x1401e3850
test r14, r14
je 0x1401e3b43
mov eax, dword [0x1415cea10]
sub eax, dword [0x1415cea14]
xor eax, 0x9105b034
imul rax, rax, 0x78a13355
shr rax, 0x3c
cmp eax, 0xa4a3e830
jne 0x1401e38c0
mov ecx, 8
mov rdx, r14
call fcn.140219830
nop dword [rax]
mov eax, dword [0x1415cea18]
sub eax, dword [0x1415cea1c]
imul eax, eax, 0xcc016565
mov ecx, eax
xor ecx, 0x9f7aafa8
or eax, 0x60855057
and eax, ecx
imul ebp, eax, 0x693dd333
mov ecx, 8
mov rdx, r14
call fcn.1401b5e70
cmp ebp, 0x34a0d9c4
ja 0x1401e38c0
mov rbx, rax
mov eax, dword [0x1415cea20]
xor edx, edx
div dword [0x1415cea24]
nop dword [rax]
mov eax, dword [0x1415cea28]
imul eax, dword [0x1415cea2c]
add eax, 0xb8c4ee47
and eax, 0xb72b7d1e
imul eax, eax, 0xac2f57df
cmp eax, 0x45b6799c
jb 0x1401e3910
test rbx, rbx
je 0x1401e3c4d
mov eax, dword [0x1415cea78]
xor edx, edx
div dword [0x1415cea7c]
mov ecx, eax
and ecx, 0x591d1f08
add ecx, ecx
neg ecx
add eax, ecx
add eax, 0x591d1f08
mov ecx, eax
xor ecx, 0x852918b0
xor eax, 0x3a94054b
or eax, 0xc54af224
add eax, ecx
cmp eax, 0x9c26b3bf
jne 0x1401e3988
mov ecx, r14d
mov rdx, rbx
mov r8, rdi
call qword [sym.imp.ADVAPI32.dll_CopySid]
mov r15, qword [sym.imp.ADVAPI32.dll_CopySid]
nop
mov eax, dword [0x1415cea80]
sub eax, dword [0x1415cea84]
imul r12, rax, 0x20806d01
shr r12, 0x38
add r12d, 0xec21a1ee
not r12d
and r12d, 0x3de1f86
mov ecx, r14d
mov rdx, rbx
mov r8, rdi
call r15
cmp r12d, 0x5d021a56
je 0x1401e3990
nop dword [rax]
mov ecx, dword [0x1415cea88]
mov edx, dword [0x1415cea8c]
mov r8d, edx
not r8d
and r8d, ecx
xor edx, ecx
add edx, ecx
sub edx, r8d
add edx, 0xd879855e
mov ecx, edx
xor ecx, 0xace015bd
and edx, 0x531fea42
add edx, edx
sub edx, ecx
add edx, 0xf4377b06
cmp edx, 0xbacc348a
ja 0x1401e39d0
nop word cs:[rax + rax]
mov ecx, dword [0x1415cea90]
mov edx, dword [0x1415cea94]
mov r8d, ecx
xor r8d, edx
not r8d
and r8d, edx
add r8d, r8d
sub edx, r8d
add edx, ecx
imul ecx, edx, 0xbeb695f9
add ecx, 0xc093a837
cmp ecx, 0xe07c6e18
ja 0x1401e3a20
test eax, eax
je 0x1401e3b9d
movzx eax, byte [rbx]
mov ecx, 0xb02e1369
nop word cs:[rax + rax]
mov edx, dword [0x1415ceab0]
add edx, dword [0x1415ceab4]
imul rdx, rcx
shr rdx, 0x3f
lea r8d, [rdx - 0x777ab0ae]
not r8d
or r8d, 0x66c546b8
add edx, r8d
add edx, 0x88854f53
cmp edx, 0xe5302db9
ja 0x1401e3a70
cmp al, 1
jne 0x1401e3c89
mov eax, dword [0x1415ceab8]
xor edx, edx
div dword [0x1415ceabc]
add eax, 0x40fb3ea1
or eax, 0xafe79bdf
add eax, 0x722df29b
cmp eax, 0x271c1a62
jae 0x1401e3ae0
mov qword [rsi], r14
mov qword [rsi + 8], rbx
nop dword [rax]
mov eax, dword [0x1415ceac0]
add eax, dword [0x1415ceac4]
and eax, 0x5986046
add eax, 0x9c716305
or eax, 0x9bb1e2fb
mov qword [rsi], r14
mov qword [rsi + 8], rbx
cmp eax, 0x351f2ee2
je 0x1401e3ae0
mov qword [rsi + 0x10], r14
nop dword [rax]
mov eax, dword [0x1415ceac8]
or eax, dword [0x1415ceacc]
mov ecx, eax
not ecx
or ecx, 0xe0944818
or eax, 0x1f6bb7e7
and eax, ecx
add eax, 0x9835052e
and eax, 0xc73371db
cmp eax, 0x67598d7
jbe 0x1401e3b10
jmp 0x1401e3f02
mov eax, dword [0x1415cea40]
mov ecx, dword [0x1415cea44]
mov edx, ecx
not edx
and edx, eax
xor ecx, eax
add ecx, eax
sub ecx, edx
mov eax, ecx
not eax
mov edx, ecx
and edx, 0xdf54e98f
and eax, 0x20ab1670
imul eax, edx
mov edx, ecx
and edx, 0x20ab1670
or ecx, 0x20ab1670
imul ecx, edx
add ecx, eax
imul rax, rcx, 0x7ce321f5
shr rax, 0x3e
cmp eax, 0xd47b0336
jbe 0x1401e3d65
jmp 0x1401e3da3
mov eax, dword [0x1415cea98]
mov ecx, dword [0x1415cea9c]
mov edx, eax
or edx, ecx
not edx
not eax
not ecx
and ecx, eax
or ecx, edx
not ecx
add ecx, 0xb0e09ae0
not ecx
or ecx, 0xe404c0e9
cmp ecx, 0x895a3099
jae 0x1401e3be0
call sub.KERNEL32.dll_GetLastError
nop word cs:[rax + rax]
mov edi, dword [0x1415ceaa0]
mov eax, dword [0x1415ceaa4]
mov ecx, eax
and ecx, edi
add edi, eax
sub edi, ecx
add edi, 0x617f1948
mov eax, edi
not eax
mov ecx, edi
and ecx, 0x1e9d4642
and eax, 0x2162b9bd
imul eax, ecx
mov ecx, edi
and ecx, 0x2162b9bd
or edi, 0x2162b9bd
imul edi, ecx
add edi, eax
or edi, 0xc8f05e87
call sub.KERNEL32.dll_GetLastError
cmp edi, 0x1a2b4cab
jb 0x1401e3be0
movabs rax, 0x8000000000000000
xor ecx, ecx
test cl, cl
je 0x1401e3f11
jmp 0x1401e3f60
mov eax, dword [0x1415cea30]
xor edx, edx
div dword [0x1415cea34]
mov ecx, eax
not ecx
or ecx, 0x9071c829
and ecx, 0x90f5cd3d
and eax, 0x2a020082
or eax, ecx
xor eax, 0x81bfffa7
imul eax, eax, 0xc5591c3b
cmp eax, 0xbf875a8
jae 0x1401e3cc8
jmp 0x1401e3d5c
mov eax, dword [0x1415cead0]
mov ecx, dword [0x1415cead4]
mov edx, eax
xor edx, ecx
not edx
and edx, ecx
add edx, edx
sub ecx, edx
add ecx, eax
mov eax, ecx
not eax
or eax, 0xe67419fe
add eax, ecx
add eax, 0xf1083f52
or eax, 0x6a8e7f5b
cmp eax, 0x6d6b146
jae 0x1401e3f86
jmp 0x1401e3fd5
mov eax, dword [0x1415cea38]
mov ecx, dword [0x1415cea3c]
mov edx, ecx
not edx
mov r8d, eax
and r8d, edx
or edx, eax
not edx
imul edx, r8d
mov r8d, eax
and r8d, ecx
or eax, ecx
imul eax, r8d
add eax, edx
mov ecx, eax
not ecx
and ecx, 0x2665c6cf
and eax, 0xd99a3930
sub eax, ecx
mov ecx, eax
not ecx
and ecx, 0x174cdc4e
mov edx, eax
and edx, 0xe8b323b1
imul edx, ecx
mov ecx, eax
and ecx, 0x174cdc4e
or eax, 0x174cdc4e
imul eax, ecx
add eax, edx
mov ecx, eax
not ecx
mov edx, eax
and edx, 0xd08209a0
and ecx, 0x2f7df65f
imul ecx, edx
mov edx, eax
and edx, 0x2f7df65e
or eax, 0x2f7df65f
imul eax, edx
add eax, ecx
ud2
ud2
ud2
mov eax, dword [0x1415cea48]
mov ebx, dword [0x1415cea4c]
mov ecx, eax
or ecx, ebx
not ecx
not eax
not ebx
and ebx, eax
or ebx, ecx
xor ebx, 0x41a90021
or ebx, 0x3256ed14
mov edx, 1
xor ecx, ecx
mov r8, rdi
call qword [sym.imp.ADVAPI32.dll_CopySid]
cmp ebx, 0x951733b3
jae 0x1401e3db5
mov edx, 1
xor ecx, ecx
mov r8, rdi
call qword [sym.imp.ADVAPI32.dll_CopySid]
jmp 0x1401e3d65
mov ecx, 0xa75bea15
nop word [rax + rax]
mov edx, dword [0x1415cea50]
mov r8d, dword [0x1415cea54]
add edx, r8d
add edx, 0x72f16766
xor edx, 0x94809cf3
imul rdx, rcx
shr rdx, 0x3f
cmp edx, 0xf0c66821
ja 0x1401e3dc0
test eax, eax
jne 0x1401e3d63
mov eax, dword [0x1415cea58]
sub eax, dword [0x1415cea5c]
mov ecx, eax
not ecx
mov edx, eax
and edx, 0xb7be82f5
and ecx, 0x48417d0a
imul ecx, edx
mov edx, eax
and edx, 0x48417d0a
or eax, 0x48417d0a
imul eax, edx
add eax, ecx
xor eax, 0x47848745
mov ecx, eax
and ecx, 0xd93eb1cc
or eax, 0xd93eb1cc
add eax, ecx
cmp eax, 0x98582db3
ja 0x1401e3e71
mov eax, dword [0x1415cea60]
sub eax, dword [0x1415cea64]
xor eax, 0x3b620aae
imul rax, rax, 0x4c7f8919
shr rax, 0x3d
imul edi, eax, 0xf09fb139
call sub.KERNEL32.dll_GetLastError
cmp edi, 0x58132455
jbe 0x1401e3e78
call fcn.14021a080
jmp 0x1401e3e42
movabs rax, 0x8000000000000000
mov ecx, dword [0x1415cea68]
mov edx, dword [0x1415cea6c]
mov r8d, ecx
and r8d, edx
xor ecx, edx
lea ecx, [rcx + r8*2]
mov edx, ecx
and edx, 0xd55a68
xor ecx, 0x80d55a68
lea ecx, [rcx + rdx*2]
imul ecx, ecx, 0x900b47dc
mov edx, 0xc31da831
imul rdx, rcx
shr rdx, 0x3f
cmp edx, 0x6f7784ae
ja 0x1401e3efd
mov ecx, dword [0x1415cea70]
xor ecx, dword [0x1415cea74]
add ecx, 0x24f63804
or ecx, 0xa3b20a22
mov edx, ecx
and edx, 0x6014e4b1
add edx, edx
neg edx
add ecx, edx
add ecx, 0x6014e4b1
mov qword [rsi], rax
cmp ecx, 0xddeaad77
jb 0x1401e3f02
mov qword [rsi], rax
jmp 0x1401e3ec6
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov ecx, dword [0x1415ceaa8]
or ecx, dword [0x1415ceaac]
mov edx, ecx
xor edx, 0x8572c9b0
and ecx, 0x7a8d364f
add ecx, ecx
sub ecx, edx
mov edx, ecx
and edx, 0x3ffd82d3
and ecx, 0x2f248240
mov r8d, edx
xor r8d, 0x10db1dbb
add r8d, edx
sub r8d, ecx
mov qword [rsi], rax
mov rcx, qword [0x1415d3918]
cmp r8d, 0xf2f7f3bc
jbe 0x1401e3f6c
mov qword [rsi], rax
mov rcx, qword [0x1415d3918]
jmp 0x1401e3f11
xor edx, edx
mov r8, rbx
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [0x1415cead8]
mov ecx, dword [0x1415ceadc]
mov edx, eax
not edx
mov r8d, ecx
not r8d
mov r9d, edx
and r9d, 0x23c0d64a
and eax, 0xdc3f29b5
or eax, r9d
or edx, r8d
and r8d, 0x23c0d64a
and ecx, 0xdc3f29b5
or ecx, r8d
xor ecx, eax
not edx
or edx, ecx
ud2
ud2