Function at 0x1400943f0
Capabilities:
Encode data using xor
Get file attributes
Get session user name
Set file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov rax, qword [0x14025d030]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
mov rdi, rcx
xor ebx, ebx
mov dword [rsp + 0x40], 0x5f984f01
mov dword [rsp + 0x44], 0xf5d74a1
mov dword [rsp + 0x48], 0x44035841
mov dword [rsp + 0x4c], 0xbec27cbd
mov dword [rsp + 0x50], 0x36fc33e7
mov dword [rsp + 0x54], 0x21a8ef0b
mov dword [rsp + 0x58], 0x58d89a12
mov word [rsp + 0x5c], 0xc209
mov qword [rsp + 0x38], rbx
mov rax, qword [rsp + 0x38]
nop dword [rax]
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x38]
movzx edx, byte [rsp + rcx + 0x40]
sub dl, byte [rsp + rax + 0x4f]
mov byte [rsp + 0x30], dl
movzx ecx, byte [rsp + 0x30]
mov rax, qword [rsp + 0x38]
mov byte [rbp + rax + 0xa0], cl
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp rax, 0xf
jb 0x140094470
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rbx
mov qword [rbp - 0x78], rbx
mov r8d, reloc.WLDAP32.dll_Ordinal_14
lea rdx, [rbp + 0xa0]
lea rcx, [rsp + 0x70]
call fcn.140062b80
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov rcx, qword [0x14025f0f8]
add rcx, 8
lea rax, [rsp + 0x70]
cmp rcx, rax
je 0x140094510
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 0x10
cmovae rdx, qword [rsp + 0x70]
mov r8, qword [rbp - 0x80]
call fcn.140057920
nop
lea rcx, [rsp + 0x70]
call fcn.140057660
mov rcx, qword [rdi + 0x10]
sub rcx, qword [rdi + 8]
movabs r14, 0x6666666666666667
mov rax, r14
imul rcx
sar rdx, 6
mov rax, rdx
shr rax, 0x3f
add rdx, rax
movsxd rax, dword [0x14025f110]
cmp rax, rdx
jae 0x14009482a
mov dword [rbp + 0x78], 0x104
lea rdx, [rbp + 0x78]
lea rcx, [rbp + 0xb0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea rdx, [rbp + 0x80]
call fcn.140075ca0
nop
lea r9, [rbp + 0xb0]
movzx r8d, byte [rbp + 0xb0]
test r8b, r8b
je 0x1400945c4
nop dword [rax]
movzx edx, r8b
lea r9, [r9 + 1]
sub r8b, 0x41
lea eax, [rdx + 0x20]
movzx ecx, al
cmp r8b, 0x19
cmova ecx, edx
movsx eax, cl
add eax, ebx
imul ebx, eax, 0x401
mov eax, ebx
shr eax, 6
xor ebx, eax
movzx r8d, byte [r9]
test r8b, r8b
jne 0x140094590
lea ecx, [rbx + rbx*8]
mov eax, ecx
shr eax, 0xb
xor ecx, eax
imul eax, ecx, 0x8001
mov dword [rbp - 8], eax
movabs rax, 0x2000000000000000
mov qword [rbp - 0x10], rax
mov qword [rsp + 0x60], 1
lea rax, [rbp - 0x10]
mov qword [rsp + 0x68], rax
lea rax, str..dat
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], 6
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
movaps xmm1, xmmword [rbp - 0x70]
movdqa xmmword [rbp - 0x70], xmm1
lea r8, [rsp + 0x60]
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x50]
call fcn.14005a870
nop
lea rax, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rax, qword [rbp - 0x50]
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x40]
mov qword [rbp - 0x28], rax
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x70]
call fcn.140066f70
nop
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x80]
call fcn.1400485a0
nop
lea rcx, [rbp - 0x70]
call fcn.140055ab0
nop
lea rcx, [rbp - 0x50]
call fcn.140057660
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x80]
call fcn.1400487f0
nop
cmp qword [rax + 0x18], 0x10
jb 0x140094698
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
and ebx, 0xfffffffd
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x80]
call fcn.1400487f0
cmp qword [rax + 0x18], 0x10
jb 0x1400946c0
mov rax, qword [rax]
mov edx, ebx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rbp - 0x70]
call fcn.140057660
nop
lea rcx, [rbp - 0x10]
call fcn.140057660
lea rax, [rbp - 0x30]
mov qword [rsp + 0x38], rax
lea rdx, [rbp - 0x30]
mov rcx, qword [0x14025ef48]
call fcn.14004c700
mov rbx, rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x60], rax
lea rax, vtable.std::_Func_impl_no_alloc_class__public:_void___cdecl__private:_void___cdecl_CUserInterface::RenderHome_void____ptr64::_28::_lambda_1_::operator___void____ptr64::_5::_lambda_1___int__long_long___int64___long_long___int64__.0
mov qword [rbp + 0x30], rax
lea rax, [rbp + 0x30]
mov qword [rbp + 0x68], rax
mov byte [rbp + 0x70], 1
lea rcx, [rbp + 0x10]
mov qword [rbp - 0x10], rcx
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x80]
call fcn.1400487f0
mov rsi, rax
movsxd r8, dword [0x14025f110]
mov r9, qword [rdi + 8]
mov rcx, qword [rdi + 0x10]
sub rcx, r9
mov rax, r14
imul rcx
sar rdx, 6
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rdx, r8
jbe 0x14009485a
lea rdx, [r8 + r8*4]
shl rdx, 5
add r9, 0x40
add rdx, r9
lea rcx, [rbp - 0x50]
call fcn.140055ce0
nop
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x30]
mov r8, rsi
lea rdx, [rbp - 0x50]
call fcn.1400734a0
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x80]
call fcn.1400487f0
nop
cmp qword [rax + 0x18], 0x10
jb 0x1400947ad
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
or ebx, 2
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x80]
call fcn.1400487f0
cmp qword [rax + 0x18], 0x10
jb 0x1400947d5
mov rax, qword [rax]
mov edx, ebx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rbp + 0x10]
call fcn.140057660
nop
lea rcx, [rbp - 0x50]
call fcn.140057660
movzx ebx, byte [0x14025f174]
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x10]
call fcn.140048cb0
movzx r8d, bl
mov rdx, rax
lea rcx, [0x14025f3c0]
call fcn.14008bc20
nop
lea rcx, [rbp + 0x80]
call fcn.140055ab0
mov rax, qword [rdi]
mov dword [rax], 2
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.14013ea20
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.1400973f0
nop
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x14025d030]
xor rax, rsp
mov qword [rbp + 0x20], rax
mov r9, rdx
xor r10d, r10d
imul rax, r8, 0x64
cqo
idiv r9
mov rcx, rax
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
movsxd rax, dword [0x14025f170]
cmp rdx, rax
jle 0x140094a63
mov dword [0x14025f170], edx
mov dword [rbp - 0x50], edx
movabs rax, 0x1000000000000000
mov qword [rbp - 0x60], rax
mov byte [rbp - 0x4c], 0x25
movabs rax, 0x6000000000000004
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x40], 2
lea rax, [rbp - 0x60]
mov qword [rbp - 0x38], rax
mov dword [rsp + 0x30], 0x71d7bf3
mov dword [rsp + 0x34], 0x9b39a03d
mov dword [rsp + 0x38], 0x6eeb8845
mov dword [rsp + 0x3c], 0x8c154b9e
mov dword [rsp + 0x40], 0xac284822
mov dword [rsp + 0x44], 0x30ba4604
mov dword [rsp + 0x48], 0xe80d22cc
mov dword [rsp + 0x4c], 0xcafce78
mov dword [rsp + 0x50], 0x31d199a6
mov dword [rsp + 0x54], 0x1adc37d8
mov dword [rsp + 0x58], 0xe35b4e84
mov dword [rsp + 0x5c], 0xd0c11ab0
mov dword [rsp + 0x60], 0xda9b6608
mov dword [rsp + 0x64], 0xa7acbd55
mov dword [rsp + 0x68], 0xce53b890
mov qword [rsp + 0x28], r10
mov rax, qword [rsp + 0x28]
nop dword [rax + rax]
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x28]
movzx edx, byte [rsp + rcx + 0x30]
sub dl, byte [rsp + rax + 0x4e]
mov byte [rsp + 0x20], dl
movzx ecx, byte [rsp + 0x20]
mov rax, qword [rsp + 0x28]
mov byte [rbp + rax], cl
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp rax, 0x1e
jb 0x140094980
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x70], xmm1
mov r8d, 0x1d
lea rdx, [rbp]
lea rcx, [rbp - 0x80]
call fcn.140062b80
nop
lea rax, [rbp - 0x80]
cmp qword [rbp - 0x68], 0x10
cmovae rax, qword [rbp - 0x80]
mov qword [rsp + 0x70], rax
mov rax, qword [rbp - 0x70]
mov qword [rsp + 0x78], rax
movaps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp - 0x30], xmm0
movaps xmm1, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x70], xmm1
lea r8, [rbp - 0x30]
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x20]
call fcn.14005a870
mov rbx, rax
mov qword [rsp + 0x28], rax
mov rcx, qword [0x14025f0f8]
add rcx, 8
cmp rcx, rax
je 0x140094a51
mov rdx, rax
cmp qword [rax + 0x18], 0x10
jb 0x140094a47
mov rdx, qword [rax]
mov r8, qword [rax + 0x10]
call fcn.140057920
nop
mov rcx, rbx
call fcn.140057660
nop
lea rcx, [rbp - 0x80]
call fcn.140057660
xor eax, eax
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.14013ea20
mov rbx, qword [rsp + 0x140]
add rsp, 0x130
pop rbp
ret