Function at 0x1400dc300
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rsi, rcx
test rdx, rdx
je 0x1400dc4b2
mov rdi, rdx
mov rcx, rdx
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
xor ecx, ecx
nop word cs:[rax + rax]
test cl, cl
jne 0x1400dc330
test eax, eax
je 0x1400dc4cb
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov r14d, eax
nop dword [rax + rax]
mov eax, dword [0x141f45c68]
sub eax, dword [0x141f45c6c]
add eax, 0x58f1051
or eax, 0x78a20033
cmp eax, 0x6be0654c
je 0x1400dc350
nop dword [rax]
mov eax, dword [str.L_E6L]
or eax, dword [0x141f45c74]
and eax, 0x97a86240
xor eax, 0x77d04206
cmp eax, 0xf09d9abf
ja 0x1400dc370
test r14, r14
je 0x1400dc4e4
mov ecx, 8
mov rdx, r14
call fcn.1400c6170
mov rbx, rax
nop word cs:[rax + rax]
mov eax, dword [0x141f45c78]
imul eax, dword [0x141f45c7c]
imul eax, eax, 0xf9dad323
xor eax, 0x1000305
or eax, 0x5eb5fcfa
cmp eax, 0x79c7c584
je 0x1400dc3b0
nop word cs:[rax + rax]
mov eax, dword [0x141f45c80]
imul eax, dword [0x141f45c84]
or eax, 0x5c336757
xor eax, 0xd910b65c
cmp eax, 0x3d17d111
ja 0x1400dc3e0
test rbx, rbx
je 0x1400dc52d
mov ecx, r14d
mov rdx, rbx
mov r8, rdi
call qword [sym.imp.ADVAPI32.dll_CopySid]
nop word cs:[rax + rax]
mov ecx, dword [0x141f45cb0]
add ecx, dword [0x141f45cb4]
imul ecx, ecx, 0xb617dc8e
cmp ecx, 0xa84fc6d7
je 0x1400dc420
nop word [rax + rax]
mov ecx, dword [0x141f45cb8]
sub ecx, dword [0x141f45cbc]
or ecx, 0x3558df8b
xor ecx, 0xfbdc46d9
imul rcx, rcx, 0x69bca5eb
shr rcx, 0x3c
cmp ecx, 0x98a8d937
ja 0x1400dc440
test eax, eax
je 0x1400dc514
movzx eax, byte [rbx]
nop word cs:[rax + rax]
mov ecx, dword [0x141f45cd0]
sub ecx, dword [0x141f45cd4]
and ecx, 0xc67fecf7
cmp ecx, 0x6ee65971
je 0x1400dc480
cmp al, 1
jne 0x1400dc5a2
mov qword [rsi], r14
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], r14
jmp 0x1400dc620
movabs rax, 0x8000000000000000
xor ecx, ecx
test cl, cl
je 0x1400dc5f2
jmp 0x1400dc617
movabs rax, 0x8000000000000000
xor ecx, ecx
test cl, cl
je 0x1400dc643
jmp 0x1400dc675
mov eax, dword [0x141f45ca0]
or eax, dword [0x141f45ca4]
imul rcx, rax, 0x4051648f
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1d
cmp eax, 0x1792151
jne 0x1400dc67c
jmp 0x1400dc692
movabs rdi, 0x8000000000000000
xor eax, eax
test al, al
je 0x1400dc6f2
jmp 0x1400dc737
mov eax, dword [0x141f45c88]
add eax, dword [0x141f45c8c]
or eax, 0xff7f7efb
imul eax, eax, 0x234927c5
cmp eax, 0xeaffee8d
jbe 0x1400dc550
ud2
mov eax, dword [0x141f45c90]
and eax, dword [0x141f45c94]
imul eax, eax, 0xab2ce642
add eax, 0x67ae5e32
or eax, 0x4f08d30d
ud2
mov eax, dword [0x141f45cd8]
or eax, dword [0x141f45cdc]
xor eax, 0x1002812
or eax, 0x9661d44d
cmp eax, 0x295b923a
jne 0x1400dc5c1
ud2
mov eax, dword [0x141f45ce0]
mov ecx, dword [0x141f45ce4]
add eax, ecx
add eax, 0x1673f52c
or eax, 0xb0696df1
imul rax, rax, 0x57ca9445
shr rax, 0x3b
ud2
mov ecx, dword [0x141f45c50]
imul ecx, dword [0x141f45c54]
mov edx, 0xbf7fa529
imul rdx, rcx
shr rdx, 0x3f
mov qword [rsi], rax
cmp edx, 0x4f8d2420
jne 0x1400dc620
mov qword [rsi], rax
jmp 0x1400dc5f2
mov eax, dword [0x141f45c58]
or eax, dword [0x141f45c5c]
and eax, 0xd7be13c7
cmp eax, 0x3664eb4c
je 0x1400dc620
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov ecx, dword [0x141f45c60]
and ecx, dword [0x141f45c64]
or ecx, 0xdb840262
shr ecx, 1
mov edx, 0xa89a2761
imul rdx, rcx
shr rdx, 0x3e
imul ecx, edx, 0x9ffeba73
mov qword [rsi], rax
cmp ecx, 0x31c9cbef
jne 0x1400dc620
mov qword [rsi], rax
jmp 0x1400dc643
ud2
xor ebx, ebx
mov edx, 1
xor ecx, ecx
mov r8, rdi
call qword [sym.imp.ADVAPI32.dll_CopySid]
test bl, bl
je 0x1400dc6b0
mov edx, 1
xor ecx, ecx
mov r8, rdi
call qword [sym.imp.ADVAPI32.dll_CopySid]
jmp 0x1400dc67c
mov ecx, dword [0x141f45ca8]
or ecx, dword [0x141f45cac]
add ecx, 0x53f0d004
or ecx, 0xb2244634
add ecx, 0x13bce0d6
cmp ecx, 0x49b1a608
jb 0x1400dc6b0
test eax, eax
jne 0x1400dc67a
call qword [sym.imp.KERNEL32.dll_GetLastError]
movabs rax, 0x8000000000000000
mov qword [rsi], rax
jmp 0x1400dc620
mov eax, dword [0x141f45cc0]
mov ecx, dword [0x141f45cc4]
add eax, ecx
add eax, 0xbe9238ec
imul rcx, rax, 0x9a68f03
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1e
imul ebp, eax, 0xb1251f1b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsi], rdi
mov rcx, qword [0x141f49060]
cmp ebp, 0x6e2df57a
jne 0x1400dc749
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsi], rdi
mov rax, qword [0x141f49060]
jmp 0x1400dc6f2
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop word cs:[rax + rax]
mov eax, dword [0x141f45cc8]
xor edx, edx
div dword [0x141f45ccc]
or eax, 0x4040c188
and eax, 0x6071f9be
imul rax, rax, 0x1f02473
shr rax, 0x36
cmp eax, 0x845dac14
je 0x1400dc760
jmp 0x1400dc620