Function at 0x4626b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x10], rdx
mov rax, rsp
sub rsp, 0xb8
mov qword [rax - 8], rbx
mov rbx, qword [rcx + reloc.SHELL32.dll_IsUserAnAdmin]
mov qword [rax - 0x10], rbp
mov qword [rax - 0x18], rsi
mov qword [rax - 0x20], rdi
mov qword [rax - 0x28], r12
mov qword [rax - 0x30], r13
mov qword [rax - 0x38], r14
mov r14, rdx
mov rdx, qword [r9]
mov rdi, rcx
mov qword [rax - 0x40], r15
xor eax, eax
mov r13, r8
lea rcx, [rbx + 0x28]
xor r8d, r8d
mov rsi, r9
mov qword [rsp + 0x60], rbx
mov r12d, eax
mov dword [rsp + 0xc0], eax
call fcn.0045d480
test rax, rax
mov qword [rsp + 0x48], rax
jne 0x4627ce
mov rsi, qword [rsi]
nop
nop
mov rax, qword [rbx + 0xb0]
cmp qword [rbx + 0xb8], rax
jne 0x462754
lea rcx, [rbx + 0xa0]
call fcn.0045da30
test al, al
je 0x462a76
movzx eax, byte [rsi]
mov rcx, qword [rbx + 0xb8]
inc rsi
mov byte [rcx], al
inc qword [rbx + 0xb8]
movzx eax, byte [rsi - 1]
test al, al
mov rcx, qword [rbx + 0xb8]
jne 0x462730
mov rdx, qword [rbx + 0xc0]
mov qword [rbx + 0xc0], rcx
test rdx, rdx
je 0x462a76
lea rcx, [rbx + 0x28]
mov r8d, 0x28
call fcn.0045d480
test rax, rax
mov qword [rsp + 0x48], rax
je 0x462a76
cmp byte [rdi + 0x1d0], r12b
je 0x4627ce
mov rdx, rax
mov rcx, rdi
call fcn.0045e8a0
test eax, eax
je 0x462a76
mov rax, qword [rsp + 0x48]
mov r9, qword [rdi + 0x2e8]
mov r8d, dword [rdi + 0x2d8]
movsxd rbp, dword [rax + 0x18]
mov rdx, r13
mov rcx, r14
call qword [r14 + 0x50]
mov esi, dword [rdi + 0x2d8]
movsxd rbx, eax
lea ecx, [rbx + rbp]
cmp ecx, esi
jle 0x462841
add ecx, 0x10
movsxd rdx, ecx
mov dword [rdi + 0x2d8], ecx
mov rcx, qword [rdi + 0x2e8]
shl rdx, 5
call qword [rdi + 0x20]
test rax, rax
je 0x462a76
cmp ebx, esi
mov qword [rdi + 0x2e8], rax
jle 0x46284b
mov rsi, qword [rsp + 0xc8]
mov r9, rax
mov r8d, ebx
mov rcx, rsi
mov rdx, r13
call qword [rsi + 0x50]
jmp 0x462853
mov rsi, qword [rsp + 0xc8]
jmp 0x462853
mov rsi, qword [rsp + 0xc8]
mov r14, qword [rdi + 0x2e8]
xor r9d, r9d
test ebx, ebx
mov r15, rbp
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x30], r9d
mov r13, r9
mov qword [rsp + 0x58], r9
jle 0x462abe
mov rbp, qword [rsp + 0x40]
mov r14, r9
nop
nop
nop
mov rax, qword [rdi + 0x2e8]
mov rcx, rsi
mov rbx, qword [r14 + rax]
mov rdx, rax
mov rdx, qword [rax + r14]
call qword [rsi + 0x40]
mov r8, rbx
mov rdx, rsi
movsxd r9, eax
mov rcx, rdi
add r9, rbx
call fcn.00461170
test rax, rax
mov rsi, rax
je 0x462a76
mov rax, qword [rax]
cmp byte [rax - 1], 0
jne 0x462a80
mov byte [rax - 1], 1
mov rcx, qword [rsi]
mov qword [rbp], rcx
mov r8, qword [rdi + 0x2e8]
cmp byte [r8 + r14 + 0x18], 0
jne 0x4629c4
cmp byte [rsi + 0x10], 0
mov r13b, 1
je 0x46292d
xor eax, eax
test r15, r15
jle 0x46292d
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rcx + 0x20]
mov rcx, rdx
nop
cmp rsi, qword [rcx]
je 0x462923
inc rax
add rcx, 0x18
cmp rax, r15
jl 0x462910
jmp 0x46292d
lea rax, [rax + rax*2]
movzx r13d, byte [rdx + rax*8 + 8]
mov rax, qword [r8 + r14 + 0x10]
mov r9, qword [r8 + r14 + 8]
mov rdx, qword [rsp + 0xc8]
lea rbx, [rdi + 0x308]
movzx r8d, r13b
mov rcx, rdi
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call fcn.004602e0
test eax, eax
jne 0x463266
test r13b, r13b
jne 0x46297f
mov rcx, qword [rbx + 0x18]
cmp rcx, qword [rbx + 0x20]
je 0x46297f
dec rcx
cmp byte [rcx], 0x20
jne 0x46297f
mov qword [rbx + 0x18], rcx
mov rax, qword [rbx + 0x10]
cmp qword [rbx + 0x18], rax
jne 0x462999
mov rcx, rbx
call fcn.0045da30
test al, al
je 0x462a76
mov rax, qword [rbx + 0x18]
mov r13, qword [rsp + 0x58]
mov byte [rax], 0
inc qword [rbx + 0x18]
mov rax, qword [rdi + 0x328]
mov qword [rbp + 8], rax
mov rax, qword [rdi + 0x320]
mov qword [rdi + 0x328], rax
jmp 0x4629fd
mov r9, qword [r8 + r14 + 0x10]
mov rdx, qword [rsp + 0xc8]
mov r8, qword [r8 + r14 + 8]
lea rcx, [rdi + 0x308]
call fcn.0045f5f0
test rax, rax
mov qword [rbp + 8], rax
je 0x462a76
mov rax, qword [rdi + 0x320]
mov qword [rdi + 0x328], rax
mov rdx, qword [rsi + 8]
test rdx, rdx
je 0x462a4a
cmp byte [rsi + 0x11], 0
je 0x462a32
mov rax, qword [rsp + 0xe0]
mov r9, qword [rbp + 8]
mov r8, rsi
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.0045cbc0
test eax, eax
jne 0x463266
jmp 0x462a52
mov rax, qword [rsi]
add r12d, 2
add rbp, 0x10
inc dword [rsp + 0xc0]
mov byte [rax - 1], 2
jmp 0x462a52
add r12d, 2
add rbp, 0x10
inc dword [rsp + 0x30]
inc r13
add r14, 0x20
cmp r13, qword [rsp + 0x50]
mov qword [rsp + 0x58], r13
jge 0x462ab6
mov rsi, qword [rsp + 0xc8]
jmp 0x462890
mov eax, 1
jmp 0x463266
mov rax, qword [rsp + 0xc8]
cmp rax, qword [rdi + 0x120]
jne 0x462aac
movsxd rcx, dword [rsp + 0x30]
mov rax, qword [rdi + 0x2e8]
shl rcx, 5
mov rcx, qword [rcx + rax]
mov qword [rdi + 0x228], rcx
mov eax, 8
jmp 0x463266
mov r14, qword [rsp + 0x40]
xor r9d, r9d
mov r13, qword [rsp + 0x48]
mov dword [rdi + 0x2dc], r12d
movsxd rdx, r12d
mov r8, qword [r13 + 0x10]
test r8, r8
je 0x462b0c
mov rax, qword [r8]
cmp byte [rax - 1], 0
je 0x462b0c
test r12d, r12d
mov ecx, r9d
mov rax, r9
jle 0x462b16
mov r8, qword [r8]
nop
cmp qword [r14 + rax*8], r8
je 0x462b04
add rax, 2
add ecx, 2
cmp rax, rdx
jl 0x462af0
jmp 0x462b16
mov dword [rdi + 0x2e0], ecx
jmp 0x462b16
mov dword [rdi + 0x2e0], 0xffffffff
test r15, r15
mov rbp, r9
jle 0x462bda
mov rsi, r9
lea rbx, [r14 + rdx*8]
nop
nop
mov r10, qword [r13 + 0x20]
mov r8, qword [rsi + r10]
mov rax, qword [r8]
cmp byte [rax - 1], 0
jne 0x462bc7
mov r9, qword [rsi + r10 + 0x10]
test r9, r9
je 0x462bc7
mov rdx, qword [r8 + 8]
test rdx, rdx
je 0x462ba7
cmp byte [r8 + 0x11], 0
je 0x462b7e
mov rax, qword [rsp + 0xe0]
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.0045cbc0
test eax, eax
jne 0x463266
jmp 0x462bc7
inc dword [rsp + 0xc0]
mov byte [rax - 1], 2
mov rax, qword [rsi + r10]
mov rcx, qword [rax]
add r12d, 2
add rbx, 0x10
mov qword [rbx - 0x10], rcx
mov rax, qword [rsi + r10 + 0x10]
mov qword [rbx - 8], rax
jmp 0x462bc7
mov byte [rax - 1], 1
mov rax, qword [rsi + r10]
add r12d, 2
mov rcx, qword [rax]
add rbx, 0x10
mov qword [rbx - 0x10], rcx
mov rax, qword [rsi + r10 + 0x10]
mov qword [rbx - 8], rax
inc rbp
add rsi, 0x18
cmp rbp, r15
jl 0x462b30
xor r9d, r9d
mov r11d, dword [rsp + 0xc0]
movsxd r8, r12d
mov r10d, r9d
test r11d, r11d
mov dword [rsp + 0x30], r9d
mov r15d, 1
mov qword [rsp + 0x58], r8
mov qword [r14 + r8*8], r9
je 0x46309b
movzx edx, byte [rdi + 0x2fc]
mov ebp, dword [rdi + 0x2f8]
lea eax, [r11 + r11]
mov ecx, edx
mov r12d, r15d
shl r12d, cl
sar eax, cl
test eax, eax
mov dword [rsp + 0x34], r12d
je 0x462c92
nop
nop
movzx ecx, dl
mov eax, r11d
inc dl
sar eax, cl
test eax, eax
jne 0x462c30
cmp dl, 3
mov byte [rdi + 0x2fc], dl
jae 0x462c50
mov byte [rdi + 0x2fc], 3
movzx ecx, byte [rdi + 0x2fc]
mov r12d, r15d
shl r12d, cl
mov rcx, qword [rdi + 0x2f0]
movsxd rdx, r12d
mov dword [rsp + 0x34], r12d
shl rdx, 4
call qword [rdi + 0x20]
test rax, rax
je 0x4631cc
mov r8, qword [rsp + 0x58]
mov r10d, dword [rsp + 0x30]
mov qword [rdi + 0x2f0], rax
xor r9d, r9d
jmp 0x462c96
test ebp, ebp
jne 0x462cc3
test r12d, r12d
mov ebp, 0xffffffff
movsxd rcx, r12d
je 0x462cc3
mov rdx, rcx
shl rdx, 4
nop
nop
mov rax, qword [rdi + 0x2f0]
sub rdx, 0x10
dec rcx
mov dword [rdx + rax], ebp
jne 0x462cb0
add ebp, 0xffffffff
test r8, r8
mov rax, r9
mov dword [rsp + 0x38], ebp
mov dword [rdi + 0x2f8], ebp
mov qword [rsp + 0x50], r9
jle 0x4630a2
mov rsi, qword [r14 + rax*8]
cmp byte [rsi - 1], 2
jne 0x46305b
mov rdx, qword [rsp + 0x60]
mov byte [rsi - 1], 0
mov r14d, r9d
mov r12, qword [rdx + 0x60]
test r12, r12
jne 0x462d0c
mov rax, r9
jmp 0x462dc3
movzx ebx, byte [rsi]
mov rcx, rsi
mov r10d, r9d
test bl, bl
je 0x462d36
movzx eax, bl
nop
imul r10d, r10d, 0xf4243
movzx eax, al
inc rcx
xor r10d, eax
mov al, byte [rcx]
test al, al
jne 0x462d20
mov r11, qword [rdx + 0x50]
lea ebp, [r12 - 1]
mov r8d, r10d
mov eax, ebp
xor r9b, r9b
and r8, rax
cmp qword [r11 + r8*8], 0
je 0x462dbd
mov rax, qword [r11 + r8*8]
mov rcx, qword [rax]
cmp bl, byte [rcx]
jne 0x462d7d
mov rdx, rsi
movzx eax, bl
sub rdx, rcx
test al, al
je 0x462f57
mov al, byte [rcx + rdx + 1]
inc rcx
cmp al, byte [rcx]
je 0x462d65
mov rdx, qword [rsp + 0x60]
test r9b, r9b
jne 0x462d9f
mov al, byte [rdx + 0x58]
mov r9d, ebp
not r9d
lea ecx, [rax - 1]
mov eax, ebp
and r9d, r10d
shr eax, 2
shr r9d, cl
and r9b, al
or r9b, r15b
movzx ecx, r9b
cmp r8, rcx
jae 0x462db3
mov rax, r12
sub rax, rcx
add r8, rax
jmp 0x462db6
sub r8, rcx
cmp qword [r11 + r8*8], 0
jne 0x462d51
xor r9d, r9d
mov rax, r9
mov rax, qword [rax + 8]
mov r13, qword [rax + 8]
test r13, r13
je 0x463104
cmp dword [r13 + 0x28], 0
mov r12d, r9d
mov rbx, r9
jle 0x462e40
mov rax, qword [r13 + 0x20]
movzx ebp, byte [rbx + rax]
mov rax, qword [rdi + 0x318]
cmp qword [rdi + 0x320], rax
jne 0x462e0d
lea rcx, [rdi + 0x308]
call fcn.0045da30
test al, al
je 0x4631cc
mov rax, qword [rdi + 0x320]
imul r14d, r14d, 0xf4243
inc r12d
mov byte [rax], bpl
inc qword [rdi + 0x320]
movzx eax, bpl
xor r14d, eax
inc rbx
cmp r12d, dword [r13 + 0x28]
jl 0x462de1
nop
nop
movzx eax, byte [rsi]
inc rsi
cmp al, 0x3a
jne 0x462e40
nop
nop
mov rax, qword [rdi + 0x318]
movzx ebx, byte [rsi]
cmp qword [rdi + 0x320], rax
jne 0x462e77
lea rcx, [rdi + 0x308]
call fcn.0045da30
test al, al
je 0x4631cc
movzx eax, byte [rsi]
mov rcx, qword [rdi + 0x320]
imul r14d, r14d, 0xf4243
mov byte [rcx], al
inc qword [rdi + 0x320]
mov r11, qword [rdi + 0x320]
movzx eax, bl
inc rsi
xor r14d, eax
movzx eax, byte [rsi - 1]
test al, al
jne 0x462e50
mov r12d, dword [rsp + 0x34]
mov r10, qword [rdi + 0x2f0]
mov ebp, dword [rsp + 0x38]
lea ebx, [r12 - 1]
xor r9b, r9b
mov esi, ebx
and esi, r14d
movsxd r8, esi
mov rdx, r8
shl rdx, 4
cmp dword [rdx + r10], ebp
jne 0x462f7f
nop
nop
cmp r14d, dword [rdx + r10 + 4]
jne 0x462f21
mov rax, qword [rdx + r10 + 8]
mov rcx, qword [rdi + 0x328]
movzx edx, byte [rcx]
cmp dl, byte [rax]
jne 0x462f18
add r8, r8
mov rax, qword [r10 + r8*8 + 8]
sub rax, rcx
test dl, dl
je 0x462aac
mov dl, byte [rcx + 1]
inc rcx
cmp dl, byte [rcx + rax]
je 0x462f05
cmp byte [rcx], 0
je 0x462aac
test r9b, r9b
jne 0x462f46
mov al, byte [rdi + 0x2fc]
mov r9d, ebx
not r9d
lea ecx, [rax - 1]
mov eax, ebx
and r9d, r14d
shr eax, 2
shr r9d, cl
and r9b, al
or r9b, r15b
movzx ecx, r9b
cmp esi, ecx
jge 0x462f63
mov eax, r12d
sub eax, ecx
add esi, eax
jmp 0x462f65
mov rax, qword [r11 + r8*8]
xor r9d, r9d
jmp 0x462dc3
sub esi, ecx
mov rax, qword [rdi + 0x2f0]
movsxd r8, esi
mov rdx, r8
shl rdx, 4
cmp dword [rdx + rax], ebp
je 0x462ee0
cmp byte [rdi + 0x1d1], 0
je 0x462fe9
movzx eax, byte [rdi + 0x374]
mov byte [r11 - 1], al
mov rax, qword [r13]
mov rbx, qword [rax]
nop
nop
mov rax, qword [rdi + 0x318]
cmp qword [rdi + 0x320], rax
jne 0x462fc4
lea rcx, [rdi + 0x308]
call fcn.0045da30
test al, al
je 0x4631cc
movzx eax, byte [rbx]
mov rcx, qword [rdi + 0x320]
inc rbx
mov byte [rcx], al
inc qword [rdi + 0x320]
movzx eax, byte [rbx - 1]
test al, al
mov r11, qword [rdi + 0x320]
jne 0x462fa0
mov rdx, qword [rdi + 0x328]
mov rax, qword [rsp + 0x50]
mov r9, qword [rsp + 0x40]
mov qword [rdi + 0x328], r11
mov r11d, dword [rsp + 0xc0]
mov qword [r9 + rax*8], rdx
mov rax, qword [rdi + 0x2f0]
movsxd rcx, esi
add rcx, rcx
dec r11d
mov dword [rax + rcx*8], ebp
mov rax, qword [rdi + 0x2f0]
mov dword [rsp + 0xc0], r11d
mov dword [rax + rcx*8 + 4], r14d
mov rax, qword [rdi + 0x2f0]
mov qword [rax + rcx*8 + 8], rdx
je 0x463086
mov rax, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov r10d, dword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
xor r9d, r9d
jmp 0x46305f
mov byte [rsi - 1], 0
add rax, 2
add r10d, 2
cmp rax, r8
mov dword [rsp + 0x30], r10d
mov qword [rsp + 0x50], rax
jl 0x462ce1
mov r9, qword [rsp + 0x40]
mov r13, qword [rsp + 0x48]
jmp 0x4630a7
mov r10d, dword [rsp + 0x30]
mov r8, qword [rsp + 0x58]
mov r13, qword [rsp + 0x48]
add r10d, 2
jmp 0x4630a7
mov r9, qword [rsp + 0x40]
jmp 0x4630a7
mov r9, qword [rsp + 0x40]
movsxd rcx, r10d
cmp rcx, r8
jge 0x4630c1
nop
mov rax, qword [r9 + rcx*8]
add rcx, 2
cmp rcx, r8
mov byte [rax - 1], 0
jl 0x4630b0
mov rax, qword [rsp + 0xe0]
mov rdx, qword [rax]
test rdx, rdx
je 0x4630e5
mov rax, qword [rdx + 0x18]
mov rcx, qword [rax]
mov byte [rcx - 1], 0
mov rdx, qword [rdx + 8]
test rdx, rdx
jne 0x4630d1
cmp byte [rdi + 0x1d0], 0
je 0x463264
mov rbx, qword [r13 + 8]
test rbx, rbx
je 0x46312c
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x46310e
mov eax, 0x1b
jmp 0x463266
mov r13, qword [rsp + 0xd8]
mov rsi, qword [r13]
nop
nop
movzx eax, byte [rsi]
inc rsi
cmp al, 0x3a
jne 0x463120
jmp 0x46314d
mov rbx, qword [rsp + 0x60]
mov rbx, qword [rbx + 0x138]
test rbx, rbx
je 0x463264
mov r13, qword [rsp + 0xd8]
mov rsi, qword [r13]
xor r14d, r14d
mov ebp, r14d
cmp byte [rdi + 0x1d1], bpl
je 0x46317c
mov rcx, qword [rbx]
cmp qword [rcx], rbp
je 0x46317c
mov rcx, qword [rcx]
nop
nop
nop
movzx eax, byte [rcx]
inc ebp
inc rcx
test al, al
jne 0x463170
mov qword [r13 + 8], rsi
mov eax, dword [rbx + 0x28]
mov dword [r13 + 0x1c], eax
mov rax, qword [rbx]
mov rcx, qword [rax]
mov dword [r13 + 0x20], ebp
mov qword [r13 + 0x10], rcx
mov rcx, rsi
nop
nop
movzx eax, byte [rcx]
inc r14d
inc rcx
test al, al
jne 0x4631a0
mov eax, dword [rbx + 0x28]
add eax, ebp
add eax, r14d
cmp eax, dword [rbx + 0x2c]
jle 0x46321d
lea r13d, [rax + 0x18]
movsxd rcx, r13d
call qword [rdi + 0x18]
test rax, rax
mov r12, rax
jne 0x4631d4
mov eax, r15d
jmp 0x463266
movsxd r8, dword [rbx + 0x28]
mov rdx, qword [rbx + 0x20]
mov rcx, rax
mov dword [rbx + 0x2c], r13d
call fcn.004435a0
mov r11, qword [rdi + 0x2b8]
test r11, r11
je 0x46320a
mov rax, qword [rbx + 0x20]
cmp qword [r11 + 0x18], rax
jne 0x463202
mov qword [r11 + 0x18], r12
mov r11, qword [r11]
test r11, r11
jne 0x4631f4
mov rcx, qword [rbx + 0x20]
call qword [rdi + 0x28]
mov r13, qword [rsp + 0xd8]
mov qword [rbx + 0x20], r12
movsxd r12, dword [rbx + 0x28]
movsxd r8, r14d
mov rdx, rsi
add r12, qword [rbx + 0x20]
mov rcx, r12
call fcn.004435a0
test ebp, ebp
je 0x46325c
lea eax, [r14 - 1]
movsxd r8, ebp
movsxd rcx, eax
movzx eax, byte [rdi + 0x374]
mov byte [r12 + rcx], al
mov rdx, qword [rbx]
lea rcx, [r12 + rcx + 1]
mov rdx, qword [rdx]
call fcn.004435a0
mov rax, qword [rbx + 0x20]
mov qword [r13], rax
xor eax, eax
mov r15, qword [rsp + 0x78]
mov r14, qword [rsp + 0x80]
mov r13, qword [rsp + 0x88]
mov r12, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x98]
mov rsi, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0xb0]
add rsp, 0xb8
ret