Function at 0x1400d4f90
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov eax, 0xaa653e09
nop word cs:[rax + rax]
mov ecx, dword [0x141dd8478]
or ecx, dword [0x141dd847c]
add ecx, 0x17b2d1da
imul rcx, rax
shr rcx, 0x3f
cmp ecx, 0xb5971cac
je 0x1400d4fb0
test rdi, rdi
je 0x1400d4fff
mov eax, dword [0x141dd8490]
add eax, dword [0x141dd8494]
or eax, 0xb09c1331
imul eax, eax, 0x7d370927
xor eax, 0x58ccca73
cmp eax, 0x3965ce87
jbe 0x1400d506a
jmp 0x1400d50a7
movabs rax, 0x8000000000000000
mov ecx, dword [0x141dd8480]
and ecx, dword [0x141dd8484]
add ecx, 0xdb40d81f
or ecx, 0xdc05dfef
and ecx, 0xdfa5dfef
cmp ecx, 0xe3749163
ja 0x1400d5065
mov ecx, dword [0x141dd8488]
mov edx, dword [0x141dd848c]
add ecx, edx
add ecx, 0xb6f51cd2
mov edx, 0xb1c6046b
imul rdx, rcx
shr rdx, 0x3f
or edx, 0x635baf7e
mov qword [rsi], rax
cmp edx, 0xb25ea56
ja 0x1400d556a
mov qword [rsi], rax
jmp 0x1400d502f
mov ebx, dword [0x141dd8498]
add ebx, dword [0x141dd849c]
imul rax, rbx, 0x139eb9c9
shr rax, 0x20
sub ebx, eax
shr ebx, 1
add ebx, eax
shr ebx, 0x1f
add ebx, 0x8cd0035b
and ebx, 0xc10004a
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
cmp ebx, 0x951cac8e
jbe 0x1400d50c0
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
jmp 0x1400d506a
mov ecx, dword [0x141dd84a0]
or ecx, dword [0x141dd84a4]
imul ecx, ecx, 0x575e012f
add ecx, 0xd8fafa5e
imul rdx, rcx, 0x1fcd02ad
shr rdx, 0x20
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 0x1d
cmp ecx, 0xdec75283
je 0x1400d50c0
nop word cs:[rax + rax]
mov ecx, dword [0x141dd84a8]
and ecx, dword [0x141dd84ac]
imul ecx, ecx, 0xf01c9c34
or ecx, 0x21a71234
xor ecx, 0xff657539
cmp ecx, 0xb2f6939c
ja 0x1400d5100
test eax, eax
je 0x1400d52b7
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov ebx, eax
nop dword [rax]
mov eax, dword [0x141dd84b0]
sub eax, dword [0x141dd84b4]
add eax, 0xcde914eb
and eax, 0x5bb48cea
imul rax, rax, 0x6ecf031
shr rax, 0x39
cmp eax, 0xfb873596
ja 0x1400d5140
test rbx, rbx
je 0x1400d52c9
mov eax, dword [0x141dd84b8]
imul eax, dword [0x141dd84bc]
imul eax, eax, 0x428f6016
add eax, 0xdaf2ca2e
or eax, 0x124c3e17
cmp eax, 0x8476af6f
jbe 0x1400d51b0
mov ecx, 8
mov rdx, rbx
call fcn.1400bf820
nop word cs:[rax + rax]
mov eax, dword [0x141dd84c0]
xor edx, edx
div dword [0x141dd84c4]
mov ebp, eax
and ebp, 0x44128822
or ebp, 0x29ed44cc
xor ebp, 0x9be28488
mov ecx, 8
mov rdx, rbx
call fcn.1400bf820
cmp ebp, 0xa7a27388
jb 0x1400d51b0
mov r14, rax
nop word [rax + rax]
mov eax, dword [0x141dd84c8]
sub eax, dword [0x141dd84cc]
or eax, 0xb564b348
imul eax, eax, 0x4d059556
cmp eax, 0xac8b4763
je 0x1400d51f0
test r14, r14
je 0x1400d54bd
mov ecx, ebx
mov rdx, r14
mov r8, rdi
call qword [sym.imp.ADVAPI32.dll_CopySid]
nop word cs:[rax + rax]
mov ecx, dword [0x141dd8510]
and ecx, dword [0x141dd8514]
or ecx, 0x1ae7b5cd
and ecx, 0x9ae7f5dd
cmp ecx, 0xa482eb5f
ja 0x1400d5230
mov ecx, dword [str.O_nrZ]
mov edx, dword [0x141dd851c]
add ecx, edx
add ecx, 0x91c1dcf2
xor ecx, 0x61401800
or ecx, 0x9c98e5fb
cmp ecx, 0x122d9319
je 0x1400d5250
test eax, eax
je 0x1400d5438
cmp byte [r14], 1
jne 0x1400d5536
mov qword [rsi], rbx
mov eax, dword [str.hEA]
and eax, dword [0x141dd8544]
mov qword [rsi + 8], r14
or eax, 0xfebeeee6
add eax, 0x286e9517
cmp eax, 0xa5a38e72
jbe 0x1400d5538
jmp 0x1400d5564
movabs rax, 0x8000000000000000
mov qword [rsi], rax
jmp 0x1400d556a
mov edx, 1
xor ecx, ecx
mov r8, rdi
call qword [sym.imp.ADVAPI32.dll_CopySid]
mov ecx, eax
nop dword [rax + rax]
mov eax, dword [0x141dd84d8]
xor eax, dword [0x141dd84dc]
xor eax, 0x45836
and eax, 0x4257c7f
imul eax, eax, 0xcc6cfeb8
cmp eax, 0x7a0ca052
ja 0x1400d52e0
nop word cs:[rax + rax]
mov eax, dword [0x141dd84e0]
xor edx, edx
div dword [0x141dd84e4]
or eax, 0xa3974e71
add eax, 0x1fff43cc
cmp eax, 0x2ef28884
jb 0x1400d5310
test ecx, ecx
jne 0x1400d54c5
mov eax, dword [0x141dd84e8]
and eax, dword [0x141dd84ec]
add eax, 0x3467dd41
shr eax, 1
imul rax, rax, 0x159da449
shr rax, 0x3a
add eax, 0xc16fdd0e
cmp eax, 0xcb52eb71
jbe 0x1400d5367
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ebx, dword [0x141dd84f0]
add ebx, dword [0x141dd84f4]
or ebx, 0x4f537cb5
and ebx, 0xef57ffb5
call rdi
cmp ebx, 0xa6bd0674
je 0x1400d5370
movabs rax, 0x8000000000000000
mov ecx, dword [0x141dd84f8]
and ecx, dword [str.srdk]
add ecx, 0x4d49f9ab
imul rcx, rcx, 0x7db2f563
shr rcx, 0x3e
cmp ecx, 0x9c5bff7c
jbe 0x1400d53d0
mov qword [rsi], rax
nop word cs:[rax + rax]
mov ecx, dword [0x141dd8500]
xor ecx, dword [0x141dd8504]
add ecx, 0x674484d9
and ecx, 0x89dbbef1
imul rdx, rcx, 0x1e74249
shr rdx, 0x20
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 0x1f
mov qword [rsi], rax
cmp ecx, 0x86227af9
ja 0x1400d53d0
nop word [rax + rax]
mov eax, dword [0x141dd8508]
add eax, dword [0x141dd850c]
imul eax, eax, 0x6f6ca135
xor eax, 0x8482015
or eax, 0x43b45bea
cmp eax, 0xda3fb775
jae 0x1400d5410
jmp 0x1400d556a
mov eax, dword [0x141dd8520]
xor eax, dword [0x141dd8524]
imul rax, rax, 0x72ce5f29
shr rax, 0x3e
imul eax, eax, 0xe6644b0e
add eax, 0x1d8077c6
cmp eax, 0x55aa82f0
jbe 0x1400d5467
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ebx, dword [0x141dd8528]
imul ebx, dword [0x141dd852c]
add ebx, 0x4c151119
and ebx, 0x20000242
call rdi
cmp ebx, 0xe206caa5
ja 0x1400d5470
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rcx, qword [0x141ddb9a0]
xor edx, edx
mov r8, r14
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
jmp qword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
test al, al
je 0x1400d551d
jmp 0x1400d5532
mov eax, dword [0x141dd8530]
and eax, dword [0x141dd8534]
imul eax, eax, 0x8f54dbbb
cmp eax, 0xb8ca0ac9
jne 0x1400d54e0
ud2
xor eax, eax
ud2
mov eax, dword [0x141dd84d0]
sub eax, dword [0x141dd84d4]
ud2
ud2
ud2
mov eax, dword [0x141dd8548]
or eax, dword [0x141dd854c]
imul rax, rax, 0x28d8aadb
shr rax, 0x3d
add eax, 0xa2c1ccab
xor eax, 0x9970d7cc
mov qword [rsi + 0x10], rbx
cmp eax, 0x179edb6e
jae 0x1400d556a
mov qword [rsi + 0x10], rbx
jmp 0x1400d5538
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret