Function at 0x1400021f0
Capabilities:
Encode data using xor
Get session user name

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xb8]
sub rsp, 0x1b8
mov rbx, rcx
xor edi, edi
xor edx, edx
mov r8d, 0x109
lea rcx, [rbp - 0x60]
call fcn.1400090e0
mov dword [rbp + 0x118], 0x109
lea rdx, [rbp + 0x118]
lea rcx, [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], rdi
lea rax, [rbp - 0x60]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], dil
jne 0x140002260
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x28]
call fcn.140005030
nop
lea r8, [rsp + 0x28]
mov r10, qword [rsp + 0x28]
cmp qword [rsp + 0x40], 0x10
cmovae r8, r10
mov r9, qword [rsp + 0x38]
mov r12d, edi
mov dword [rbp + 0x108], edi
cmp byte [r9 + r8], 0
jne 0x1400022cb
mov rdx, rdi
test r9, r9
je 0x1400022cb
nop dword [rax]
movsx ecx, byte [rdx + r8]
imul r12d, r12d, 0x1f
add r12d, ecx
inc rdx
cmp rdx, r9
jb 0x1400022b0
mov dword [rbp + 0x108], r12d
mov dword [rbp + 0x110], r12d
mov rax, qword [rbx]
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400025d0
movsxd r13, dword [rax + 0x3c]
add r13, rax
mov qword [rsp + 0x48], r13
movzx eax, word [r13 + 0x14]
add rax, 0x18
add rax, r13
mov qword [rsp + 0x50], rax
mov r15d, edi
cmp di, word [r13 + 6]
jae 0x14000241d
mov r14, rax
mov r12, qword [rbp + 0x100]
nop dword [rax + rax]
movups xmm0, xmmword [r14]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [r14 + 0x10]
movups xmmword [rbp - 0x80], xmm1
movsd xmm0, qword [r14 + 0x20]
movsd qword [rbp - 0x70], xmm0
movq rsi, xmm1
shr rsi, 0x20
add rsi, qword [r12]
movd ebx, xmm1
test ebx, ebx
je 0x140002401
mov eax, dword [0x140032040]
mov dword [rsp + 0x20], eax
movzx eax, word [0x140032044]
mov word [rsp + 0x24], ax
mov byte [rsp + 0x20], 0x2e
xor byte [rsp + 0x21], 0x33
xor byte [rsp + 0x22], 0x34
xor byte [rsp + 0x23], 0x35
xor al, 0x36
mov byte [rsp + 0x24], al
xor byte [rsp + 0x25], 0x37
mov r8d, 8
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x70]
call fcn.14000d950
test eax, eax
je 0x140002401
mov r8d, edi
mov ecx, edi
test ebx, ebx
je 0x140002401
nop dword [rax]
mov eax, ebx
sub eax, ecx
cmp byte [rax + rsi], 0
jne 0x1400023c3
inc r8d
inc ecx
cmp ecx, ebx
jb 0x1400023b0
cmp r8d, 0x14
jb 0x140002401
mov eax, 0x14
cmova r8d, eax
mov eax, edi
test r8d, r8d
je 0x140002401
mov r9, rdi
nop dword [rax]
mov rcx, r9
and ecx, 3
movzx edx, al
xor dl, byte [rbp + rcx + 0x110]
mov ecx, ebx
sub ecx, eax
mov byte [rcx + rsi], dl
inc eax
inc r9
cmp eax, r8d
jb 0x1400023e0
inc r15d
add r14, 0x28
movzx eax, word [r13 + 6]
cmp r15d, eax
jl 0x140002320
mov r12d, dword [rbp + 0x108]
mov eax, dword [str..text]
mov dword [rbp + 0x108], eax
movzx eax, word [0x140031ea4]
mov word [rbp + 0x10c], ax
xor eax, eax
mov word [rbp + 0x10e], ax
mov eax, 0x38e38e39
imul r12d
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*8]
sub r12d, ecx
lea eax, [r12 + 1]
cdq
xor eax, edx
sub eax, edx
shl eax, 8
movsxd r13, eax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x58], xmm0
mov r14, rdi
mov qword [rsp + 0x68], rdi
mov rbx, rdi
mov rsi, rdi
test eax, eax
je 0x1400024fa
movabs rax, 0x7fffffffffffffff
cmp r13, rax
ja 0x140002622
cmp r13, 0x1000
jb 0x1400024c7
lea rcx, [r13 + 0x27]
cmp rcx, r13
jbe 0x140002628
call fcn.1400069c0
test rax, rax
je 0x14000262e
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x1400024d2
mov rcx, r13
call fcn.1400069c0
mov rbx, rax
mov r15, rbx
mov qword [rsp + 0x58], rbx
lea r14, [rbx + r13]
mov rsi, r14
mov qword [rsp + 0x68], r14
mov r8, r13
xor edx, edx
mov rcx, rbx
call fcn.1400090e0
mov qword [rsp + 0x60], r14
jmp 0x1400024ff
mov r15, qword [rsp + 0x58]
sub rsi, rbx
je 0x140002520
mov rcx, rdi
and ecx, 3
movzx eax, dil
xor al, byte [rbp + rcx + 0x110]
mov byte [rbx + rdi], al
inc rdi
cmp rdi, rsi
jb 0x140002504
mov r8, qword [rsp + 0x48]
add dword [r8 + 0x50], esi
movzx eax, word [r8 + 6]
lea rcx, [rax + rax*4]
mov rax, qword [rsp + 0x50]
lea r10, [rax + rcx*8]
mov ecx, dword [r10 - 0x1c]
mov edx, dword [r10 - 0x20]
add ecx, 0xfff
add edx, ecx
and edx, 0xfffff000
mov ecx, dword [r10 - 0x18]
add ecx, dword [r10 - 0x14]
mov rax, qword [rbp + 0x108]
mov qword [r10], rax
mov dword [r10 + 8], esi
mov dword [r10 + 0xc], edx
mov dword [r10 + 0x10], esi
mov dword [r10 + 0x14], ecx
mov dword [r10 + 0x24], 0xe0000000
inc word [r8 + 6]
mov rcx, qword [rbp + 0x100]
mov rdx, qword [rcx + 8]
mov r9, rsi
mov r8, rbx
call fcn.140005780
nop
test r15, r15
je 0x1400025cb
sub r14, r15
mov rax, r15
cmp r14, 0x1000
jb 0x1400025c0
add r14, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000262e
mov rdx, r14
mov rcx, r15
call fcn.1400069b8
mov r10, qword [rsp + 0x28]
mov rax, qword [rsp + 0x40]
cmp rax, 0x10
jb 0x140002608
lea rdx, [rax + 1]
mov rax, r10
cmp rdx, 0x1000
jb 0x140002600
add rdx, 0x27
mov r10, qword [r10 - 8]
sub rax, r10
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000261c
mov rcx, r10
call fcn.1400069b8
add rsp, 0x1b8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14001129c
nop
call fcn.140005760
nop
call fcn.140001180
int3
call fcn.14001129c
int3