Function at 0x1400a0fe0
Capabilities:
Encode data using xor
Get file attributes
Get session user name
Set file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1e0]
sub rsp, 0x2e0
mov rax, qword [0x1402ba030]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
mov rdi, rcx
xor r13d, r13d
mov dword [rbp - 0x80], r13d
mov rdx, qword [rcx]
movzx edx, byte [rdx + 0x54]
lea rcx, [0x1402bcc0c]
call fcn.140095770
mov dword [rsp + 0x40], 0x59b16309
mov dword [rsp + 0x44], 0xeb11b6fa
mov dword [rsp + 0x48], 0x5b2ab2e0
mov dword [rsp + 0x4c], 0xc6ec57fe
mov dword [rsp + 0x50], 0x8ff64cfb
mov dword [rsp + 0x54], 0xc084a34d
mov dword [rsp + 0x58], 0x99efc16c
mov word [rsp + 0x5c], 0xece4
mov qword [rsp + 0x38], r13
mov rax, qword [rsp + 0x38]
nop
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x38]
movzx edx, byte [rsp + rcx + 0x40]
sub dl, byte [rsp + rax + 0x4f]
mov byte [rsp + 0x30], dl
movzx ecx, byte [rsp + 0x30]
mov rax, qword [rsp + 0x38]
mov byte [rbp + rax + 0xb0], cl
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp rax, 0xf
jb 0x1400a1080
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp], r13
mov qword [rbp + 8], r13
mov r8d, reloc.WLDAP32.dll_Ordinal_14
lea rdx, [rbp + 0xb0]
lea rcx, [rbp - 0x10]
call fcn.14006abf0
lea rax, [rbp - 0x10]
mov qword [rsp + 0x38], rax
mov rcx, qword [0x1402bc5a0]
add rcx, 8
lea rax, [rbp - 0x10]
cmp rcx, rax
je 0x1400a111a
lea rdx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rdx, qword [rbp - 0x10]
mov r8, qword [rbp]
call fcn.14005f580
nop
lea rcx, [rbp - 0x10]
call fcn.14005f2e0
mov rcx, qword [rdi + 0x10]
sub rcx, qword [rdi + 8]
movabs rax, 0xc30c30c30c30c30d
imul rcx
add rdx, rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, qword [rdi]
movsxd rcx, dword [rax + 0x50]
cmp rcx, rdx
jae 0x1400a17a6
mov dword [rbp + 0xa8], 0x104
lea rdx, [rbp + 0xa8]
lea rcx, [rbp + 0xc0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea rdx, [rbp + 0x88]
call fcn.14007f970
nop
lea r10, [rbp + 0xc0]
mov r9d, r13d
movzx r8d, byte [rbp + 0xc0]
test r8b, r8b
je 0x1400a11d8
nop dword [rax + rax]
movzx edx, r8b
lea r10, [r10 + 1]
sub r8b, 0x41
lea eax, [rdx + 0x20]
movzx ecx, al
cmp r8b, 0x19
cmova ecx, edx
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx r8d, byte [r10]
test r8b, r8b
jne 0x1400a11a0
lea ecx, [r9 + r9*8]
mov eax, ecx
shr eax, 0xb
xor ecx, eax
imul eax, ecx, 0x8001
mov dword [rbp + 0x18], eax
movabs rax, 0x2000000000000000
mov qword [rbp + 0x10], rax
mov qword [rbp - 0x70], 1
lea rax, [rbp + 0x10]
mov qword [rbp - 0x68], rax
lea rax, str..dat
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 6
movaps xmm0, xmmword [rbp - 0x70]
movdqa xmmword [rbp - 0x70], xmm0
movaps xmm1, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm1
lea r8, [rbp - 0x70]
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x30]
call fcn.1400628e0
nop
lea rax, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rax, qword [rbp - 0x30]
mov qword [rbp - 0x50], rax
mov rax, qword [rbp - 0x20]
mov qword [rbp - 0x48], rax
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x60]
call fcn.14006f020
nop
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x88]
call fcn.140048990
nop
lea rcx, [rsp + 0x60]
call fcn.14005f270
nop
lea rcx, [rbp - 0x30]
call fcn.14005f2e0
lea r14, [rbp + 0x88]
cmp qword [rbp + 0xa0], 8
cmovae r14, qword [rbp + 0x88]
mov rsi, qword [rbp + 0x98]
call fcn.140151bec
mov r15d, eax
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
movdqa xmm1, xmmword [0x1402973d0]
movdqu xmmword [rbp - 0x60], xmm1
mov byte [rbp - 0x70], 0
mov dword [rbp - 0x80], Ordinal_147
test rsi, rsi
je 0x1400a134e
cmp rsi, 0x7fffffff
ja 0x1400a17e9
mov dword [rsp + 0x20], r13d
xor r9d, r9d
mov r8d, esi
mov rdx, r14
mov ecx, eax
call fcn.140151c5c
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x1400a17ef
movsxd rdx, ebx
xor r8d, r8d
lea rcx, [rbp - 0x70]
call fcn.14005f340
lea r9, [rbp - 0x70]
cmp qword [rbp - 0x58], 0x10
cmovae r9, qword [rbp - 0x70]
mov dword [rsp + 0x20], ebx
mov r8d, esi
mov rdx, r14
mov ecx, r15d
call fcn.140151c5c
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x1400a17fb
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 0x10
cmovae rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov r12d, eax
and r12d, 0xfffffffd
lea r14, [rbp + 0x88]
cmp qword [rbp + 0xa0], 8
cmovae r14, qword [rbp + 0x88]
mov rsi, qword [rbp + 0x98]
call fcn.140151bec
mov r15d, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [0x1402973d0]
movdqu xmmword [rsp + 0x70], xmm1
mov byte [rsp + 0x60], 0
mov dword [rbp - 0x80], 0x87f
test rsi, rsi
je 0x1400a1429
cmp rsi, 0x7fffffff
ja 0x1400a1805
mov dword [rsp + 0x20], r13d
xor r9d, r9d
mov r8d, esi
mov rdx, r14
mov ecx, eax
call fcn.140151c5c
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x1400a180b
movsxd rdx, ebx
xor r8d, r8d
lea rcx, [rsp + 0x60]
call fcn.14005f340
lea r9, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae r9, qword [rsp + 0x60]
mov dword [rsp + 0x20], ebx
mov r8d, esi
mov rdx, r14
mov ecx, r15d
call fcn.140151c5c
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x1400a1817
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rcx, qword [rsp + 0x60]
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rsp + 0x60]
call fcn.14005f2e0
nop
lea rcx, [rbp - 0x70]
call fcn.14005f2e0
lea rax, [rbp - 0x50]
mov qword [rsp + 0x38], rax
lea rdx, [rbp - 0x50]
mov rcx, qword [0x1402bc368]
call fcn.14004d370
mov r12, rax
lea rax, [rbp + 0x40]
mov qword [rbp + 0x10], rax
lea rax, vtable.std::_Func_impl_no_alloc_class__public:_void___cdecl__private:_void___cdecl_CUserInterface::RenderBase_void____ptr64::_28::_lambda_1_::operator___void____ptr64::_5::_lambda_1___int__long_long___int64___long_long___int64__.0
mov qword [rbp + 0x40], rax
lea rax, [rbp + 0x40]
mov qword [rbp + 0x78], rax
mov byte [rbp + 0x80], 1
lea rax, [rbp - 0x30]
mov qword [rbp + 0xb0], rax
lea r14, [rbp + 0x88]
cmp qword [rbp + 0xa0], 8
cmovae r14, qword [rbp + 0x88]
mov rsi, qword [rbp + 0x98]
call fcn.140151bec
mov r15d, eax
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x30], 0
mov dword [rbp - 0x80], 0x877f
test rsi, rsi
je 0x1400a1558
cmp rsi, 0x7fffffff
ja 0x1400a1821
mov dword [rsp + 0x20], r13d
xor r9d, r9d
mov r8d, esi
mov rdx, r14
mov ecx, eax
call fcn.140151c5c
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x1400a1827
movsxd rdx, ebx
xor r8d, r8d
lea rcx, [rbp - 0x30]
call fcn.14005f340
lea r9, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae r9, qword [rbp - 0x30]
mov dword [rsp + 0x20], ebx
mov r8d, esi
mov rdx, r14
mov ecx, r15d
call fcn.140151c5c
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x1400a1833
mov rcx, qword [rdi]
movsxd r8, dword [rcx + 0x50]
mov r9, qword [rdi + 8]
mov rcx, qword [rdi + 0x10]
sub rcx, r9
movabs rax, 0xc30c30c30c30c30d
imul rcx
add rdx, rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rdx, r8
jbe 0x1400a183d
imul rdx, r8, 0xa8
add r9, 0x48
add rdx, r9
lea rcx, [rbp + 0x20]
call fcn.14005d3f0
nop
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x40]
lea r8, [rbp - 0x30]
lea rdx, [rbp + 0x20]
call fcn.14007c760
lea r14, [rbp + 0x88]
cmp qword [rbp + 0xa0], 8
cmovae r14, qword [rbp + 0x88]
mov rsi, qword [rbp + 0x98]
call fcn.140151bec
mov r15d, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [0x1402973d0]
movdqu xmmword [rsp + 0x70], xmm1
mov byte [rsp + 0x60], 0
mov dword [rbp - 0x80], 0x11777f
test rsi, rsi
je 0x1400a167f
cmp rsi, 0x7fffffff
ja 0x1400a1843
mov dword [rsp + 0x20], r13d
xor r9d, r9d
mov r8d, esi
mov rdx, r14
mov ecx, eax
call fcn.140151c5c
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x1400a1849
movsxd rdx, ebx
xor r8d, r8d
lea rcx, [rsp + 0x60]
call fcn.14005f340
lea r9, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae r9, qword [rsp + 0x60]
mov dword [rsp + 0x20], ebx
mov r8d, esi
mov rdx, r14
mov ecx, r15d
call fcn.140151c5c
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x1400a1855
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov r15d, eax
or r15d, 2
lea r14, [rbp + 0x88]
cmp qword [rbp + 0xa0], 8
cmovae r14, qword [rbp + 0x88]
mov rsi, qword [rbp + 0x98]
call fcn.140151bec
mov r12d, eax
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
movdqa xmm1, xmmword [0x1402973d0]
movdqu xmmword [rbp - 0x40], xmm1
mov byte [rbp - 0x50], 0
mov dword [rbp - 0x80], 0x10f777f
test rsi, rsi
je 0x1400a1756
cmp rsi, 0x7fffffff
ja 0x1400a185f
mov dword [rsp + 0x20], r13d
xor r9d, r9d
mov r8d, esi
mov rdx, r14
mov ecx, eax
call fcn.140151c5c
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x1400a1865
movsxd rdx, ebx
xor r8d, r8d
lea rcx, [rbp - 0x50]
call fcn.14005f340
lea r9, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae r9, qword [rbp - 0x50]
mov dword [rsp + 0x20], ebx
mov r8d, esi
mov rdx, r14
mov ecx, r12d
call fcn.140151c5c
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x1400a17df
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rcx, qword [rbp - 0x50]
mov edx, r15d
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rbp - 0x50]
call fcn.14005f2e0
nop
lea rcx, [rsp + 0x60]
call fcn.14005f2e0
lea rdx, [rbp + 0x88]
lea rcx, [rbp + 0x20]
call fcn.140049100
mov rdx, rax
call fcn.140096340
nop
lea rcx, [rbp + 0x88]
call fcn.14005f270
mov rax, qword [rdi]
mov dword [rax], 2
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.1401526c0
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
shr rcx, 0x20
call fcn.140046e10
nop
call fcn.140046b40
int3
shr rbx, 0x20
mov ecx, ebx
call fcn.140046e10
int3
shr rcx, 0x20
call fcn.140046e10
nop
call fcn.140046b40
int3
shr rbx, 0x20
mov ecx, ebx
call fcn.140046e10
int3
shr rcx, 0x20
call fcn.140046e10
nop
call fcn.140046b40
int3
shr rbx, 0x20
mov ecx, ebx
call fcn.140046e10
int3
shr rcx, 0x20
call fcn.140046e10
nop
call fcn.14005ea00
nop
call fcn.140046b40
int3
shr rbx, 0x20
mov ecx, ebx
call fcn.140046e10
int3
shr rcx, 0x20
call fcn.140046e10
nop
call fcn.140046b40
int3
shr rbx, 0x20
mov ecx, ebx
call fcn.140046e10
int3