Function at 0x1400d6420
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov r14, rdx
mov rsi, rcx
mov eax, 0xb0015c0b
nop word cs:[rax + rax]
mov ecx, dword [0x141dd8ea8]
add ecx, dword [0x141dd8eac]
imul ecx, ecx, 0x7bd0c6b3
imul rcx, rax
shr rcx, 0x3f
imul ecx, ecx, 0xf5ebd45e
cmp ecx, 0xb7f8f3e0
je 0x1400d6440
test r14, r14
je 0x1400d6511
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
nop word [rax + rax]
mov ecx, dword [0x141dd8eb8]
imul ecx, dword [0x141dd8ebc]
and ecx, 0xcea17405
xor ecx, 0x582370b0
add ecx, 0x6c2c74c0
cmp ecx, 0x2b5b27c0
jb 0x1400d6480
test eax, eax
je 0x1400d6543
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov ebx, eax
nop word [rax + rax]
mov eax, dword [0x141dd8ec8]
and eax, dword [0x141dd8ecc]
imul eax, eax, 0xb5c8e8ca
cmp eax, 0x153f04f6
je 0x1400d64c0
test rbx, rbx
je 0x1400d658c
mov eax, dword [str._tMG_a]
and eax, dword [0x141dd8ed4]
add eax, 0x9122e763
mov ecx, 0x96afe34f
imul rcx, rax
shr rcx, 0x3f
cmp ecx, 0x8f868415
jne 0x1400d664f
jmp 0x1400d667d
movabs rax, 0x8000000000000000
mov qword [rsi], rax
nop
mov eax, dword [0x141dd8eb0]
xor eax, dword [0x141dd8eb4]
imul rax, rax, 0x3e010c9b
shr rax, 0x3d
cmp eax, 0x9412e6d6
je 0x1400d6520
jmp 0x1400d69d7
movabs rax, 0x8000000000000000
mov ecx, dword [0x141dd8ec0]
add ecx, dword [0x141dd8ec4]
imul ecx, ecx, 0x82db1760
or ecx, 0x6770853c
imul ecx, ecx, 0x4372ebd5
cmp ecx, 0x2dd95cca
jne 0x1400d6576
mov qword [rsi], rax
mov cl, 1
nop dword [rax + rax]
mov qword [rsi], rax
test cl, cl
je 0x1400d6580
jmp 0x1400d69d7
mov edx, 1
xor ecx, ecx
mov r8, r14
call qword [sym.imp.ADVAPI32.dll_CopySid]
nop dword [rax]
mov ecx, dword [str.0L2]
xor ecx, dword [0x141dd8ef4]
and ecx, 0x2900000
cmp ecx, 0x2b0ef2c8
ja 0x1400d65a0
nop word [rax + rax]
mov ecx, dword [0x141dd8ef8]
xor ecx, dword [0x141dd8efc]
and ecx, 0x8e3cd6a9
imul ecx, ecx, 0x15786be7
or ecx, 0x779d05fd
cmp ecx, 0xe0c0e12d
ja 0x1400d65c0
test eax, eax
jne 0x1400d6629
call qword [sym.imp.KERNEL32.dll_GetLastError]
movabs rax, 0x8000000000000000
mov ecx, dword [0x141dd8f00]
sub ecx, dword [0x141dd8f04]
and ecx, 0xa97d7bd2
add ecx, 0x287ba8e8
xor ecx, 0x95d55dce
cmp ecx, 0x22014fc3
jae 0x1400d672f
jmp 0x1400d6757
mov eax, dword [0x141dd8f60]
or eax, dword [0x141dd8f64]
xor eax, 0x80526200
or eax, 0x592d9de8
cmp eax, 0x319306cd
jne 0x1400d69e2
jmp 0x1400d6a07
mov ebp, dword [0x141dd8ed8]
imul ebp, dword [0x141dd8edc]
xor ebp, 0x105af552
add ebp, 0xd613f42
mov ecx, 8
mov rdx, rbx
call fcn.1400c0a10
cmp ebp, 0x7ae16bfc
jbe 0x1400d668c
mov ecx, 8
mov rdx, rbx
call fcn.1400c0a10
jmp 0x1400d664f
mov rdi, rax
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x1400d66a0
test rdi, rdi
je 0x1400d66d4
mov eax, dword [0x141dd8f10]
sub eax, dword [0x141dd8f14]
add eax, 0x387051e1
xor eax, 0x3e510fe7
add eax, 0xf7937ee6
cmp eax, 0x7cc12554
jbe 0x1400d675c
jmp 0x1400d678f
xor eax, eax
test al, al
je 0x1400d66e0
ud2
mov eax, dword [0x141dd8ee0]
sub eax, dword [0x141dd8ee4]
and eax, 0x6b78bd25
xor eax, 0x396a2016
imul eax, eax, 0x5f5306e7
ud2
ud2
mov ecx, dword [0x141dd8f08]
imul ecx, dword [0x141dd8f0c]
xor ecx, 0x3a0000
and ecx, 0xb27e8000
mov qword [rsi], rax
cmp ecx, 0xb64405c3
jbe 0x1400d69d7
mov qword [rsi], rax
jmp 0x1400d672f
mov eax, dword [0x141dd8f18]
sub eax, dword [0x141dd8f1c]
and eax, 0x689169fe
imul ebp, eax, 0x9dd4ad28
add ebp, 0xea216650
mov ecx, ebx
mov rdx, rdi
mov r8, r14
call qword [sym.imp.ADVAPI32.dll_CopySid]
cmp ebp, 0x7ca2495
jae 0x1400d67a0
mov ecx, ebx
mov rdx, rdi
mov r8, r14
call qword [sym.imp.ADVAPI32.dll_CopySid]
jmp 0x1400d675c
mov ecx, dword [0x141dd8f20]
add ecx, dword [0x141dd8f24]
imul ecx, ecx, 0x25f8bbf6
and ecx, 0x5b01a42
imul ecx, ecx, 0xf1a05a0c
cmp ecx, 0x29cbb27b
jb 0x1400d67a0
test eax, eax
je 0x1400d6870
nop
mov eax, dword [0x141dd8f48]
mov ecx, dword [0x141dd8f4c]
add eax, ecx
add eax, 0xa3c84fb
or eax, 0x6a00042a
and eax, 0x6e28642e
cmp eax, 0x677a1a77
je 0x1400d67d0
movzx eax, byte [rdi]
nop word [rax + rax]
mov ecx, dword [0x141dd8f50]
or ecx, dword [0x141dd8f54]
and ecx, 0x9c04f520
add ecx, 0xf499129b
cmp ecx, 0x9e1e402d
ja 0x1400d6800
mov ecx, dword [0x141dd8f58]
or ecx, dword [0x141dd8f5c]
or ecx, 0xff4fddff
cmp ecx, 0x958e8c92
je 0x1400d6820
cmp al, 1
jne 0x1400d672d
mov eax, dword [0x141dd8f78]
mov ecx, dword [0x141dd8f7c]
add eax, ecx
add eax, 0x3dbe1d6f
xor eax, 0x27c11108
imul eax, eax, 0xbe02d930
cmp eax, 0x30f7dc94
jae 0x1400d695a
jmp 0x1400d6980
mov eax, dword [0x141dd8f28]
add eax, dword [0x141dd8f2c]
imul eax, eax, 0x1ef03f7e
add eax, 0x478aa470
cmp eax, 0x192dd03a
jae 0x1400d6894
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rbx, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov eax, dword [0x141dd8f30]
and eax, dword [0x141dd8f34]
imul r14d, eax, 0xad9832e2
imul rax, r14, 0x313c035
shr rax, 0x20
sub r14d, eax
shr r14d, 1
add r14d, eax
shr r14d, 0x1c
add r14d, 0xb9190049
call rbx
cmp r14d, 0x6416e50f
jb 0x1400d68a0
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov eax, dword [0x141dd8f38]
and eax, dword [0x141dd8f3c]
add eax, 0x7b16d15
cmp eax, 0x949efda1
jbe 0x1400d6914
mov rcx, qword [0x141ddc4e0]
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rsi, qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov eax, dword [0x141dd8f40]
imul eax, dword [0x141dd8f44]
xor eax, 0x60200002
or eax, 0x911bcbcd
imul rbx, rax, 0x36fa2873
shr rbx, 0x3d
mov rcx, qword [0x141ddc4e0]
xor edx, edx
mov r8, rdi
call rsi
cmp ebx, 0x9c9713b6
jae 0x1400d6920
jmp 0x1400d69d7
mov eax, dword [0x141dd8f80]
xor eax, dword [0x141dd8f84]
imul rax, rax, 0x66c5d5ef
shr rax, 0x3d
add eax, 0xb066982a
mov qword [rsi], rbx
cmp eax, 0x4a713786
jae 0x1400d6985
mov qword [rsi], rbx
jmp 0x1400d695a
mov eax, dword [0x141dd8f88]
xor edx, edx
div dword [0x141dd8f8c]
imul eax, eax, 0x1bf80b35
or eax, 0x8c33cc71
add eax, 0xe11d9a3b
cmp eax, 0x90d9f7ff
jbe 0x1400d69b0
mov qword [rsi + 8], rdi
nop
mov eax, dword [0x141dd8f90]
xor edx, edx
div dword [0x141dd8f94]
or eax, 0x4f97ffd1
add eax, 0x84625b3
mov qword [rsi + 8], rdi
cmp eax, 0x1a210418
jb 0x1400d69b0
mov qword [rsi + 0x10], rbx
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov eax, dword [0x141dd8f68]
sub eax, dword [0x141dd8f6c]
and eax, 0x296b3750
imul eax, eax, 0x55389f62
add eax, 0x588c5c21
ud2
ud2