Function at 0x1401d68b0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x1401d68d0
test rdi, rdi
je 0x1401d69e7
mov eax, dword [str.OnytI]
or eax, dword [0x1415a7e8c]
and eax, 0xfa095ef3
imul eax, eax, 0xa8aa9fd0
add eax, 0x36cedaf0
cmp eax, 0x4dcd7ffb
jae 0x1401d6909
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
mov rbx, qword [sym.imp.ADVAPI32.dll_IsValidSid]
mov ebp, dword [0x1415a7e94]
add ebp, dword [0x1415a7e90]
mov eax, ebp
or eax, 0x200008
not ebp
or ebp, 0x20090100
and ebp, eax
not ebp
or ebp, 0x5f06fac7
and ebp, 0x7f2ffbcf
mov rcx, rdi
call rbx
cmp ebp, 0x8a3addf7
ja 0x1401d6910
nop dword [rax + rax]
mov ecx, dword [0x1415a7e98]
mov edx, dword [0x1415a7e9c]
add ecx, edx
add ecx, 0xb2df7210
mov edx, ecx
and edx, 0x18ea0de7
add edx, edx
sub ecx, edx
add ecx, 0x98ea0de7
or ecx, 0x3da76e54
cmp ecx, 0xb1e69fbc
jb 0x1401d6950
nop word cs:[rax + rax]
mov ecx, dword [0x1415a7ea0]
and ecx, dword [0x1415a7ea4]
and ecx, 0x1a7bdd39
add ecx, 0x2d166854
cmp ecx, 0x9e4b06b7
ja 0x1401d6990
test eax, eax
je 0x1401d6a25
mov eax, dword [0x1415a7ec0]
mov ecx, dword [0x1415a7ec4]
xor ecx, eax
not ecx
and ecx, eax
xor ecx, 0x5ca47071
imul eax, ecx, 0xe059ca22
or eax, 0x71403ed2
cmp eax, 0xfe2b8b36
jbe 0x1401d6b97
jmp 0x1401d6ba8
mov eax, dword [0x1415a7e70]
xor edx, edx
div dword [0x1415a7e74]
movabs rcx, 0x8000000000000000
xor eax, 0xb0e79084
shr eax, 2
imul rax, rax, 0xcf25ccd
shr rax, 0x35
and eax, 0xfffffff8
cmp eax, 0x40dc7104
jbe 0x1401d6ad3
jmp 0x1401d6b05
movabs rax, 0x8000000000000000
mov edx, dword [0x1415a7eb0]
mov ecx, dword [0x1415a7eb4]
mov r8d, ecx
not r8d
and r8d, edx
xor ecx, edx
add ecx, edx
sub ecx, r8d
mov edx, ecx
not edx
mov r8d, ecx
and r8d, 0xb74f62a
and edx, 0xf48b09d5
imul edx, r8d
mov r8d, ecx
and r8d, 0xf48b09d5
or ecx, 0xf48b09d5
imul ecx, r8d
add ecx, edx
xor ecx, 0x960504e0
or ecx, 0x20f8f81f
cmp ecx, 0xfe9d53b1
jbe 0x1401d6a90
mov qword [rsi], rax
mov ecx, dword [0x1415a7eb8]
imul ecx, dword [0x1415a7ebc]
mov edx, ecx
xor edx, 0xc01326af
add edx, ecx
and ecx, 0x3fecd950
sub edx, ecx
add edx, 0x9c570a07
mov ecx, edx
and ecx, 0x8158054
xor edx, 0x8158054
lea ecx, [rdx + rcx*2]
mov qword [rsi], rax
cmp ecx, 0x2d5e6940
jbe 0x1401d6a90
jmp 0x1401d6b50
mov eax, dword [0x1415a7e78]
and eax, dword [0x1415a7e7c]
or eax, 0xd0ba42ac
mov edx, eax
xor edx, 0x7754a25a
add edx, eax
and eax, 0x88ab5da5
sub edx, eax
imul eax, edx, 0x395afdb2
mov qword [rsi], rcx
cmp eax, 0xff03fb8
jae 0x1401d6b10
mov qword [rsi], rcx
jmp 0x1401d6ad3
mov eax, dword [0x1415a7e80]
mov ecx, dword [0x1415a7e84]
not eax
mov edx, eax
and edx, ecx
or eax, ecx
not eax
or eax, edx
or eax, 0xa1451fc4
imul rcx, rax, 0xa618fb
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1d
cmp eax, 0xf2b7a528
je 0x1401d6b10
nop dword [rax + rax]
mov eax, dword [0x1415a7eac]
add eax, dword [0x1415a7ea8]
mov ecx, eax
not ecx
mov edx, eax
and edx, 0xa777c53f
and ecx, 0x58883ac0
imul ecx, edx
mov edx, eax
and edx, 0x58883ac0
or eax, 0x58883ac0
imul eax, edx
add eax, ecx
cmp eax, 0x743f5e60
je 0x1401d6b50
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov ebp, eax
xor eax, eax
test al, al
je 0x1401d6bb3
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
jmp 0x1401d6b97
mov ebx, ebp
nop word cs:[rax + rax]
mov eax, dword [0x1415a7ec8]
and eax, dword [0x1415a7ecc]
mov ecx, eax
not ecx
and ecx, 0xd827f396
mov edx, eax
and edx, 0x27d80c69
imul edx, ecx
mov ecx, eax
and ecx, 0xd827f396
or eax, 0xd827f396
imul eax, ecx
add eax, edx
imul eax, eax, 0x9b69da67
xor eax, 0x247334a1
cmp eax, 0x53c69c77
je 0x1401d6bc0
test ebp, ebp
je 0x1401d6e90
mov eax, dword [0x1415a7ed0]
add eax, dword [0x1415a7ed4]
mov ecx, eax
and ecx, 0xc0cd006
or eax, 0xc0cd006
add eax, ecx
mov ecx, eax
not ecx
or ecx, 0x2a4842
or eax, 0x9048184
and eax, ecx
or eax, 0xf6d13639
cmp eax, 0x30549026
jne 0x1401d6c60
mov ecx, 8
mov rdx, rbx
call fcn.1401ac910
nop word cs:[rax + rax]
mov eax, dword [0x1415a7ed8]
or eax, dword [0x1415a7edc]
xor eax, 0x80045008
or eax, 0x3b598ec7
imul r15d, eax, 0xd2815a46
mov ecx, 8
mov rdx, rbx
call fcn.1401ac910
cmp r15d, 0x66bdf077
jb 0x1401d6c60
mov r14, rax
nop word cs:[rax + rax]
mov eax, dword [0x1415a7ee4]
xor eax, dword [0x1415a7ee0]
mov ecx, eax
xor ecx, 0x20ac7290
add ecx, eax
and eax, 0xdf538d6f
sub ecx, eax
mov eax, ecx
add eax, 0x501a26bb
not eax
or eax, 0x94370fd6
add eax, ecx
add eax, 0x501a26bb
cmp eax, 0x5817a3cf
je 0x1401d6ca0
test r14, r14
je 0x1401d6f0a
mov ecx, ebp
mov rdx, r14
mov r8, rdi
call qword [sym.imp.ADVAPI32.dll_CopySid]
mov ecx, dword [0x1415a7f28]
mov edx, dword [0x1415a7f2c]
mov r8d, ecx
not r8d
and r8d, edx
mov r9d, edx
not r9d
and r9d, ecx
imul r9d, r8d
mov r8d, ecx
and r8d, edx
or ecx, edx
imul ecx, r8d
add ecx, r9d
imul rcx, rcx, 0x8509f73
shr rcx, 0x39
add ecx, 0xdda1b739
imul rcx, rcx, 0x5037f3df
shr rcx, 0x3d
cmp ecx, 0x36dc34b5
ja 0x1401d6cf0
test eax, eax
je 0x1401d6ecb
mov eax, dword [0x1415a7f30]
xor edx, edx
div dword [0x1415a7f34]
nop dword [rax + rax]
mov eax, dword [0x1415a7f38]
sub eax, dword [0x1415a7f3c]
mov ecx, eax
and ecx, 0xcf0f3876
or eax, 0xcf0f3876
add eax, ecx
imul eax, eax, 0x115e3c60
add eax, 0x9cd009a7
cmp eax, 0x118347c2
jb 0x1401d6d60
cmp byte [r14], 1
jne 0x1401d6f43
mov eax, dword [0x1415a7f58]
sub eax, dword [0x1415a7f5c]
and eax, 0x8c2f7e6d
add eax, 0x851583a8
cmp eax, 0x4bb89d16
jae 0x1401d6dc0
mov qword [rsi], rbx
mov qword [rsi + 8], r14
nop dword [rax + rax]
mov eax, dword [0x1415a7f60]
mov ecx, dword [0x1415a7f64]
not eax
not ecx
or ecx, eax
not ecx
imul eax, ecx, 0x6de3b5cd
shr eax, 2
imul rax, rax, 0x413ca633
shr rax, 0x3a
xor eax, 0x23c4a055
mov qword [rsi], rbx
mov qword [rsi + 8], r14
cmp eax, 0x93737243
ja 0x1401d6dc0
xor eax, eax
test al, al
je 0x1401d6e10
mov qword [rsi + 0x10], rbx
nop word cs:[rax + rax]
mov eax, dword [0x1415a7f68]
mov ecx, dword [0x1415a7f6c]
mov edx, eax
not edx
and edx, ecx
mov r8d, ecx
not r8d
and r8d, eax
imul r8d, edx
mov edx, eax
and edx, ecx
or eax, ecx
imul eax, edx
add eax, r8d
add eax, 0x3cf0a387
xor eax, 0xb385e9df
mov qword [rsi + 0x10], rbx
cmp eax, 0xe0293c6e
je 0x1401d6e10
mov eax, dword [0x1415a7f74]
add eax, dword [0x1415a7f70]
imul rax, rax, 0x14756251
shr rax, 0x3c
lea ecx, [rax + 0x1c6fa558]
mov edx, ecx
and edx, 0x805a501
xor ecx, 0x56ea1258
add eax, ecx
add eax, 0x1c6fa558
sub eax, edx
cmp eax, 0xec822e70
jae 0x1401d6e50
jmp 0x1401d6b50
mov eax, dword [0x1415a7f00]
mov ecx, dword [0x1415a7f04]
not eax
not ecx
or ecx, eax
not ecx
mov eax, ecx
and eax, 0x351faa3f
add eax, eax
neg eax
add eax, ecx
add eax, 0x1addf07f
and eax, 0xb34cb3c1
cmp eax, 0x934994ec
jbe 0x1401d7060
jmp 0x1401d70bf
call fcn.14020b260
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rcx, qword [0x1415acb98]
xor esi, esi
xor edx, edx
mov r8, r14
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop word cs:[rax + rax]
test sil, sil
jne 0x1401d6f00
jmp 0x1401d6b50
mov eax, dword [0x1415a7ee8]
or eax, dword [0x1415a7eec]
imul rax, rax, 0x6adce505
shr rax, 0x3e
imul eax, eax, 0xc8a8a9d7
mov ecx, eax
and ecx, 0xccfb631
xor eax, 0x8ccfb631
lea eax, [rax + rcx*2]
cmp eax, 0x3f88f145
jae 0x1401d6fa9
jmp 0x1401d6ffb
mov ecx, dword [0x1415a7f78]
mov eax, dword [0x1415a7f7c]
mov edx, ecx
not edx
and edx, eax
not eax
and eax, ecx
sub eax, edx
mov ecx, eax
xor ecx, 0xb051e70f
xor eax, 0xbf30440a
add eax, ecx
and ecx, 0xf09e5cfa
sub eax, ecx
mov ecx, eax
not ecx
mov edx, eax
and edx, 0xfaf6fcfc
and ecx, 0x5090303
imul ecx, edx
mov edx, eax
and edx, 0x5090303
or eax, 0x5090303
imul eax, edx
add eax, ecx
cmp eax, 0xc0cd9c74
jae 0x1401d7282
jmp 0x1401d72c6
mov ecx, dword [0x1415a7ef0]
mov eax, dword [0x1415a7ef4]
mov edx, eax
not edx
and edx, ecx
xor eax, ecx
add eax, ecx
sub eax, edx
mov ecx, eax
not ecx
and ecx, 0x5ee15723
mov edx, eax
and edx, 0xa11ea8dc
imul edx, ecx
mov ecx, eax
and ecx, 0x5ee15723
or eax, 0x5ee15723
imul eax, ecx
add eax, edx
xor eax, 0xdeb00bc4
add eax, 0xfc5b635e
ud2
ud2
mov eax, dword [0x1415a7f08]
mov ecx, dword [0x1415a7f0c]
mov edx, ecx
not edx
mov r8d, eax
and r8d, edx
or edx, eax
not edx
imul edx, r8d
mov r8d, eax
and r8d, ecx
or eax, ecx
imul eax, r8d
add eax, edx
mov ecx, eax
and ecx, 0x2d1cf140
or eax, 0x2d1cf140
add eax, ecx
imul ebx, eax, 0x3cddb57b
add ebx, 0x756d3950
mov edx, 1
xor ecx, ecx
mov r8, rdi
call qword [sym.imp.ADVAPI32.dll_CopySid]
cmp ebx, 0xef777c18
jbe 0x1401d70d1
mov edx, 1
xor ecx, ecx
mov r8, rdi
call qword [sym.imp.ADVAPI32.dll_CopySid]
jmp 0x1401d7060
mov ecx, eax
nop word cs:[rax + rax]
mov eax, dword [0x1415a7f10]
xor edx, edx
div dword [0x1415a7f14]
imul eax, eax, 0xc689c4e0
mov edx, eax
and edx, 0x65dca7e0
xor eax, 0x65dca7ec
lea eax, [rax + rdx*2]
mov edx, eax
not edx
and edx, 0xc0751021
mov r8d, eax
and r8d, 0x3f8aefc0
imul r8d, edx
mov edx, eax
and edx, 0xc075102c
or eax, 0xc075102d
imul eax, edx
add eax, r8d
cmp eax, 0xa3d73c97
ja 0x1401d70e0
nop word cs:[rax + rax]
mov eax, dword [0x1415a7f18]
add eax, dword [0x1415a7f1c]
or eax, 0xb12a0848
and eax, 0xf92e0858
cmp eax, 0x2cc30f80
je 0x1401d7140
test ecx, ecx
jne 0x1401d71b2
call sub.KERNEL32.dll_GetLastError
movabs rax, 0x8000000000000000
mov qword [rsi], rax
nop word cs:[rax + rax]
mov eax, dword [0x1415a7f20]
and eax, dword [0x1415a7f24]
or eax, 0xf96f5055
lea ecx, [rax + 0x3977abe2]
not ecx
or ecx, 0x533833dc
add eax, ecx
add eax, 0x3977abe3
cmp eax, 0xb677cbb3
jae 0x1401d7180
jmp 0x1401d6b50
mov eax, dword [0x1415a7f44]
add eax, dword [0x1415a7f40]
and eax, 0x2aefe5b6
imul eax, eax, 0x8e5b6b44
mov ecx, eax
not ecx
or ecx, 0xdb5b1b9b
add ecx, eax
cmp ecx, 0x1af76d45
jne 0x1401d71df
ud2
mov eax, dword [0x1415a7f48]
mov ecx, dword [str.I_]
mov edx, ecx
not edx
mov r8d, eax
and r8d, edx
or edx, eax
not edx
imul edx, r8d
mov r8d, eax
and r8d, ecx
or eax, ecx
imul eax, r8d
add eax, edx
add eax, 0x5909d6dd
imul rax, rax, 0x246c2395
shr rax, 0x3d
imul eax, eax, 0x20b6ca35
ud2
mov eax, dword [0x1415a7f80]
mov ecx, dword [0x1415a7f84]
mov edx, eax
not edx
and edx, ecx
not edx
not ecx
and ecx, eax
not ecx
and ecx, edx
not ecx
add ecx, 0x4a2dd9a5
mov eax, ecx
not eax
or eax, 0x930b04d0
and eax, 0xbb0b4df0
and ecx, 0x44309002
or ecx, eax
ud2
ud2