Function at 0x180091790
Capabilities:
Encode data using xor
Get user security identifier

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xa0
mov rax, qword [0x1802c0758]
xor rax, rsp
mov qword [rbp + 0x17], rax
xor r15d, r15d
mov qword [rbp - 0x21], rcx
cmp qword [rdx + 0x18], 0x10
mov rbx, rdx
mov rdi, rcx
mov dword [rbp - 0x15], r15d
mov dword [rbp - 0x19], r15d
jb 0x1800917d5
mov rdx, qword [rdx]
lea rax, [rbp - 0x11]
xor r8d, r8d
mov qword [rsp + 0x30], rax
lea r9, [rbp - 0x15]
lea rax, [rbp - 0x19]
xor ecx, ecx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
mov ecx, dword [rbp - 0x15]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ecx, dword [rbp - 0x19]
mov rsi, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
cmp qword [rbx + 0x18], 0x10
mov r14, rax
jb 0x18009181d
mov rbx, qword [rbx]
lea rax, [rbp - 0x11]
mov r8, rsi
mov qword [rsp + 0x30], rax
lea r9, [rbp - 0x15]
lea rax, [rbp - 0x19]
mov rdx, rbx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
test eax, eax
je 0x1800918b6
lea rdx, [rbp - 0x21]
mov qword [rbp - 0x21], r15
mov rcx, rsi
call sub.ADVAPI32.dll_ConvertSidToStringSidA
mov rdx, qword [rbp - 0x21]
xorps xmm0, xmm0
xorps xmm1, xmm1
mov r8, 0xffffffffffffffff
movups xmmword [rbp - 9], xmm0
movdqu xmmword [rbp + 7], xmm1
inc r8
cmp byte [rdx + r8], r15b
jne 0x180091874
lea rcx, [rbp - 9]
call fcn.180034f40
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.KERNEL32.dll_LocalFree]
movups xmm0, xmmword [rbp - 9]
movups xmm1, xmmword [rbp + 7]
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm1
jmp 0x180091a9a
cmp byte [0x18010d2c7], r15b
mov rax, qword [0x18010d2c0]
mov qword [rbp - 0x21], rax
je 0x180091a34
cmp dword [0x1802c0770], 2
jl 0x1800919f3
movdqa xmm2, xmmword [0x18010d9f0]
mov eax, 5
movdqa xmm3, xmmword [0x18010da00]
movdqa xmm1, xmm2
movdqa xmm4, xmmword [0x18010da40]
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
movaps xmmword [rsp + 0x90], xmm6
movd xmm6, eax
mov eax, 0x1f
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
movd xmm5, eax
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x18010da10]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [rbp - 0x21]
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x18010da20]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.3333333333333333]
xorps xmm2, xmm0
punpckldq xmm1, xmm3
movd dword [rbp - 0x21], xmm2
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movaps xmm6, xmmword [rsp + 0x90]
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x18010da10]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [rbp - 0x1d]
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x18010da20]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.3333333333333333]
xorps xmm2, xmm0
movd dword [rbp - 0x1d], xmm2
jmp 0x180091a34
lea r9, [rbp - 0x21]
mov r8d, r15d
nop word [rax + rax]
mov eax, 0x8fb823ef
lea r9, [r9 + 1]
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x39
movzx eax, r8b
inc r8d
sub al, dl
add al, 0x33
xor byte [r9 - 1], al
cmp r8d, 8
jl 0x180091a00
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, [rbp - 0x21]
call fcn.18007b864
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x18007ba40]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xorps xmm0, xmm0
lea rdx, [0x1800a2ab4]
movups xmmword [rdi], xmm0
xor r8d, r8d
mov qword [rdi + 0x10], r15
mov rcx, rdi
mov qword [rdi + 0x18], r15
call fcn.180034f40
mov rax, rdi
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.180097d30
mov rbx, qword [rsp + 0xe0]
add rsp, 0xa0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret