Function at 0x1400b01e0
Capabilities:
Encode data using xor
Get file attributes
Get session user name
Set file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov rax, qword [0x1402d9040]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
mov rdi, rcx
xor r13d, r13d
mov dword [rbp - 0x60], r13d
mov rdx, qword [rcx]
movzx edx, byte [rdx + 0x54]
lea rcx, [0x1402dbecc]
call fcn.1400a3dc0
mov dword [rsp + 0x60], 0x1b0aa24d
mov dword [rsp + 0x64], 0x4cdc127a
mov dword [rsp + 0x68], 0x74dfc4c9
mov dword [rsp + 0x6c], 0xa6cb7fd
mov dword [rsp + 0x70], 0xfb8a53a
mov dword [rsp + 0x74], 0xa9e56ea9
mov dword [rsp + 0x78], 0x9808767e
mov word [rsp + 0x7c], 0x6c44
mov qword [rsp + 0x38], r13
mov rax, qword [rsp + 0x38]
nop
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x38]
movzx edx, byte [rsp + rcx + 0x60]
sub dl, byte [rsp + rax + 0x6f]
mov byte [rsp + 0x30], dl
movzx ecx, byte [rsp + 0x30]
mov rax, qword [rsp + 0x38]
mov byte [rbp + rax + 0x80], cl
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp rax, 0xf
jb 0x1400b0280
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp], r13
mov qword [rbp + 8], r13
mov r8d, reloc.WLDAP32.dll_Ordinal_14
lea rdx, [rbp + 0x80]
lea rcx, [rbp - 0x10]
call fcn.14004a1a0
lea rax, [rbp - 0x10]
mov qword [rsp + 0x38], rax
mov rcx, qword [0x1402db860]
add rcx, 8
lea rdx, [rbp - 0x10]
call fcn.14005f4d0
nop
lea rcx, [rbp - 0x10]
call fcn.1400614c0
mov rcx, qword [rdi + 0x10]
sub rcx, qword [rdi + 8]
movabs rax, 0xc30c30c30c30c30d
imul rcx
add rdx, rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, qword [rdi]
movsxd rcx, dword [rax + 0x50]
cmp rcx, rdx
jae 0x1400b096e
mov dword [rbp + 0x78], 0x104
lea rdx, [rbp + 0x78]
lea rcx, [rbp + 0x90]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea rdx, [rbp + 0x58]
call fcn.14008db80
nop
lea r10, [rbp + 0x90]
mov r9d, r13d
movzx r8d, byte [rbp + 0x90]
test r8b, r8b
je 0x1400b03b8
nop dword [rax + rax]
movzx edx, r8b
lea r10, [r10 + 1]
sub r8b, 0x41
lea eax, [rdx + 0x20]
movzx ecx, al
cmp r8b, 0x19
cmova ecx, edx
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx r8d, byte [r10]
test r8b, r8b
jne 0x1400b0380
lea ecx, [r9 + r9*8]
mov eax, ecx
shr eax, 0xb
xor ecx, eax
imul eax, ecx, 0x8001
lea rcx, str..dat
mov qword [rbp + 0x80], rcx
mov qword [rbp + 0x88], 6
mov dword [rbp - 0x18], eax
movabs rax, 0x2000000000000000
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x30], 1
lea rax, [rbp - 0x20]
mov qword [rbp - 0x28], rax
movaps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rbp - 0x30], xmm0
movaps xmm1, xmmword [rbp + 0x80]
movdqa xmmword [rbp - 0x80], xmm1
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x58]
call fcn.140064740
nop
lea rax, [rbp - 0x58]
cmp qword [rbp - 0x40], 0xf
cmova rax, qword [rbp - 0x58]
mov qword [rsp + 0x40], rax
mov rax, qword [rbp - 0x48]
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x80]
call fcn.1400712e0
nop
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x58]
call fcn.140048b30
nop
lea rcx, [rbp - 0x80]
call fcn.140061450
nop
lea rcx, [rbp - 0x58]
call fcn.1400614c0
lea r14, [rbp + 0x58]
cmp qword [rbp + 0x70], 7
cmova r14, qword [rbp + 0x58]
mov rsi, qword [rbp + 0x68]
call fcn.14016a8a8
mov r15d, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x1402b3fe0]
movdqu xmmword [rsp + 0x50], xmm1
mov byte [rsp + 0x40], 0
mov dword [rbp - 0x60], Ordinal_145
test rsi, rsi
je 0x1400b052a
cmp rsi, 0x7fffffff
ja 0x1400b09b1
mov dword [rsp + 0x20], r13d
xor r9d, r9d
mov r8d, esi
mov rdx, r14
mov ecx, eax
call fcn.14016a918
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x1400b09b7
movsxd rdx, ebx
xor r8d, r8d
lea rcx, [rsp + 0x40]
call fcn.140061520
lea r9, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova r9, qword [rsp + 0x40]
mov dword [rsp + 0x20], ebx
mov r8d, esi
mov rdx, r14
mov ecx, r15d
call fcn.14016a918
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x1400b09c3
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov r15d, eax
and r15d, 0xfffffffd
lea r14, [rbp + 0x58]
cmp qword [rbp + 0x70], 7
cmova r14, qword [rbp + 0x58]
mov rsi, qword [rbp + 0x68]
call fcn.14016a8a8
mov r12d, eax
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
movdqa xmm1, xmmword [0x1402b3fe0]
movdqu xmmword [rbp - 0x70], xmm1
mov byte [rbp - 0x80], 0
mov dword [rbp - 0x60], 0x87f
test rsi, rsi
je 0x1400b05f5
cmp rsi, 0x7fffffff
ja 0x1400b09cd
mov dword [rsp + 0x20], r13d
xor r9d, r9d
mov r8d, esi
mov rdx, r14
mov ecx, eax
call fcn.14016a918
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x1400b09d3
movsxd rdx, ebx
xor r8d, r8d
lea rcx, [rbp - 0x80]
call fcn.140061520
lea r9, [rbp - 0x80]
cmp qword [rbp - 0x68], 0xf
cmova r9, qword [rbp - 0x80]
mov dword [rsp + 0x20], ebx
mov r8d, esi
mov rdx, r14
mov ecx, r12d
call fcn.14016a918
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x1400b09df
lea rcx, [rbp - 0x80]
cmp qword [rbp - 0x68], 0xf
cmova rcx, qword [rbp - 0x80]
mov edx, r15d
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rbp - 0x80]
call fcn.1400614c0
nop
lea rcx, [rsp + 0x40]
call fcn.1400614c0
lea rcx, [rbp + 0x58]
cmp qword [rbp + 0x70], 7
cmova rcx, qword [rbp + 0x58]
call fcn.14016af00
mov rdx, rax
shr rax, 0x20
test eax, eax
jne 0x1400b09e9
lea rax, [rbp - 0x80]
mov qword [rsp + 0x38], rax
lea rdx, [rbp - 0x80]
mov rcx, qword [0x1402db588]
call fcn.14004e380
mov r12, rax
lea rax, [rbp + 0x10]
mov qword [rbp - 0x20], rax
lea rax, vtable.std::_Func_impl_no_alloc_class__public:_void___cdecl__private:_void___cdecl_CUserInterface::RenderBase_void____ptr64::_28::_lambda_1_::operator___void____ptr64::_5::_lambda_1___int__long_long___int64___long_long___int64__.0
mov qword [rbp + 0x10], rax
lea rax, [rbp + 0x10]
mov qword [rbp + 0x48], rax
mov byte [rbp + 0x50], 1
lea rax, [rsp + 0x40]
mov qword [rbp + 0x80], rax
lea r14, [rbp + 0x58]
cmp qword [rbp + 0x70], 7
cmova r14, qword [rbp + 0x58]
mov rsi, qword [rbp + 0x68]
call fcn.14016a8a8
mov r15d, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x40], 0
mov dword [rbp - 0x60], 0x877f
test rsi, rsi
je 0x1400b073d
cmp rsi, 0x7fffffff
ja 0x1400b09fe
mov dword [rsp + 0x20], r13d
xor r9d, r9d
mov r8d, esi
mov rdx, r14
mov ecx, eax
call fcn.14016a918
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x1400b0a04
movsxd rdx, ebx
xor r8d, r8d
lea rcx, [rsp + 0x40]
call fcn.140061520
lea r9, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova r9, qword [rsp + 0x40]
mov dword [rsp + 0x20], ebx
mov r8d, esi
mov rdx, r14
mov ecx, r15d
call fcn.14016a918
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x1400b0a10
mov rcx, qword [rdi]
movsxd r8, dword [rcx + 0x50]
mov r9, qword [rdi + 8]
mov rcx, qword [rdi + 0x10]
sub rcx, r9
movabs rax, 0xc30c30c30c30c30d
imul rcx
add rdx, rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rdx, r8
jbe 0x1400b0a1a
imul rdx, r8, 0xa8
add r9, 0x48
add rdx, r9
lea rcx, [rbp - 0x58]
call fcn.14005f5f0
nop
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x10]
lea r8, [rsp + 0x40]
lea rdx, [rbp - 0x58]
call fcn.14007fb90
lea r14, [rbp + 0x58]
cmp qword [rbp + 0x70], 7
cmova r14, qword [rbp + 0x58]
mov rsi, qword [rbp + 0x68]
call fcn.14016a8a8
mov r15d, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x1402b3fe0]
movdqu xmmword [rsp + 0x50], xmm1
mov byte [rsp + 0x40], 0
mov dword [rbp - 0x60], 0x11777f
test rsi, rsi
je 0x1400b0859
cmp rsi, 0x7fffffff
ja 0x1400b0a20
mov dword [rsp + 0x20], r13d
xor r9d, r9d
mov r8d, esi
mov rdx, r14
mov ecx, eax
call fcn.14016a918
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x1400b0a26
movsxd rdx, ebx
xor r8d, r8d
lea rcx, [rsp + 0x40]
call fcn.140061520
lea r9, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova r9, qword [rsp + 0x40]
mov dword [rsp + 0x20], ebx
mov r8d, esi
mov rdx, r14
mov ecx, r15d
call fcn.14016a918
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x1400b0a32
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov r15d, eax
or r15d, 2
lea r14, [rbp + 0x58]
cmp qword [rbp + 0x70], 7
cmova r14, qword [rbp + 0x58]
mov rsi, qword [rbp + 0x68]
call fcn.14016a8a8
mov r12d, eax
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
movdqa xmm1, xmmword [0x1402b3fe0]
movdqu xmmword [rbp - 0x70], xmm1
mov byte [rbp - 0x80], 0
mov dword [rbp - 0x60], 0x10f777f
test rsi, rsi
je 0x1400b0924
cmp rsi, 0x7fffffff
ja 0x1400b0a3c
mov dword [rsp + 0x20], r13d
xor r9d, r9d
mov r8d, esi
mov rdx, r14
mov ecx, eax
call fcn.14016a918
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x1400b0a42
movsxd rdx, ebx
xor r8d, r8d
lea rcx, [rbp - 0x80]
call fcn.140061520
lea r9, [rbp - 0x80]
cmp qword [rbp - 0x68], 0xf
cmova r9, qword [rbp - 0x80]
mov dword [rsp + 0x20], ebx
mov r8d, esi
mov rdx, r14
mov ecx, r12d
call fcn.14016a918
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x1400b09a7
lea rcx, [rbp - 0x80]
cmp qword [rbp - 0x68], 0xf
cmova rcx, qword [rbp - 0x80]
mov edx, r15d
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rbp - 0x80]
call fcn.1400614c0
nop
lea rcx, [rsp + 0x40]
call fcn.1400614c0
lea rdx, [rbp + 0x58]
lea rcx, [rbp - 0x58]
call fcn.140049210
mov rdx, rax
call fcn.1400a4980
nop
lea rcx, [rbp + 0x58]
call fcn.140061450
mov rax, qword [rdi]
mov dword [rax], 2
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.14016b380
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
shr rcx, 0x20
call fcn.140046fa0
nop
call fcn.140046cd0
int3
shr rbx, 0x20
mov ecx, ebx
call fcn.140046fa0
int3
shr rcx, 0x20
call fcn.140046fa0
nop
call fcn.140046cd0
int3
shr rbx, 0x20
mov ecx, ebx
call fcn.140046fa0
int3
shr rcx, 0x20
call fcn.140046fa0
nop
shr rdx, 0x20
lea r8, [rbp + 0x58]
lea rcx, [0x140220484]
call fcn.14008d710
nop
call fcn.140046cd0
int3
shr rbx, 0x20
mov ecx, ebx
call fcn.140046fa0
int3
shr rcx, 0x20
call fcn.140046fa0
nop
call fcn.140060bd0
nop
call fcn.140046cd0
int3
shr rbx, 0x20
mov ecx, ebx
call fcn.140046fa0
int3
shr rcx, 0x20
call fcn.140046fa0
nop
call fcn.140046cd0
int3
shr rbx, 0x20
mov ecx, ebx
call fcn.140046fa0
int3