Function at 0x14002da30
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
sub rsp, 0x60
mov qword [rax - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rsi, rdx
mov rdi, rcx
mov qword [rax - 0x28], rcx
xor ebp, ebp
mov dword [rax - 0x48], ebp
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call fcn.1400260f0
mov rcx, rax
lea r9, [rsp + 0x38]
lea r8d, [rbp + 0x18]
mov rdx, rbx
call fcn.14003b220
test eax, eax
je 0x14002dca2
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [rbp + 0x19]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x14002dc97
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14002dc97
mov edx, dword [rsp + 0x34]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x14002dc97
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x34]
mov r8, rbx
lea edx, [rbp + 0x19]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x14002dc8e
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
movzx ecx, byte [rax]
dec cl
movzx edx, cl
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
mov ecx, dword [rax]
cmp ecx, 0x2000
jae 0x14002db65
mov dword [rsi], 1
mov r8d, dword [0x1401a9d80]
mov ecx, r8d
imul ecx, r8d
mov eax, 0x30c30c31
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 8
jne 0x14002db51
inc r8d
mov dword [0x1401a9d80], r8d
lea rdx, str.Low_Integrity
mov rcx, rdi
call fcn.1400030f0
jmp 0x14002dcb2
cmp ecx, 0x3000
jae 0x14002dc77
mov dword [rsi], 2
mov edx, dword [0x1401a9d80]
mov eax, edx
imul eax, edx
and eax, 0x8000000f
jge 0x14002db90
dec eax
or eax, 0xfffffff0
inc eax
cmp eax, 8
jne 0x14002dc30
nop dword [rax]
mov ecx, ebp
and ecx, 1
dec ecx
not ecx
and ecx, edx
mov eax, ebp
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, edx
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, edx
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, edx
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, edx
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, edx
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, edx
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, edx
sar ecx, 1
xor eax, ecx
add edx, eax
inc ebp
cmp ebp, 0x100
jl 0x14002dba0
mov dword [0x1401a9d80], edx
lea rdx, str.Mediu
lea rcx, [rsp + 0x40]
call fcn.1400022a0
nop
lea r8, str.m_Integrity
mov rdx, rax
mov rcx, rdi
call fcn.140019af0
mov dword [rsp + 0x30], 1
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14002dcba
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14002dcba
mov dword [rsi], 3
lea rdx, str.High_Integrity
mov rcx, rdi
call fcn.1400030f0
jmp 0x14002dcb2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [0x1401366d0]
mov rcx, rdi
call fcn.1400022a0
nop
mov dword [rsp + 0x30], 1
mov rax, rdi
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret