Function at 0x1402d51f5
Capabilities:
Encode data using xor

Disassembly:
mov dword [rbp - 0x19], 0x233f2d76
mov rcx, r15
mov word [rbp - 0x15], Ordinal_41
mov byte [rbp - 0x13], 1
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx + 0x58]
xor byte [rbp + rcx - 0x19], al
inc rcx
cmp rcx, 5
jb 0x140026a30
xor edx, edx
mov byte [rbp - 0x13], r15b
lea rcx, [rbp - 0x19]
call fcn.140021520
test al, al
je 0x140026a81
xorps xmm0, xmm0
mov qword [rbp + 0x27], r15
mov r8d, 0x40
mov qword [rbp + 0x2f], r15
lea rdx, str.check_section_integrity___failed__dont_tamper_with_the_program.
lea rcx, [rbp + 0x17]
movups xmmword [rbp + 0x17], xmm0
call fcn.14000c690
lea rcx, [rbp + 0x17]
call fcn.140022cb0
xor r14b, r14b
mov qword [rbp + 0xf], r15
mov dword [rbp + 7], r15d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp + 0xf]
mov edx, 8
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140026ba3
mov rcx, qword [rbp + 0xf]
lea rax, [rbp + 7]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea edx, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov ecx, dword [rbp + 7]
call qword [0x14007e908]
mov rbx, rax
test rax, rax
je 0x140026ba3
mov r9d, dword [rbp + 7]
lea rax, [rbp + 7]
mov rcx, qword [rbp + 0xf]
mov r8, rbx
mov edx, 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x140026b9a
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x140026b9a
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
lea esi, [rax + 0x14]
mov ecx, esi
call qword [0x14007e908]
mov rdi, rax
test rax, rax
je 0x140026b9a
mov r8d, 2
mov edx, esi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
je 0x140026b91
mov r9, qword [rbx]
mov edx, 2
mov r8d, 0x101001
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_AddAccessAllowedAce]
test eax, eax
je 0x140026b91
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor r9d, r9d
mov qword [rsp + 0x30], r15
mov rcx, rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r15
lea edx, [r9 + 6]
lea r8d, [r9 + 4]
call qword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
test eax, eax
sete r14b
mov rcx, rdi
call qword [0x14007e8f8]
mov rcx, rbx
call qword [0x14007e8f8]
mov rcx, qword [rbp + 0xf]
test rcx, rcx
je 0x140026bb2
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14b, r14b
jne 0x140026be5
xorps xmm0, xmm0
mov qword [rbp + 0x27], r15
mov r8d, gethostname
mov qword [rbp + 0x2f], r15
lea rdx, str.LockMemAccess___failed__dont_tamper_with_the_program.
lea rcx, [rbp + 0x17]
movups xmmword [rbp + 0x17], xmm0
call fcn.14000c690
lea rcx, [rbp + 0x17]
call fcn.140022cb0
mov rax, qword [0x14009ba80]
test rax, rax
jne 0x140026cc8
movdqa xmm0, xmmword [str.___c_]
mov rcx, r15
movdqu xmmword [rbp - 0x11], xmm0
mov word [rbp - 1], 0x100
nop dword [rax + rax]
lea eax, [rcx + 0x58]
xor byte [rbp + rcx - 0x11], al
inc rcx
cmp rcx, 0x10
jb 0x140026c10
xorps xmm0, xmm0
mov byte [rbp], r15b
xor eax, eax
xor ecx, ecx
movups xmmword [rbp + 0x17], xmm0
mov qword [rbp + 0x27], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, Ordinal_26
lea r8, [rbp + 0x17]
mov rcx, rax
mov rdx, rbx
call sub.PSAPI.DLL_GetModuleInformation
mov ebx, dword [rbp + 0x1f]
mov r9d, r15d
test ebx, ebx
je 0x140026cba
movzx r11d, byte [rbp - 0x11]
mov rdi, qword [rbp + 0x17]
nop word [rax + rax]
mov r10d, r9d
lea rdx, [0x14007f090]
add r10, rdi
test r11b, r11b
je 0x140026cbd
lea rcx, [rbp - 0x11]
mov r8, r10
sub r8, rcx
lea rax, [rbp - 0x11]
movzx ecx, r11b
cmp cl, 0x78
jne 0x140026ca2
movzx ecx, byte [rdx]
cmp byte [r8 + rax], cl
jne 0x140026cb2
movzx ecx, byte [rax + 1]
inc rax
inc rdx
test cl, cl
je 0x140026cbd
jmp 0x140026c94
inc r9d
cmp r9d, ebx
jb 0x140026c70
mov r10, r15
lea rax, [r10 - 5]
mov qword [0x14009ba80], rax
cmp byte [rax], 0xe9
jne 0x140026cfb
xorps xmm0, xmm0
mov qword [rbp + 0x27], r15
mov r8d, Ordinal_60
mov qword [rbp + 0x2f], r15
lea rdx, str.Pattern_checksum_failed__dont_tamper_with_the_program.
lea rcx, [rbp + 0x17]
movups xmmword [rbp + 0x17], xmm0
call fcn.14000c690
lea rcx, [rbp + 0x17]
call fcn.140022cb0
mov ecx, reloc.WLDAP32.dll_Ordinal_50
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140026a10
mov qword [rsp + r15*4 - 0x200001f0], rax
add r13d, 0x2d6e4857
neg r10d
call fcn.14018261e
call fcn.14021bd1e
jbe 0x14013f681
mov qword [rsp + 0x38], 0x5552082e
xchg qword [rsp + 0x58], rbx
mov r14, r8
jge 0x14020e88a
jb 0x140026af7
add qword [rsp], 0x17e046
call fcn.1401e8a23