Function at 0x14005a910
Capabilities:
Acquire debug privileges
Encode data using xor
Get disk size

Disassembly:
push rdi
sub rsp, 0x90
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0xa0], rbx
mov rax, qword [0x1401bbe90]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov edi, edx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call fcn.1400284b0
mov rcx, rax
lea r9, [rsp + 0x30]
mov r8d, 0x20028
mov rdx, rbx
call fcn.1400405e0
test eax, eax
jne 0x14005a9a2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0x68]
call fcn.140050ff0
mov r10, rax
call fcn.140052e70
mov rdx, rax
mov r8, r10
lea rcx, [rsp + 0x38]
call fcn.140056aa0
lea rdx, [0x1401867b8]
lea rcx, [rsp + 0x38]
call fcn.1400d5998
nop
mov ecx, dword [0x1401c3d80]
lea eax, [rcx + 1]
imul eax, ecx
and eax, 0x8000000f
jge 0x14005a9bc
dec eax
or eax, 0xfffffff0
inc eax
xor ebx, ebx
cmp eax, 9
jne 0x14005a9d8
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
lea r8, [rsp + 0x48]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x14005aa37
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0x68]
call fcn.140050ff0
mov rbx, rax
call fcn.140053480
mov rdx, rax
mov r8, rbx
lea rcx, [rsp + 0x38]
call fcn.140056aa0
lea rdx, [0x1401867b8]
lea rcx, [rsp + 0x38]
call fcn.1400d5998
nop
mov dword [rsp + 0x58], 1
mov r8d, dword [0x1401c3d80]
lea ecx, [r8 + 1]
imul ecx, r8d
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xf
sub ecx, edx
cmp ecx, 8
jne 0x14005ab0b
mov edx, ebx
mov ecx, edx
and ecx, 1
dec ecx
not ecx
and ecx, r8d
mov eax, edx
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, r8d
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, r8d
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, r8d
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, r8d
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, r8d
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, r8d
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, r8d
sar ecx, 1
xor eax, ecx
add r8d, eax
inc edx
cmp edx, 0x100
jl 0x14005aa71
mov dword [0x1401c3d80], r8d
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x5c], rax
neg edi
sbb eax, eax
and eax, 2
mov dword [rsp + 0x64], eax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, [rsp + 0x58]
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x30]
test eax, eax
jne 0x14005ab8a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0x68]
call fcn.140050ff0
mov rbx, rax
call fcn.140052020
mov rdx, rax
mov r8, rbx
lea rcx, [rsp + 0x38]
call fcn.140056aa0
lea rdx, [0x1401867b8]
lea rcx, [rsp + 0x38]
call fcn.1400d5998
nop
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1400cdac0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rdi
ret