Function at 0x14019e888
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Encode data using xor
Hash data using fnv
List groups for user account
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x468]
sub rsp, 0x568
xor r14d, r14d
lea rcx, [rbp + 0x50]
xor edx, edx
mov qword [rbp + 0x4c8], r14
mov r8d, 0x1fe
mov dword [rbp + 0x4b0], r14d
mov dword [rbp + 0x4c0], r14d
mov qword [rbp + 0x18], r14
mov dword [rbp + 0x20], r14d
mov dword [rbp + 0x3c], r14d
call fcn.1403ccc50
call fcn.140141104
lea r8d, [r14 + 8]
lea rdx, [rbp + 0x50]
call fcn.1401a5cc0
mov eax, 0xffe0
mov dword [rbp + 0x38], 0x10221
add word [rbp + 0x50], ax
lea r15d, [r14 + 1]
lea rax, [rbp + 0x50]
mov dword [rbp + 0x24], r15d
mov qword [rbp + 0x10], rax
xorps xmm0, xmm0
lea rax, [rbp + 0x50]
mov qword [rbp + 0x40], r14
mov qword [rbp + 8], rax
mov ecx, r14d
xor eax, eax
mov dword [rsp + 0x40], 0x6276644e
movdqu xmmword [rbp + 0x28], xmm0
mov dword [rsp + 0x44], 0x35356c74
mov dword [rsp + 0x48], 0x67666d26
lea edx, [rax + 0xc]
mov byte [rsp + 0x4c], al
movsxd rax, ecx
xor byte [rsp + rax + 0x40], cl
add ecx, r15d
cmp ecx, edx
jb 0x14019e947
lea rcx, [rsp + 0x40]
mov byte [rsp + 0x4c], r14b
call qword [sym.imp.kernel32.dll_GetModuleHandleA]
mov r8, rax
cmp rax, 0xffffffffffffffff
jne 0x14019e9b1
xor eax, eax
mov dword [rsp + 0x4d], 0x6276644e
mov byte [rsp + 0x59], al
mov ecx, r14d
mov dword [rsp + 0x51], 0x35356c74
mov dword [rsp + 0x55], 0x67666d26
movsxd rax, ecx
xor byte [rsp + rax + 0x4d], cl
add ecx, r15d
cmp ecx, 0xc
jb 0x14019e98f
lea rcx, [rsp + 0x4d]
mov byte [rsp + 0x59], r14b
call qword [sym.imp.kernel32.dll_LoadLibraryA]
mov r8, rax
xor eax, eax
mov dword [rsp + 0x5a], 0x5676644e
mov byte [rsp + 0x64], al
mov ecx, r14d
mov dword [rsp + 0x5e], 0x46746077
mov word [rsp + 0x62], 0x6d6c
movsxd rax, ecx
xor byte [rsp + rax + 0x5a], cl
add ecx, r15d
cmp ecx, 0xa
jb 0x14019e9d1
lea rdx, [rsp + 0x5a]
mov byte [rsp + 0x64], r14b
mov rcx, r8
call qword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [rsp + 0x4d], 0x6276644e
mov ecx, r14d
mov rbx, rax
mov dword [rsp + 0x51], 0x35356c74
xor eax, eax
mov dword [rsp + 0x55], 0x67666d26
mov byte [rsp + 0x59], al
movsxd rax, ecx
xor byte [rsp + rax + 0x4d], cl
add ecx, r15d
cmp ecx, 0xc
jb 0x14019ea17
lea rcx, [rsp + 0x4d]
mov byte [rsp + 0x59], r14b
call qword [sym.imp.kernel32.dll_GetModuleHandleA]
mov r8, rax
cmp rax, 0xffffffffffffffff
jne 0x14019ea82
xor eax, eax
mov dword [rsp + 0x40], 0x6276644e
mov byte [rsp + 0x4c], al
mov ecx, r14d
mov dword [rsp + 0x44], 0x35356c74
mov dword [rsp + 0x48], 0x67666d26
movsxd rax, ecx
xor byte [rsp + rax + 0x40], cl
add ecx, r15d
cmp ecx, 0xc
jb 0x14019ea60
lea rcx, [rsp + 0x40]
mov byte [rsp + 0x4c], r14b
call qword [sym.imp.kernel32.dll_LoadLibraryA]
mov r8, rax
movdqa xmm0, xmmword [0x1404cff50]
mov ecx, r14d
movdqu xmmword [rsp + 0x66], xmm0
mov dword [rsp + 0x76], 0x717f745d
mov dword [rsp + 0x7a], 0x656771
movsxd rax, ecx
xor byte [rsp + rax + 0x66], cl
add ecx, r15d
cmp ecx, 0x17
jb 0x14019eaa3
lea rdx, [rsp + 0x66]
mov byte [rsp + 0x7d], r14b
mov rcx, r8
call qword [sym.imp.kernel32.dll_GetProcAddress]
xor r9d, r9d
lea r8, [rbp + 0x10]
mov rsi, rax
mov edx, r15d
mov rax, rbx
xor ecx, ecx
call qword [case.0x140173169.0]
mov r8d, eax
cmp eax, 0x8b0
jne 0x14019ebb6
mov dword [rbp - 0x54], 0x690054
mov ecx, r14d
mov dword [rbp - 0x50], 0x770063
mov dword [rbp - 0x4c], 0x520024
mov dword [rbp - 0x48], 0x69006f
mov dword [rbp - 0x44], 0x66006c
mov dword [rbp - 0x40], 0x78007d
mov dword [rbp - 0x3c], 0x78002c
mov dword [rbp - 0x38], 0x6a007d
mov dword [rbp - 0x34], 0x310062
mov dword [rbp - 0x30], 0x60007b
mov dword [rbp - 0x2c], 0x740034
mov dword [rbp - 0x28], 0x65007a
mov dword [rbp - 0x24], 0x78007d
mov dword [rbp - 0x20], 0x62007e
mov dword [rbp - 0x1c], 0x78003c
mov dword [rbp - 0x18], 0x760066
mov dword [rbp - 0x14], 0x550053
mov dword [rbp - 0x10], 0xf0051
mov dword [rbp - 0xc], 0x440004
mov dword [rbp - 8], 0x480044
mov dword [rbp - 4], 0x5b005c
mov dword [rbp], 0x4f004f
mov dword [rbp + 4], 2
movsxd rax, ecx
xor word [rbp + rax*2 - 0x54], cx
add ecx, r15d
cmp ecx, 0x2d
jb 0x14019eb8f
mov word [rbp + 6], r14w
lea rdx, [rbp - 0x54]
xor ecx, ecx
call fcn.1401a8110
xor eax, eax
jmp 0x14019ee67
test r8d, r8d
je 0x14019ec6c
xor eax, eax
mov dword [rsp + 0x66], 0x650041
mov word [rbp - 0x56], ax
mov ecx, r14d
mov dword [rsp + 0x6a], 0x230066
mov dword [rsp + 0x6e], 0x760071
mov dword [rsp + 0x72], 0x750063
mov dword [rsp + 0x76], 0x7e0028
mov dword [rsp + 0x7a], 0x78006b
mov dword [rsp + 0x7e], 0x6b002c
mov dword [rbp - 0x7e], 0x66006f
mov dword [rbp - 0x7a], 0x74007c
mov dword [rbp - 0x76], 0x330076
mov dword [rbp - 0x72], 0x7c0063
mov dword [rbp - 0x6e], 0x7f0062
mov dword [rbp - 0x6a], 0x7a0038
mov dword [rbp - 0x66], 0x7f0075
mov dword [rbp - 0x62], 0x270079
mov dword [rbp - 0x5e], 0x3a003e
mov dword [rbp - 0x5a], 0xf0044
movsxd rax, ecx
xor word [rsp + rax*2 + 0x66], cx
add ecx, r15d
cmp ecx, 0x22
jb 0x14019ec46
lea rdx, [rsp + 0x66]
mov word [rbp - 0x56], r14w
xor ecx, ecx
call fcn.1401a8110
jmp 0x14019ebaf
mov dword [rbp + 0x4b8], 0x101
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x14019ecec
mov r9d, dword [r10 + 0x18]
test r9d, r9d
je 0x14019ecec
mov edi, dword [r10 + 0x20]
dec r9d
mov r11d, 0x4ba012f8
lea rcx, [r8 + r9*4]
mov edx, dword [rcx + rdi]
add rdx, r8
mov cl, byte [rdx]
add rdx, r15
test cl, cl
je 0x14019ece7
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
add rdx, r15
test cl, cl
jne 0x14019ecc8
cmp r11d, 0x4de75f69
je 0x14019ecf1
test r9d, r9d
jne 0x14019ecac
mov rax, qword [rax]
jmp 0x14019ec87
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx edx, word [rcx + r9*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
lea rdx, [rbp + 0x4b8]
add rax, r8
lea rcx, [rbp + 0x250]
call qword [case.0x140173169.0]
lea rax, [rbp + 0x4c0]
mov r9d, r15d
mov qword [rsp + 0x38], rax
lea rdx, [rbp + 0x250]
lea rax, [rbp + 0x4b0]
xor r8d, r8d
mov qword [rsp + 0x30], rax
xor ecx, ecx
or dword [rsp + 0x28], 0xffffffff
lea rax, [rbp + 0x4c8]
mov qword [rsp + 0x20], rax
call qword [sym.imp.netapi32.dll_NetUserGetLocalGroups]
test eax, eax
jne 0x14019edb7
mov rbx, qword [rbp + 0x4c8]
test rbx, rbx
je 0x14019edb7
mov edi, r14d
cmp dword [rbp + 0x4b0], r14d
jbe 0x14019edb7
mov rdx, qword [rbx]
lea r9, [rbp + 8]
mov r8d, 3
mov dword [rsp + 0x20], r15d
xor ecx, ecx
mov rax, rsi
call qword [case.0x140173169.0]
cmp eax, 0x8ac
je 0x14019ee99
test eax, eax
jne 0x14019ee7b
add rbx, 8
add edi, r15d
cmp edi, dword [rbp + 0x4b0]
jb 0x14019ed78
call fcn.140141298
xor eax, eax
mov dword [rsp + 0x66], 0x730043
mov word [rbp - 0x76], ax
mov ecx, r14d
mov dword [rsp + 0x6a], 0x620067
mov dword [rsp + 0x6e], 0x600070
mov dword [rsp + 0x72], 0x490062
mov dword [rsp + 0x76], 0x7e006d
mov dword [rsp + 0x7a], 0x78005f
mov dword [rsp + 0x7e], 0x7f0069
mov dword [rbp - 0x7e], 0x6e0040
mov dword [rbp - 0x7a], 0x74007d
movsxd rax, ecx
xor word [rsp + rax*2 + 0x66], cx
add ecx, r15d
cmp ecx, 0x12
jb 0x14019ee0b
mov word [rbp - 0x76], r14w
mov edx, r14d
mov dword [rsp + 0x5a], 0x710053
mov dword [rsp + 0x5e], 0x6c006d
mov dword [rsp + 0x62], 0x62
movsxd rcx, edx
xor word [rsp + rcx*2 + 0x5a], dx
add edx, r15d
cmp edx, 5
jb 0x14019ee3b
lea r9, [rbp + 0x50]
mov word [rsp + 0x64], r14w
lea r8, [rsp + 0x66]
lea rdx, [rsp + 0x5a]
call fcn.14019d130
mov eax, r15d
add rsp, 0x568
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
xor r9d, r9d
lea r8, [0x1404cb890]
lea rdx, [0x1404cb898]
xor ecx, ecx
call qword [sym.imp.user32.dll_MessageBoxW]
jmp 0x14019ebaf
xor eax, eax
mov dword [rbp - 0x54], 0x690054
mov word [rbp], ax
mov ecx, r14d
mov dword [rbp - 0x50], 0x770063
mov dword [rbp - 0x4c], 0x720024
mov dword [rbp - 0x48], 0x69006f
mov dword [rbp - 0x44], 0x66006c
mov dword [rbp - 0x40], 0x78007d
mov dword [rbp - 0x3c], 0x6a002c
mov dword [rbp - 0x38], 0x60007c
mov dword [rbp - 0x34], 0x610065
mov dword [rbp - 0x30], 0x640032
mov dword [rbp - 0x2c], 0x660075
mov dword [rbp - 0x28], 0x790036
mov dword [rbp - 0x24], 0x6d0077
mov dword [rbp - 0x20], 0x7d003a
mov dword [rbp - 0x1c], 0x680073
mov dword [rbp - 0x18], 0x7b0070
mov dword [rbp - 0x14], 0x1000c
mov dword [rbp - 0x10], 0x410043
mov dword [rbp - 0xc], 0x57004b
mov dword [rbp - 8], 0x420052
mov dword [rbp - 4], 0x7004c
movsxd rax, ecx
xor word [rbp + rax*2 - 0x54], cx
add ecx, r15d
cmp ecx, 0x2a
jb 0x14019ef35
mov word [rbp], r14w
lea rdx, [rbp - 0x54]
jmp 0x14019eba8