Function at 0x14009b19d
Capabilities:
Encode data using xor
Get token membership

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x2a8
xor eax, eax
lea rsi, [rsp + 0x80]
mov dword [rsi], eax
mov word [rsi + 4], 0x500
lea rcx, [rsp + 0x178]
mov qword [rsp + 0x50], rcx
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov rcx, rsi
mov dl, 2
mov r8d, 0x20
mov r9d, 0x220
call qword [sym.imp.advapi32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x14009b24d
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, [rsp + 0x100]
mov byte [r8], 0
mov rdi, qword [rsp + 0x178]
xor ecx, ecx
mov rdx, rdi
call qword [sym.imp.advapi32.dll_CheckTokenMembership]
test eax, eax
jne 0x14009b236
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsp + 0x100], 0
mov rcx, rdi
call qword [sym.imp.advapi32.dll_FreeSid]
cmp byte [rsp + 0x100], 0
je 0x14009b3fc
lea rax, [0x14029c67e]
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0xd0], 3
lea rdi, [rsp + 0x178]
mov rcx, rdi
call fcn.14017b2a0
mov rax, qword [rdi]
mov rdi, qword [rdi + 8]
movabs r12, 0x8000000000000000
cmp rax, r12
je 0x14009b3e2
lea rbx, [rsp + 0x178]
movups xmm0, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x150], xmm0
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x148], rdi
lea rdi, [rsp + 0xd8]
mov rcx, rdi
call fcn.14017af10
mov rdx, qword [rdi + 8]
mov r8, qword [rdi + 0x10]
lea rdi, [rsp + 0x100]
mov rcx, rdi
call fcn.14018fc30
mov qword [rsp + 0x80], rdi
lea rax, [0x140006a7e]
mov qword [rsp + 0x88], rax
lea r14, [rsp + 0xc8]
mov qword [rsp + 0x90], r14
lea r15, [0x14003906a]
mov qword [rsp + 0x98], r15
lea rax, [0x14029be68]
mov qword [rbx], rax
mov eax, 2
mov qword [rbx + 8], rax
mov qword [rbx + 0x20], 0
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], rax
lea rcx, [rsp + 0x160]
mov rdx, rbx
call fcn.14003f640
mov rax, qword [rdi]
cmp rax, r12
je 0x14009b36b
test rax, rax
je 0x14009b36b
mov r8, qword [rsp + 0x108]
mov rcx, qword [0x1403531b0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
movups xmm0, xmmword [rsp + 0x160]
movaps xmmword [rsp + 0x60], xmm0
mov r8, qword [rsp + 0x170]
mov qword [rsp + 0x70], r8
mov rsi, qword [rsp + 0x68]
lea rcx, [rsp + 0x140]
mov rdx, rsi
call fcn.1400038af
test rax, rax
je 0x14009b42d
mov rdi, rdx
cmp qword [rsp + 0x60], 0
je 0x14009b3c0
mov rcx, qword [0x1403531b0]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp qword [rsp + 0xd8], 0
je 0x14009b3e2
mov r8, qword [rsp + 0xe0]
mov rcx, qword [0x1403531b0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rsp + 0x178], rdi
test rdi, rdi
je 0x14009b3fc
lea rcx, [rsp + 0x178]
call fcn.1400747f0
lea rax, [0x140294ea4]
lea rdx, [rsp + 0x178]
mov qword [rdx], rax
mov rcx, qword [rdx]
movabs rax, 0x8825dbcca65c6778
mov qword [rdx], rax
lea rax, [rsp + 0x178]
mov rdx, qword [rax]
call fcn.1400861df
mov ecx, 0x33532ede
xor ecx, dword [rax]
movzx edx, byte [rax + 6]
movzx eax, word [rax + 4]
xor eax, 0x76da
xor dl, 0x90
movzx r8d, dl
lea rdx, [rsp + 0xf8]
mov byte [rdx + 6], r8b
shl r8, 0x30
shl rax, 0x20
or rax, r8
mov dword [rdx], ecx
shr rax, 0x20
mov word [rdx + 4], ax
lea rsi, [rsp + 0x178]
mov r8d, 7
mov rcx, rsi
call fcn.140194450
mov dword [rsi + 0xc0], 0x8000000
lea rdx, [0x14029be88]
mov r8d, 2
mov rcx, rsi
call fcn.140194560
lea rax, [0x14028e421]
lea rdx, [rsp + 0x80]
mov qword [rdx], rax
mov rcx, qword [rdx]
movabs rax, 0x3e5d6f0db3261ad7
mov qword [rdx], rax
lea rsi, [rsp + 0x80]
mov rdx, qword [rsi]
call fcn.140085eda
xorps xmm0, xmm0
movaps xmmword [rsi], xmm0
mov cl, 1
xor edx, edx
lea r8, [0x14029be8a]
mov r9, qword [rdx + r8]
xor r9, qword [rax + rdx]
mov qword [rsp + rdx + 0x80], r9
mov edx, 8
test cl, 1
mov ecx, 0
jne 0x14009b513
mov ecx, 0x7da0c909
xor ecx, dword [rax + 0x10]
lea rax, [rsp + 0x270]
mov dword [rax + 0x10], ecx
lea rdx, [rsp + 0x80]
movaps xmm0, xmmword [rdx]
movaps xmmword [rax], xmm0
lea rdi, [rsp + 0x250]
mov qword [rdi], rax
mov qword [rdi + 8], 0x14
lea rax, [0x1402913d9]
mov qword [rdx], rax
mov rcx, qword [rdx]
movabs rax, 0x6e072bbe1782d1a0
mov qword [rdx], rax
lea rsi, [rsp + 0x80]
mov rdx, qword [rsi]
call fcn.140085a4d
movabs rcx, 0xa4cc817b34f2d531
xor rcx, qword [rax]
mov edx, 0xa89c9a4a
xor edx, dword [rax + 8]
movzx r8d, byte [rax + 0xe]
movzx eax, word [rax + 0xc]
xor eax, 0x33a0
xor r8b, 0x6d
lea r9, [rsp + 0x240]
mov qword [r9], rcx
mov dword [r9 + 8], edx
mov word [r9 + 0xc], ax
mov byte [r9 + 0xe], r8b
lea rax, [rsp + 0x260]
mov qword [rax], r9
mov qword [rax + 8], 0xf
mov qword [rsi], rdi
mov qword [rsi + 8], r15
lea rcx, [rsp + 0x60]
mov qword [rsi + 0x10], rcx
lea rcx, [0x140006a7e]
mov qword [rsi + 0x18], rcx
mov qword [rsi + 0x20], rax
mov qword [rsi + 0x28], r15
mov qword [rsi + 0x30], r14
mov qword [rsi + 0x38], r15
lea rax, [0x14029bea8]
lea rdx, [rsp + 0x100]
mov qword [rdx], rax
mov qword [rdx + 8], 5
mov qword [rdx + 0x20], 0
mov qword [rdx + 0x10], rsi
mov qword [rdx + 0x18], 4
lea rsi, [rsp + 0x290]
add byte [rax - 0x77], cl
int1