Function at 0x14002a7e8
Capabilities:
Encode data using xor
Get disk size

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x948]
sub rsp, 0xa10
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x1401a0e90]
xor rax, rsp
mov qword [rbp + 0x900], rax
mov r14, rdx
mov rsi, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
mov dword [rsp + 0x30], edi
mov r8d, dword [0x1401a8d80]
mov ecx, r8d
imul ecx, r8d
imul ecx, r8d
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 2
sub ecx, eax
cmp ecx, 0xa
jne 0x14002a87e
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
mov r8d, dword [0x1401a8d80]
lea ecx, [r8 + 1]
imul ecx, r8d
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xe
sub ecx, edx
mov r13d, 4
or r15, 0xffffffffffffffff
lea r12d, [r13 - 3]
cmp ecx, r12d
jne 0x14002a8ea
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x63
movsxd rcx, r8d
mov eax, r13d
mul rcx
cmovo rax, r15
mov rcx, rax
call fcn.1400bc638
mov rcx, rax
call fcn.1400be0fc
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
mov eax, dword [0x1401a8d80]
mov ecx, eax
imul ecx, eax
imul ecx, eax
mov eax, 0x30c30c31
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
mov eax, dword [0x1401a9e04]
mov edx, 0xd80b598a
cmp ecx, r13d
cmove eax, edx
mov dword [0x1401a9e04], eax
call fcn.140023824
mov rcx, rax
lea r9, [rsp + 0x38]
mov r8d, 0x18
mov rdx, rbx
call fcn.14003535c
test eax, eax
je 0x14002acc5
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x19]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x14002ac5d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14002ac5d
mov edx, dword [rsp + 0x34]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
mov r9d, dword [0x1401a8d80]
lea r8d, [r9 + 1]
mov ecx, r8d
imul ecx, r9d
mov eax, 0x30c30c31
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 0x13
cmove r9d, r8d
mov dword [0x1401a8d80], r9d
test rbx, rbx
je 0x14002ac20
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x34]
mov r8, rbx
mov edx, 0x19
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x14002abb2
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
mov cl, byte [rax]
sub cl, r12b
movzx edx, cl
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
mov ecx, dword [rax]
cmp ecx, 0x2000
jae 0x14002aa7f
mov dword [r14], r12d
call fcn.14002a6c0
test al, al
jne 0x14002aa6b
mov ecx, dword [0x1401a8d80]
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x64
sub ecx, edx
add ecx, 0x63
movsxd rcx, ecx
mov rax, r13
mul rcx
cmovo rax, r15
mov rcx, rax
call fcn.1400bc638
mov rcx, rax
call fcn.1400be0fc
lea rdx, str.Low_Integrity
mov rcx, rsi
call fcn.140002c48
jmp 0x14002acd5
cmp ecx, 0x3000
jae 0x14002ab51
mov dword [r14], 2
call fcn.14002a744
test al, al
jne 0x14002aafe
mov r14d, edi
lea r15, [rsp + 0x60]
mov r10d, edi
lea ebx, [r10 + 1]
lea ecx, [r14 + 1]
mov r8d, dword [0x1401a8d80]
mov eax, r8d
cdq
idiv ecx
mov r9d, edx
mov ecx, r8d
sub ecx, r14d
imul r9d, ecx
mov eax, r8d
cdq
idiv ebx
add r9d, eax
sub r9d, r10d
mov dword [r15], r9d
mov edx, r9d
lea rcx, [0x140136e98]
call fcn.1400bd8cc
mov r10d, ebx
add r15, r13
cmp ebx, 0x16
jl 0x14002aaa6
add r14d, r12d
cmp r14d, 0x1c
jl 0x14002aaa3
or r15, 0xffffffffffffffff
lea rdx, str.Mediu
lea rcx, [rsp + 0x40]
call fcn.140001f2c
nop
lea r8, str.m_Integrity
mov rdx, rax
mov rcx, rsi
call fcn.140017bcc
mov dword [rsp + 0x30], r12d
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14002acda
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14002acda
mov edx, dword [0x1401a8d80]
lea r8d, [rdx + 2]
lea ecx, [rdx + 1]
imul r8d, ecx
imul r8d, edx
mov eax, 0x2aaaaaab
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub r8d, eax
cmp r8d, 0xd
jne 0x14002ab97
mov rcx, r13
call fcn.1400bd778
mov ecx, dword [0x1401a8d80]
mov dword [rax], ecx
mov dword [r14], 3
lea rdx, str.High_Integrity
mov rcx, rsi
call fcn.140002c48
jmp 0x14002acd5
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r9d, dword [0x1401a8d80]
mov ecx, r9d
imul ecx, r9d
mov eax, 0x30c30c31
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 0x13
jne 0x14002ac20
mov r8d, edi
mov edx, r8d
mov r10d, 8
mov ecx, edx
and ecx, r12d
sub ecx, r12d
not ecx
and ecx, r9d
mov eax, edx
sar eax, 1
mov edx, ecx
xor edx, eax
sub r10, r12
jne 0x14002abf0
add r9d, edx
add r8d, r12d
cmp r8d, 0x100
jl 0x14002abe7
mov dword [0x1401a8d80], r9d
mov ecx, r9d
imul ecx, r9d
imul ecx, r9d
mov eax, 0x38e38e39
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 3
jne 0x14002ac5d
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x1401a8d80]
mov eax, edx
imul eax, edx
imul eax, edx
and eax, 0x80000003
jge 0x14002ac86
sub eax, r12d
or eax, 0xfffffffc
add eax, r12d
cmp eax, 2
jne 0x14002acc5
mov r8d, edi
mov r9d, 8
mov ecx, r8d
and ecx, r12d
sub ecx, r12d
not ecx
and ecx, edx
mov eax, r8d
sar eax, 1
mov r8d, ecx
xor r8d, eax
sub r9, r12
jne 0x14002ac94
add edx, r8d
add edi, r12d
cmp edi, 0x100
jl 0x14002ac8b
mov dword [0x1401a8d80], edx
lea rdx, [0x140139da8]
mov rcx, rsi
call fcn.140001f2c
nop
mov dword [rsp + 0x30], r12d
mov rax, rsi
mov rcx, qword [rbp + 0x900]
xor rcx, rsp
call fcn.1400bcfc0
mov rbx, qword [rsp + 0xa60]
add rsp, 0xa10
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret