Function at 0x140028ca8
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x18], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov r15, rdx
mov rsi, rcx
mov qword [rbp - 0x10], rcx
xor edi, edi
mov dword [rbp - 0x30], edi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
mov r8d, dword [0x14019fd80]
mov ecx, r8d
imul ecx, r8d
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub ecx, edx
lea r14d, [rdi + 4]
or r9, 0xffffffffffffffff
cmp ecx, 0x15
jne 0x140028d47
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x63
movsxd rcx, r8d
mov eax, r14d
mul rcx
cmovo rax, r9
mov rcx, rax
call fcn.1400b8688
mov rcx, rax
call fcn.1400ba0bc
call fcn.140021eac
mov rcx, rax
lea r9, [rbp - 0x28]
mov r8d, 0x18
mov rdx, rbx
call fcn.14003373c
mov ebx, 1
test eax, eax
je 0x140028fa3
lea rax, [rbp - 0x2c]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [rbx + 0x18]
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x140028f99
mov r8d, dword [0x14019fd80]
imul r8d, r8d
mov eax, 0x2aaaaaab
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub r8d, eax
cmp r8d, 0xd
jne 0x140028dd1
mov rcx, r14
call fcn.1400b97c8
mov rcx, rax
mov eax, dword [0x14019fd80]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140028f99
mov edx, dword [rbp - 0x2c]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r14, rax
test rax, rax
je 0x140028f99
lea rax, [rbp - 0x2c]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp - 0x2c]
mov r8, r14
mov edx, 0x19
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x140028f28
mov rcx, qword [r14]
call qword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
mov cl, byte [rax]
sub cl, bl
movzx edx, cl
mov rcx, qword [r14]
call qword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
mov ecx, dword [rax]
cmp ecx, 0x2000
jae 0x140028e58
mov dword [r15], ebx
lea rdx, str.Low_Integrity
mov rcx, rsi
call fcn.1400029b8
jmp 0x140028fb3
cmp ecx, 0x3000
jae 0x140028f0d
mov edx, dword [0x14019fd80]
lea r8d, [rdx + 2]
lea ecx, [rdx + 1]
imul r8d, ecx
imul r8d, edx
mov eax, 0x2aaaaaab
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 2
sub r8d, eax
cmp r8d, 2
jne 0x140028ebf
lea eax, [r8 + 0x57]
lea r8d, [rax + 0x54]
test r8d, r8d
je 0x140028eb6
mov ecx, r8d
cdq
idiv r8d
mov r8d, edx
mov eax, ecx
test ecx, ecx
jne 0x140028ea1
add eax, r8d
mov dword [0x14019fd80], eax
mov dword [r15], 2
lea rdx, str.Mediu
lea rcx, [rbp - 0x20]
call fcn.140001cb0
nop
lea r8, str.m_Integrity
mov rdx, rax
mov rcx, rsi
call fcn.140017478
mov dword [rbp - 0x30], ebx
mov rdx, qword [rbp - 0x20]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140028fb6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x140028fb6
mov dword [r15], 3
lea rdx, str.High_Integrity
mov rcx, rsi
call fcn.1400029b8
jmp 0x140028fb3
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r8d, dword [0x14019fd80]
lea ecx, [r8 + 2]
lea eax, [r8 + 1]
imul ecx, eax
imul ecx, r8d
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 0xe
jne 0x140028f99
mov edx, edi
mov r9d, 8
mov ecx, edx
and ecx, ebx
sub ecx, ebx
not ecx
and ecx, r8d
mov eax, edx
sar eax, 1
mov edx, ecx
xor edx, eax
sub r9, rbx
jne 0x140028f6d
add r8d, edx
add edi, ebx
cmp edi, 0x100
jl 0x140028f65
mov dword [0x14019fd80], r8d
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [0x140130e70]
mov rcx, rsi
call fcn.140001cb0
nop
mov dword [rbp - 0x30], ebx
mov rax, rsi
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret