Function at 0x140184000
Capabilities:
Encode data using xor

Disassembly:
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
push rbp
mov rbp, rsp
sub rsp, 0x20
and rsp, 0xfffffffffffffff0
lea rcx, [0x140022a00]
push 0
pop rsi
push rcx
add dword [rcx + 0x7c], reloc.ADVAPI32.dll_TraceMessage
not dword [rcx + 0x50]
sub dword [rcx + 0xb4], reloc.ADVAPI32.dll_TraceMessage
xor dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x141b6d9a
sub dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x22e96eda
add dword [rcx + 0x30], reloc.ADVAPI32.dll_TraceMessage
add dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x26c84c74
add dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x1a2e2a35
xor dword [rcx + 0x98], reloc.ADVAPI32.dll_TraceMessage
add dword [rcx + 0x70], reloc.ADVAPI32.dll_TraceMessage
sub dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x169a5d9a
xor dword [rcx + 0x8c], reloc.ADVAPI32.dll_TraceMessage
xor dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x7ccd7419
not dword [rcx + reloc.ADVAPI32.dll_TraceMessage]
not dword [rcx + reloc.ADVAPI32.dll_TraceMessage]
add dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x3a69198e
sub dword [rcx + 0x64], reloc.ADVAPI32.dll_TraceMessage
sub dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x744b54f5
add dword [rcx + 0xec], reloc.ADVAPI32.dll_TraceMessage
add dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x377a5fb3
sub dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0xb576ea0
add dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x54516dcc
sub dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x1e587e40
add dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x2446014
xor dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x41205d8a
sub dword [rcx + 0xfc], reloc.ADVAPI32.dll_TraceMessage
not dword [rcx + reloc.ADVAPI32.dll_TraceMessage]
xor dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x4ded5259
xor dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x174105b3
xor dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x154321ad
not dword [rcx + 0x84]
add dword [rcx + 8], reloc.ADVAPI32.dll_TraceMessage
add dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x30b21c7b
add dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x7acc6b5a
not dword [rcx + reloc.ADVAPI32.dll_TraceMessage]
xor dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x70eb503a
xor dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x4527048a
not dword [rcx + reloc.ADVAPI32.dll_TraceMessage]
not dword [rcx + reloc.ADVAPI32.dll_TraceMessage]
add dword [rcx + 0xdc], reloc.ADVAPI32.dll_TraceMessage
sub dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x48596403
add dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x595e55d9
add dword [rcx + 0xf0], reloc.ADVAPI32.dll_TraceMessage
add dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x796b1d2a
xor dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x514566bc
not dword [rcx + reloc.ADVAPI32.dll_TraceMessage]
not dword [rcx + reloc.ADVAPI32.dll_TraceMessage]
sub dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x5ee2670d
xor dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x1d407d79
xor dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x307e35e0
not dword [rcx + reloc.ADVAPI32.dll_TraceMessage]
xor dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x660c1309
not dword [rcx + reloc.ADVAPI32.dll_TraceMessage]
add dword [rcx + 0x3c], reloc.ADVAPI32.dll_TraceMessage
add dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x6c8026e3
sub dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x23e80998
not dword [rcx + reloc.ADVAPI32.dll_TraceMessage]
xor dword [rcx + 0xe8], reloc.ADVAPI32.dll_TraceMessage
xor dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x1a5d47c6
xor dword [rcx + 0xac], reloc.ADVAPI32.dll_TraceMessage
sub dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x50e55e96
sub dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x42c91e73
sub dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x7be137ee
sub dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x425f041b
add dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x14b616fc
xor dword [rcx + 0x40], reloc.ADVAPI32.dll_TraceMessage
xor dword [rcx + 0xd0], reloc.ADVAPI32.dll_TraceMessage
xor dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x7fa002a1
not dword [rcx + 0x90]
add dword [rcx + 0x28], reloc.ADVAPI32.dll_TraceMessage
xor dword [rcx + 0x2c], reloc.ADVAPI32.dll_TraceMessage
xor dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x381f44fa
sub dword [rcx + 0xe4], reloc.ADVAPI32.dll_TraceMessage
sub dword [rcx + 0x60], reloc.ADVAPI32.dll_TraceMessage
add dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x365f51f4
add dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x1eb425fd
xor dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x52a60758
sub dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x47673dd0
xor dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x6fa04f6e
not dword [rcx + reloc.ADVAPI32.dll_TraceMessage]
add dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x79205249
add dword [rcx + 0xd4], reloc.ADVAPI32.dll_TraceMessage
sub dword [rcx], reloc.ADVAPI32.dll_TraceMessage
xor dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x39ea5cd6
not dword [rcx + reloc.ADVAPI32.dll_TraceMessage]
not dword [rcx + reloc.ADVAPI32.dll_TraceMessage]
xor dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x40c62ed2
xor dword [rcx + 0x14], reloc.ADVAPI32.dll_TraceMessage
sub dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x18e47d44
add dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x18ed556b
not dword [rcx + 0x9c]
xor dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x51955184
add dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x549e14cf
xor dword [rcx + 0xc], reloc.ADVAPI32.dll_TraceMessage
add dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x65711dfb
not dword [rcx + reloc.ADVAPI32.dll_TraceMessage]
xor dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x1adc4c6e
xor dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x485b4b07
add dword [rcx + 0x68], reloc.ADVAPI32.dll_TraceMessage
sub dword [rcx + 0x5c], reloc.ADVAPI32.dll_TraceMessage
add dword [rcx + 0x44], reloc.ADVAPI32.dll_TraceMessage
not dword [rcx + reloc.ADVAPI32.dll_TraceMessage]
sub dword [rcx + 0xa0], reloc.ADVAPI32.dll_TraceMessage
add dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x7de429f9
xor dword [rcx + 0x10], reloc.ADVAPI32.dll_TraceMessage
add dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x657c7953
not dword [rcx + 0xc8]
xor dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x353f24c9
xor dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x7fa54f3c
sub dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x33fc5a61
sub dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x25527282
sub dword [rcx + 0x6c], reloc.ADVAPI32.dll_TraceMessage
sub dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x5db206c6
xor dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x32e237d5
not dword [rcx + reloc.ADVAPI32.dll_TraceMessage]
add dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x65904e43
not dword [rcx + reloc.ADVAPI32.dll_TraceMessage]
not dword [rcx + reloc.ADVAPI32.dll_TraceMessage]
add dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x187c5564
xor dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0xf1a0142
sub dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x3a0a1ee8
not dword [rcx + reloc.ADVAPI32.dll_TraceMessage]
xor dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x5e6f6469
add dword [rcx + 0x78], reloc.ADVAPI32.dll_TraceMessage
add dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x4f220263
add dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x650a0a89
add dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x27d1a68
add dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x2d0a06f1
sub dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x565a105f
add dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x312b23c7
xor dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x3b306188
sub dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0xa874319
not dword [rcx + reloc.ADVAPI32.dll_TraceMessage]
add dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x77793b8e
add dword [rcx + 0x88], reloc.ADVAPI32.dll_TraceMessage
not dword [rcx + reloc.ADVAPI32.dll_TraceMessage]
xor dword [rcx + 0xb8], reloc.ADVAPI32.dll_TraceMessage
xor dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x7c1f48ff
not dword [rcx + reloc.ADVAPI32.dll_TraceMessage]
xor dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x4fd8160e
add dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x432c530c
sub dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x34337621
xor dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x2e3d4adf
sub dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x197f642e
xor dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x30ca0426
sub dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x48566599
not dword [rcx + reloc.ADVAPI32.dll_TraceMessage]
sub dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x611b3022
not dword [rcx + reloc.ADVAPI32.dll_TraceMessage]
sub dword [rcx + 0x18], reloc.ADVAPI32.dll_TraceMessage
sub dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x3bff5d95
not dword [rcx + 0x1c]
sub dword [rcx + 4], reloc.ADVAPI32.dll_TraceMessage
not dword [rcx + reloc.ADVAPI32.dll_TraceMessage]
add dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x516529dd
not dword [rcx + reloc.ADVAPI32.dll_TraceMessage]
sub dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x4a9129ce
xor dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x79bf33d6
add dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x17ab417c
add dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x243775a0
sub dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x43174cf7
add dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x6ef96bfc
not dword [rcx + 0x34]
xor dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x4c541472
add dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x5a32bb
sub dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x60b61c18
xor dword [rcx + 0x74], reloc.ADVAPI32.dll_TraceMessage
xor dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x4e7a3a6d
add dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x16bb039a
sub dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x44817e40
not dword [rcx + reloc.ADVAPI32.dll_TraceMessage]
xor dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x320306d2
add dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x4bcb7750
add dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x729526d5
add dword [rcx + 0xc4], reloc.ADVAPI32.dll_TraceMessage
sub dword [rcx + 0x4c], reloc.ADVAPI32.dll_TraceMessage
sub dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x7841525
xor dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x5f9b636e
sub dword [rcx + 0x94], reloc.ADVAPI32.dll_TraceMessage
not dword [rcx + reloc.ADVAPI32.dll_TraceMessage]
xor dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x3a4e6e09
xor dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x6cf05b7c
add dword [rcx + 0xd8], reloc.ADVAPI32.dll_TraceMessage
sub dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0xa3a6784
xor dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x57e75156
not dword [rcx + reloc.ADVAPI32.dll_TraceMessage]
xor dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x31733e49
add dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0xc1159c8
xor dword [rcx + 0x80], reloc.ADVAPI32.dll_TraceMessage
sub dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x7ce93afa
add dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x3c88520a
add dword [rcx + 0xa8], reloc.ADVAPI32.dll_TraceMessage
not dword [rcx + reloc.ADVAPI32.dll_TraceMessage]
xor dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x4dd55dbb
sub dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x62d305ff
not dword [rcx + 0x54]
not dword [rcx + reloc.ADVAPI32.dll_TraceMessage]
add dword [rcx + 0x58], reloc.ADVAPI32.dll_TraceMessage
xor dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x2edb5443
not dword [rcx + reloc.ADVAPI32.dll_TraceMessage]
not dword [rcx + reloc.ADVAPI32.dll_TraceMessage]
add dword [rcx + 0xcc], reloc.ADVAPI32.dll_TraceMessage
add dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x39206de3
sub dword [rcx + 0xb0], reloc.ADVAPI32.dll_TraceMessage
not dword [rcx + reloc.ADVAPI32.dll_TraceMessage]
xor dword [rcx + 0xa4], reloc.ADVAPI32.dll_TraceMessage
sub dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x615c55b4
xor dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x2ada04c6
not dword [rcx + reloc.ADVAPI32.dll_TraceMessage]
not dword [rcx + reloc.ADVAPI32.dll_TraceMessage]
add dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x26cf49f0
add dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x47960df4
not dword [rcx + 0x48]
xor dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x73d242e0
add dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x592a2f35
add dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x5b876068
sub dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x249155c
not dword [rcx + 0xf8]
sub dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x31053666
not dword [rcx + reloc.ADVAPI32.dll_TraceMessage]
not dword [rcx + reloc.ADVAPI32.dll_TraceMessage]
sub dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x75c37e84
add dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x56ec4a5d
sub dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x5ddb6871
not dword [rcx + reloc.ADVAPI32.dll_TraceMessage]
add dword [rcx + 0xe0], reloc.ADVAPI32.dll_TraceMessage
sub dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x7dc42a07
xor dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x2886bcc
add dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x43de6ce7
xor dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x32e672fa
not dword [rcx + 0xc0]
add dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x4aba16f3
not dword [rcx + reloc.ADVAPI32.dll_TraceMessage]
not dword [rcx + reloc.ADVAPI32.dll_TraceMessage]
xor dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x59300fac
xor dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x334a4c62
add dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x7d4538d6
not dword [rcx + reloc.ADVAPI32.dll_TraceMessage]
not dword [rcx + reloc.ADVAPI32.dll_TraceMessage]
add dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x91f169f
not dword [rcx + 0x20]
xor dword [rcx + 0xf4], reloc.ADVAPI32.dll_TraceMessage
add dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x350f128a
not dword [rcx + 0x38]
add dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x6bc60386
xor dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x6f2625da
not dword [rcx + reloc.ADVAPI32.dll_TraceMessage]
xor dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x2d20524b
not dword [rcx + reloc.ADVAPI32.dll_TraceMessage]
xor dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x1deb4d7f
sub dword [rcx + 0xbc], reloc.ADVAPI32.dll_TraceMessage
add dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x4061172e
xor dword [rcx + reloc.ADVAPI32.dll_TraceMessage], 0x371a3423
not dword [rcx + reloc.ADVAPI32.dll_TraceMessage]
sub dword [rcx + 0x24], reloc.ADVAPI32.dll_TraceMessage
not dword [rcx + reloc.ADVAPI32.dll_TraceMessage]
add rsi, 0x400
add rcx, 0x400
cmp rsi, 0x8c000
jne 0x14018402e
pop rcx
call fcn.1400adb3e
mov rsp, rbp
pop rbp
pop r15
pop r14
pop r13
pop r12
pop r11
pop r10
pop r9
pop r8
pop rdi
pop rsi
pop rbp
pop rbx
pop rdx
pop rcx
pop rax