Function at 0x1402da000
Capabilities:
Encode data using xor

Disassembly:
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
push rbp
mov rbp, rsp
sub rsp, 0x20
and rsp, 0xfffffffffffffff0
lea rcx, [0x14024dc00]
push 0
pop rsi
push rcx
not dword [rcx + 0x54]
not dword [rcx + 0x374]
sub dword [rcx + 0x2b0], 0x5f79054b
add dword [rcx + 0x34], 0x2e7b290c
add dword [rcx + 0xd8], 0x67706df8
not dword [rcx + 0x254]
add dword [rcx + 0x228], 0x2bde007c
sub dword [rcx + 0x3b8], 0x53f09dd
xor dword [rcx + 0x35c], 0x552548d9
add dword [rcx + 0x274], 0x3b5302fb
add dword [rcx + 0x3f0], 0x240970fd
xor dword [rcx + 0x3c8], 0xcd74337
sub dword [rcx + 0x2fc], 0x69592200
xor dword [rcx + 0x30], 0x69ac2d85
add dword [rcx + 0x88], 0x13061dd9
not dword [rcx + 0xdc]
add dword [rcx + 0x28c], 0x6a9b2ac9
not dword [rcx + 0x1f8]
xor dword [rcx + 0x60], 0x284630e7
sub dword [rcx + 0x240], 0x6ca068ad
add dword [rcx + 0x19c], 0x5e6d3dad
not dword [rcx + 0x1fc]
not dword [rcx + 0x11c]
sub dword [rcx + 0x48], 0x34f444f7
sub dword [rcx + 0x108], 0x6d025d63
add dword [rcx + 0x140], 0x2b0d3803
not dword [rcx + 0x6c]
not dword [rcx + 0x16c]
xor dword [rcx + 0xd4], 0x33ad4aaf
not dword [rcx + 0x3e4]
not dword [rcx + 0x394]
add dword [rcx + 0x14], 0x4da237dc
xor dword [rcx + 0x1d4], 0x10114777
not dword [rcx + 0x128]
add dword [rcx + 0x3c0], 0x48832cc8
add dword [rcx + 0x3e8], 0x2b1d1842
add dword [rcx + 0x194], 0x60f928dd
xor dword [rcx + 0x248], 0x345050fd
add dword [rcx + 0x174], 0x317824a6
add dword [rcx + 0x378], 0x7e900d8c
sub dword [rcx + 0xe4], 0x45f337ee
add dword [rcx + 0xe8], 0x3fdd1bd6
not dword [rcx + 0x1bc]
not dword [rcx + 0x22c]
not dword [rcx + 0x154]
xor dword [rcx + 0x78], 0x6dd9278d
sub dword [rcx + 0x330], 0x2ac16f52
xor dword [rcx + 0x3bc], 0x38b028d9
xor dword [rcx + 0x340], 0x1ce30770
not dword [rcx + 0xac]
xor dword [rcx + 0x2c8], 0x3a822d6b
not dword [rcx + 0x234]
sub dword [rcx + 0x26c], 0xd1b1902
sub dword [rcx + 0x80], 0xd004b9b
add dword [rcx + 0x344], 0x774867c3
sub dword [rcx + 0x238], 0x758698c
not dword [rcx + 0x360]
sub dword [rcx + 0x384], 0x477e5ef2
add dword [rcx + 0x178], 0xd9d7cee
xor dword [rcx + 0x2a0], 0x70663bad
sub dword [rcx + 0x214], 0x394253a3
sub dword [rcx + 0x44], 0x7f89766d
sub dword [rcx + 0x3d8], 0x4618245d
add dword [rcx + 0xbc], 0x19d77394
sub dword [rcx + 0x1a4], 0x69c36e6
sub dword [rcx + 0x24c], 0xe10495
xor dword [rcx + 0x39c], 0x53c94465
xor dword [rcx + 0x258], 0x1c7f5437
xor dword [rcx + 0x134], 0x39a16989
xor dword [rcx + 0x33c], 0x4f027a38
add dword [rcx + 0x18c], 0x5f861754
sub dword [rcx + 0x38c], 0x4cf40827
sub dword [rcx + 0x1c8], 0x684d5d40
add dword [rcx + 0x250], 0x312010ce
xor dword [rcx + 0x3c], 0x3e062d7e
add dword [rcx + 0x74], 0xf407d6f
xor dword [rcx + 0x1b0], 0x521d006a
add dword [rcx + 0x368], 0x10b14fb8
not dword [rcx + 0x158]
not dword [rcx + 0x14c]
add dword [rcx + 0x18], 0x5c5e1b4f
sub dword [rcx + 0x390], 0x5fe91085
xor dword [rcx + 0x164], 0x6e4d531c
not dword [rcx + 0x2f4]
sub dword [rcx + 0x334], 0x3bc3138f
not dword [rcx + 0x294]
add dword [rcx + 0x1f4], 0x79356d00
not dword [rcx + 0x3d0]
sub dword [rcx + 0x160], 0x6cf32f3d
not dword [rcx + 0x24]
xor dword [rcx + 0x148], 0x11a21e7a
not dword [rcx + 0x8c]
not dword [rcx + 0x280]
sub dword [rcx + 0x3a0], 0x62d62582
sub dword [rcx + 0x1c0], 0x2cc2650
add dword [rcx + 0x104], 0x56161166
sub dword [rcx + 0x50], 0x72ce542a
sub dword [rcx + 0x290], 0x75af6b4e
not dword [rcx + 0x4c]
xor dword [rcx + 0x17c], 0xe1a374e
sub dword [rcx + 0x1c4], 0x6e2c74a1
sub dword [rcx + 0x338], 0x6c78630f
sub dword [rcx + 0x264], 0x1ec000cf
xor dword [rcx + 0x38], 0x493128d5
sub dword [rcx + 0x310], 0x17e70a81
sub dword [rcx + 0x3b0], 0x453a050a
add dword [rcx + 0x30c], 0x3fc315ee
add dword [rcx + 0x40], 0x36c11b4
xor dword [rcx + 0x10c], 0x6f2917d5
sub dword [rcx + 0x3dc], 0x13594713
not dword [rcx + 0x398]
add dword [rcx + 0x1ec], 0x72b042cd
sub dword [rcx + 0xe0], 0x5c881e64
not dword [rcx + 0x32c]
xor dword [rcx + 0x150], 0x6d0862a1
sub dword [rcx + 0x244], 0x5fa52f56
sub dword [rcx + 0x37c], 0x714c2a55
sub dword [rcx + 0x34c], 0x2bff0d47
add dword [rcx + 0x2e8], 0x7d7b28db
add dword [rcx + 0x28], 0x3807235f
not dword [rcx + 0x1a0]
not dword [rcx + 0x3a4]
xor dword [rcx + 0x130], 0xfd925a0
xor dword [rcx + 0x188], 0x569203d2
sub dword [rcx + 0x304], 0x3de36b94
xor dword [rcx + 0x180], 0x34ac5ea7
add dword [rcx + 0x324], 0xbc30d33
xor dword [rcx + 0x2c0], 0x5d1f4d8f
xor dword [rcx + 0x288], 0x67cd003b
not dword [rcx + 0x200]
xor dword [rcx + 0x118], 0x3f525580
xor dword [rcx + 0x3f8], 0x5cef0289
xor dword [rcx + 0x2e4], 0x1cc72c04
xor dword [rcx + 0x1f0], 0x7bad61f1
xor dword [rcx + 0x318], 0x2d0e6846
sub dword [rcx + 0x220], 0x58d84bff
not dword [rcx + 0xc]
add dword [rcx + 0x3fc], 0x49e22d89
sub dword [rcx + 0xc0], 0x44cb334c
not dword [rcx + 0x7c]
add dword [rcx + 0x320], 0x61332a5b
xor dword [rcx + 0x120], 0x7b1627c5
not dword [rcx + 0x354]
add dword [rcx + 0x58], 0x11612667
add dword [rcx + 0x2bc], 0x241a3c6a
add dword [rcx + 0x25c], 0x17c115f9
add dword [rcx + 0x68], 0x6d0c5e98
add dword [rcx + 0x15c], 0x36ed7b3f
add dword [rcx + 0x12c], 0x33be688b
add dword [rcx + 0xb8], 0x47931d45
sub dword [rcx + 0x298], 0x7bc91abc
not dword [rcx + 0x284]
add dword [rcx + 0x2a4], 0x1d867cdb
xor dword [rcx + 0x2e0], 0x1b2304a4
not dword [rcx + 0x2dc]
add dword [rcx + 0x2ec], 0x3c2a2f6b
not dword [rcx + 0x218]
sub dword [rcx + 0x348], 0x73bc6a41
xor dword [rcx + 0xc8], 0x1f7724f5
xor dword [rcx + 0x5c], 0x74ea37ea
xor dword [rcx], 0x579b4c65
add dword [rcx + 0xf0], 0x69e29e1
sub dword [rcx + 0x168], 0x50ac732a
add dword [rcx + 0xf4], 0x6aa45d13
sub dword [rcx + 0x70], 0x180b6052
sub dword [rcx + 0x170], 0x4a7777c4
not dword [rcx + 0x2cc]
add dword [rcx + 0x210], 0x502b75f5
add dword [rcx + 0x3e0], 0x94f7f50
not dword [rcx + 0x9c]
add dword [rcx + 0x2d8], 0xa4a1434
sub dword [rcx + 0xa8], 0x294a1b17
sub dword [rcx + 0x1e0], 0x6b2152eb
sub dword [rcx + 0x144], 0x12505d24
xor dword [rcx + 0x2b4], 0x4f931350
xor dword [rcx + 0x2b8], 0x289d32b1
sub dword [rcx + 8], 0x45c57b7a
add dword [rcx + 0x23c], 0x67406a58
add dword [rcx + 0x2ac], 0x51037fde
xor dword [rcx + 0x3d4], 0x78395e3b
xor dword [rcx + 0x3cc], 0x17a938e1
not dword [rcx + 0xc4]
not dword [rcx + 0x358]
sub dword [rcx + 0x208], 0x68e1edc
not dword [rcx + reloc.SHELL32.dll_IsUserAnAdmin]
not dword [rcx + 0xcc]
sub dword [rcx + 0x36c], 0x32136aa0
add dword [rcx + 0x314], 0x1d6a1dea
add dword [rcx + 0x328], 0x1d056a77
not dword [rcx + 0x1c]
sub dword [rcx + 0xa0], 0x69b34c49
not dword [rcx + 0xb0]
xor dword [rcx + 0x1dc], 0x79210124
not dword [rcx + 0x350]
xor dword [rcx + 0x100], 0x607e6034
sub dword [rcx + 0x270], 0x46582463
not dword [rcx + 0x90]
sub dword [rcx + 0x198], 0x5c436991
sub dword [rcx + 0x84], 0x7f258f6
not dword [rcx + 0x98]
not dword [rcx + 0x1ac]
sub dword [rcx + 0x1b4], 0x6bfa3f25
sub dword [rcx + 0x204], 0x1ce61b7
xor dword [rcx + 0x2d0], 0x151b71b5
xor dword [rcx + 0x388], 0x6d7830d4
not dword [rcx + 0x64]
sub dword [rcx + 0x268], 0x47a366f5
sub dword [rcx + 0x3a8], 0x575b6254
not dword [rcx + 0x1e8]
sub dword [rcx + 0xa4], 0x5ca800f3
not dword [rcx + 0x308]
not dword [rcx + 0x94]
add dword [rcx + 0x114], 0x4a953134
xor dword [rcx + 0x370], 0x3c6e55f1
sub dword [rcx + 0x380], 0x3c26405e
not dword [rcx + 0x230]
sub dword [rcx + 0x124], 0x43ff7498
not dword [rcx + 0x3b4]
sub dword [rcx + 0x20], 0x1b2e21ee
sub dword [rcx + 0x300], 0x7b477dd0
not dword [rcx + 0x3ac]
xor dword [rcx + 0x2d4], 0x6b007e65
xor dword [rcx + 0xf8], 0x3bcb3183
xor dword [rcx + 0x2c4], 0x3ab16699
xor dword [rcx + 0x29c], 0x4e1b33de
add dword [rcx + 0x278], 0x22456103
xor dword [rcx + 0x1d0], 0x3ccd38c5
xor dword [rcx + 0x3f4], 0x7a9f231a
xor dword [rcx + 0x260], 0x3ca95ce5
xor dword [rcx + 0x190], 0x1242117e
add dword [rcx + 0x21c], 0x11e00607
sub dword [rcx + 0x2f0], 0x6a901f10
add dword [rcx + 0x184], 0x5f623089
xor dword [rcx + 0x1cc], 0x7afd544e
add dword [rcx + 0x31c], 0x1ed6634b
not dword [rcx + 0xfc]
add dword [rcx + 0x13c], 0x48d75904
not dword [rcx + 0xb4]
xor dword [rcx + 0xd0], 0xabc2b6b
add dword [rcx + 0x3c4], 0x3163742c
xor dword [rcx + 0x20c], 0x6a441d1d
not dword [rcx + 0x1d8]
sub dword [rcx + 0x1a8], 0x95e1cee
not dword [rcx + 0x27c]
not dword [rcx + 0x10]
not dword [rcx + 0x364]
not dword [rcx + 0x2f8]
not dword [rcx + 0x2c]
add dword [rcx + 0x138], 0x272b640e
xor dword [rcx + 0x1b8], 0x4a4f7c69
not dword [rcx + 0x110]
xor dword [rcx + 0x1e4], 0x68ea7a9f
not dword [rcx + 0x224]
not dword [rcx + 4]
not dword [rcx + 0x3ec]
add dword [rcx + 0xec], 0x46e268a0
add rsi, 0x400
add rcx, 0x400
cmp rsi, 0x8c000
jne 0x1402da02e
pop rcx
call fcn.1402d9506
mov rsp, rbp
pop rbp
pop r15
pop r14
pop r13
pop r12
pop r11
pop r10
pop r9
pop r8
pop rdi
pop rsi
pop rbp
pop rbx
pop rdx
pop rcx
pop rax