Function at 0x1800483a0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x248]
sub rsp, 0x348
mov r13, rcx
mov dword [rbp + 0x40], 0x79cc4519
mov ecx, 3
mov dword [rbp + 0x44], 0x79cc4519
mov dword [rbp + 0x48], 0x79cc4519
lea rax, [rbp + 0x80]
mov dword [rbp + 0x4c], 0x79cc4519
movabs r8, 0x7a879d8a7a879d8a
mov dword [rbp + 0x50], 0x79cc4519
mov dword [rbp + 0x54], 0x79cc4519
mov dword [rbp + 0x58], 0x79cc4519
mov dword [rbp + 0x5c], 0x79cc4519
mov dword [rbp + 0x60], 0x79cc4519
mov dword [rbp + 0x64], 0x79cc4519
mov dword [rbp + 0x68], 0x79cc4519
mov dword [rbp + 0x6c], 0x79cc4519
mov dword [rbp + 0x70], 0x79cc4519
mov dword [rbp + 0x74], 0x79cc4519
mov dword [rbp + 0x78], 0x79cc4519
mov dword [rbp + 0x7c], 0x79cc4519
nop dword [rax]
mov qword [rax], r8
mov qword [rax + 8], r8
mov qword [rax + 0x10], r8
lea rax, [rax + 0x40]
mov qword [rax - 0x28], r8
mov qword [rax - 0x20], r8
mov qword [rax - 0x18], r8
mov qword [rax - 0x10], r8
mov qword [rax - 8], r8
sub rcx, 1
jne 0x180048450
movzx eax, byte [rdx + 1]
movzx ecx, byte [rdx]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 5]
mov dword [rsp + 0x30], ecx
movzx ecx, byte [rdx + 4]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 6]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 7]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 9]
mov dword [rsp + 0x34], ecx
movzx ecx, byte [rdx + 8]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0xa]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0xb]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0xd]
mov dword [rsp + 0x38], ecx
movzx ecx, byte [rdx + 0xc]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0xe]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0xf]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x11]
mov dword [rsp + 0x3c], ecx
movzx ecx, byte [rdx + 0x10]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x12]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x13]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x15]
mov dword [rsp + 0x40], ecx
movzx ecx, byte [rdx + 0x14]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x16]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x17]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x19]
mov dword [rsp + 0x44], ecx
movzx ecx, byte [rdx + 0x18]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x1a]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x1b]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x1d]
mov dword [rsp + 0x48], ecx
movzx ecx, byte [rdx + 0x1c]
shl ecx, 8
or ecx, eax
shl ecx, 8
movzx eax, byte [rdx + 0x1e]
or ecx, eax
movzx eax, byte [rdx + 0x1f]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x21]
mov dword [rsp + 0x4c], ecx
movzx ecx, byte [rdx + 0x20]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x22]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x23]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x25]
mov dword [rsp + 0x50], ecx
movzx ecx, byte [rdx + 0x24]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x26]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x27]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x29]
mov dword [rsp + 0x54], ecx
movzx ecx, byte [rdx + 0x28]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x2a]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x2b]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x2d]
mov dword [rsp + 0x58], ecx
movzx ecx, byte [rdx + 0x2c]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x2e]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x2f]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x31]
mov dword [rsp + 0x5c], ecx
movzx ecx, byte [rdx + 0x30]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x32]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x33]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x35]
mov dword [rsp + 0x60], ecx
movzx ecx, byte [rdx + 0x34]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x36]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x37]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x39]
mov dword [rsp + 0x64], ecx
movzx ecx, byte [rdx + 0x38]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x3a]
shl ecx, 8
or ecx, eax
shl ecx, 8
movzx eax, byte [rdx + 0x3b]
mov esi, 0xd
or ecx, eax
movzx eax, byte [rdx + 0x3d]
mov dword [rsp + 0x68], ecx
movzx ecx, byte [rdx + 0x3c]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x3e]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x3f]
shl ecx, 8
or ecx, eax
lea rax, [rsp + 0x30]
mov dword [rsp + 0x6c], ecx
nop dword [rax]
nop word [rax + rax]
mov edx, dword [rax + 0x34]
mov ebx, dword [rax + 0xc]
lea rax, [rax + 0x10]
rol edx, 0xf
xor edx, dword [rax + 0xc]
xor edx, dword [rax - 0x10]
mov ecx, edx
rol ebx, 7
rol ecx, 0xf
xor ebx, ecx
mov ecx, edx
ror ecx, 9
xor ebx, ecx
xor ebx, dword [rax + 0x18]
xor ebx, edx
mov dword [rax + 0x30], ebx
mov r8d, dword [rax + 0x28]
mov edx, dword [rax]
rol edx, 7
rol r8d, 0xf
xor r8d, dword [rax + 0x10]
xor r8d, dword [rax - 0xc]
mov ecx, r8d
rol ebx, 0xf
xor ebx, dword [rax + 0x18]
xor ebx, dword [rax - 4]
rol ecx, 0xf
xor edx, ecx
mov ecx, r8d
ror ecx, 9
xor edx, ecx
xor edx, dword [rax + 0x1c]
xor edx, r8d
mov dword [rax + 0x34], edx
mov r8d, dword [rax + 0x2c]
mov edx, dword [rax + 4]
rol edx, 7
rol r8d, 0xf
xor r8d, dword [rax + 0x14]
xor r8d, dword [rax - 8]
mov ecx, r8d
rol ecx, 0xf
xor edx, ecx
mov ecx, r8d
ror ecx, 9
xor edx, ecx
mov ecx, ebx
xor edx, dword [rax + 0x20]
xor edx, r8d
rol ecx, 0xf
mov dword [rax + 0x38], edx
mov edx, dword [rax + 8]
rol edx, 7
xor edx, ecx
mov ecx, ebx
ror ecx, 9
xor edx, ecx
xor edx, dword [rax + 0x24]
xor edx, ebx
mov dword [rax + 0x3c], edx
sub rsi, 1
jne 0x1800486c0
xor r9d, r9d
mov qword [rsp], r9
mov eax, r9d
movdqu xmm1, xmmword [rsp + rax + 0x50]
movdqu xmm2, xmmword [rsp + rax + 0x40]
movdqu xmm0, xmmword [rsp + rax + 0x30]
pxor xmm0, xmm2
pxor xmm2, xmm1
movdqu xmmword [rbp + rax + 0x140], xmm0
movdqu xmmword [rbp + rax + 0x150], xmm2
movdqu xmm2, xmmword [rsp + rax + 0x60]
movdqa xmm0, xmm2
pxor xmm0, xmm1
movdqu xmm1, xmmword [rsp + rax + 0x70]
movdqu xmmword [rbp + rax + 0x160], xmm0
pxor xmm1, xmm2
movdqu xmmword [rbp + rax + 0x170], xmm1
add rax, 0x40
cmp rax, 0x100
jl 0x180048782
mov r11d, dword [r13 + 8]
mov ecx, 2
mov edi, dword [r13 + 0xc]
mov ebx, dword [r13 + 0x10]
mov r10d, dword [r13 + 0x14]
mov r12d, dword [r13 + 0x18]
mov r15d, dword [r13 + 0x1c]
mov r14d, dword [r13 + 0x20]
mov esi, dword [r13 + 0x24]
mov dword [rbp + 0x298], ecx
mov dword [rsp + 8], r11d
mov dword [rsp + 0xc], edi
mov dword [rsp + 0x10], ebx
mov dword [rsp + 0x14], r10d
mov dword [rsp + 0x18], r12d
mov dword [rsp + 0x1c], r15d
mov dword [rsp + 0x20], r14d
mov dword [rsp + 0x24], esi
nop dword [rax]
nop dword [rax + rax]
mov r8d, dword [rbp + r9 + 0x40]
add ecx, 0xfffffffe
rol r8d, cl
mov eax, ebx
xor eax, edi
mov ecx, r14d
xor ecx, r15d
rol edi, 9
xor eax, r11d
ror r15d, 0xd
xor ecx, r12d
mov edx, r11d
add ecx, dword [rsp + r9 + 0x30]
rol edx, 0xc
add r8d, edx
add r8d, r12d
rol r8d, 7
add ecx, r8d
xor edx, r8d
add eax, edx
add ecx, esi
add eax, dword [rbp + r9 + 0x140]
mov esi, ecx
mov edx, dword [rbp + r9 + 0x44]
add r10d, eax
mov eax, ecx
ror esi, 0xf
rol eax, 9
mov r8d, ebx
xor esi, eax
mov ebx, r10d
xor esi, ecx
rol ebx, 0xc
mov ecx, dword [rbp + 0x298]
mov eax, r10d
xor eax, edi
dec ecx
rol edx, cl
xor eax, r11d
add eax, dword [rbp + r9 + 0x144]
add edx, ebx
add eax, r8d
rol r11d, 9
add edx, esi
mov r8d, edi
rol edx, 7
mov ecx, r15d
xor ecx, r12d
xor ebx, edx
xor ecx, esi
ror r12d, 0xd
add ecx, dword [rsp + r9 + 0x34]
add ebx, eax
add ecx, edx
mov edi, ebx
mov edx, dword [rbp + r9 + 0x48]
add ecx, r14d
mov r14d, ecx
rol edi, 0xc
mov eax, ecx
ror r14d, 0xf
rol eax, 9
xor r14d, eax
mov eax, ebx
xor r14d, ecx
xor eax, r11d
mov ecx, dword [rbp + 0x298]
xor eax, r10d
add eax, dword [rbp + r9 + 0x148]
rol edx, cl
add eax, r8d
add edx, edi
mov ecx, r12d
xor ecx, esi
add edx, r14d
rol edx, 7
xor ecx, r14d
add ecx, dword [rsp + r9 + 0x38]
xor edi, edx
add edi, eax
add ecx, edx
mov edx, dword [rbp + r9 + 0x4c]
lea r9, [r9 + 0x10]
add ecx, r15d
ror esi, 0xd
mov r15d, ecx
rol r10d, 9
mov eax, ecx
ror r15d, 0xf
rol eax, 9
mov r8d, edi
xor r15d, eax
rol r8d, 0xc
xor r15d, ecx
mov eax, edi
mov ecx, dword [rbp + 0x298]
xor eax, r10d
inc ecx
xor eax, ebx
add eax, dword [rbp + r9 + 0x13c]
rol edx, cl
add eax, r11d
add edx, r8d
rol ebx, 9
add edx, r15d
mov ecx, esi
xor ecx, r14d
rol edx, 7
xor ecx, r15d
ror r14d, 0xd
add ecx, dword [rsp + r9 + 0x2c]
xor r8d, edx
add r8d, eax
add ecx, edx
add ecx, r12d
mov r11d, r8d
mov r12d, ecx
mov eax, ecx
ror r12d, 0xf
rol eax, 9
xor r12d, eax
xor r12d, ecx
mov ecx, dword [rbp + 0x298]
add ecx, 4
mov dword [rbp + 0x298], ecx
lea eax, [rcx - 2]
cmp eax, 0x10
jl 0x180048840
mov ecx, 0x12
mov r13d, r10d
mov dword [rbp + 0x298], ecx
mov r9d, r8d
mov r11, qword [rsp]
add ecx, 0xfffffffe
mov r10d, r8d
mov eax, r8d
or eax, edi
rol r10d, 0xc
and eax, ebx
and r8d, edi
mov edx, dword [rbp + r11 + 0x80]
or eax, r8d
add eax, dword [rbp + r11 + 0x180]
rol edx, cl
add eax, r13d
add edx, r10d
rol edi, 9
add edx, r12d
mov ecx, r12d
not ecx
rol edx, 7
and ecx, r14d
xor r10d, edx
add r10d, eax
mov eax, r15d
and eax, r12d
ror r15d, 0xd
or ecx, eax
add ecx, dword [rsp + r11 + 0x70]
mov r11d, r10d
add ecx, edx
rol r11d, 0xc
add ecx, esi
mov rsi, qword [rsp]
mov r8d, ecx
mov eax, ecx
rol eax, 9
ror r8d, 0xf
mov edx, dword [rbp + rsi + 0x84]
xor r8d, eax
xor r8d, ecx
mov eax, r10d
mov ecx, dword [rbp + 0x298]
and eax, r9d
dec ecx
rol edx, cl
mov ecx, r10d
or ecx, r9d
add edx, r11d
and ecx, edi
rol r9d, 9
or eax, ecx
mov dword [rbp + 0x2a0], r9d
add eax, dword [rbp + rsi + 0x184]
add edx, r8d
rol edx, 7
add eax, ebx
xor r11d, edx
mov ecx, r8d
add r11d, eax
not ecx
and ecx, r15d
mov eax, r12d
and eax, r8d
ror r12d, 0xd
or ecx, eax
mov r13d, r11d
add ecx, dword [rsp + rsi + 0x74]
add ecx, edx
rol r13d, 0xc
mov edx, dword [rbp + rsi + 0x88]
add ecx, r14d
mov r9d, ecx
mov eax, ecx
ror r9d, 0xf
rol eax, 9
xor r9d, eax
xor r9d, ecx
mov ecx, dword [rbp + 0x298]
rol edx, cl
add edx, r13d
add edx, r9d
rol edx, 7
xor r13d, edx
mov ecx, r11d
or ecx, r10d
mov eax, r11d
and ecx, dword [rbp + 0x2a0]
and eax, r10d
or eax, ecx
rol r10d, 9
add eax, dword [rbp + rsi + 0x188]
mov ecx, r9d
add eax, edi
not ecx
and ecx, r12d
add r13d, eax
mov eax, r8d
mov ebx, r13d
and eax, r9d
rol ebx, 0xc
or ecx, eax
ror r8d, 0xd
add ecx, dword [rsp + rsi + 0x78]
add ecx, edx
add ecx, r15d
mov r15, qword [rsp]
mov esi, ecx
mov eax, ecx
rol eax, 9
ror esi, 0xf
mov edx, dword [rbp + r15 + 0x8c]
xor esi, eax
xor esi, ecx
mov eax, r13d
mov ecx, dword [rbp + 0x298]
and eax, r11d
inc ecx
rol edx, cl
mov ecx, r13d
or ecx, r11d
add edx, ebx
and ecx, r10d
rol r11d, 9
or eax, ecx
add edx, esi
add eax, dword [rbp + r15 + 0x18c]
mov ecx, esi
add eax, dword [rbp + 0x2a0]
not ecx
and ecx, r8d
rol edx, 7
xor ebx, edx
add ebx, eax
mov eax, r9d
and eax, esi
ror r9d, 0xd
or ecx, eax
mov edi, ebx
add ecx, dword [rsp + r15 + 0x7c]
add ecx, edx
rol edi, 0xc
mov edx, dword [rbp + r15 + 0x90]
add ecx, r12d
mov r12d, dword [rbp + 0x298]
mov r14d, ecx
mov eax, ecx
ror r14d, 0xf
rol eax, 9
xor r14d, eax
mov eax, ebx
xor r14d, ecx
and eax, r13d
lea ecx, [r12 + 2]
rol edx, cl
mov ecx, ebx
add edx, edi
or ecx, r13d
and ecx, r11d
add edx, r14d
or eax, ecx
rol edx, 7
add eax, dword [rbp + r15 + 0x190]
xor edi, edx
add eax, r10d
rol r13d, 9
add edi, eax
mov r10, r15
mov ecx, r14d
mov eax, esi
not ecx
ror esi, 0xd
and ecx, r9d
and eax, r14d
or ecx, eax
add ecx, dword [rbp + r15 - 0x80]
add ecx, edx
mov edx, dword [rbp + r10 + 0x94]
add ecx, r8d
mov r8d, edi
mov r15d, ecx
rol r8d, 0xc
mov eax, ecx
ror r15d, 0xf
rol eax, 9
xor r15d, eax
mov eax, edi
xor r15d, ecx
and eax, ebx
lea ecx, [r12 + 3]
rol edx, cl
mov ecx, edi
or ecx, ebx
add edx, r8d
and ecx, r13d
rol ebx, 9
or eax, ecx
add edx, r15d
add eax, dword [rbp + r10 + 0x194]
mov ecx, r15d
add eax, r11d
rol edx, 7
not ecx
xor r8d, edx
add r8d, eax
and ecx, esi
mov eax, r14d
ror r14d, 0xd
and eax, r15d
or ecx, eax
add ecx, dword [rbp + r10 - 0x7c]
add r10, 0x18
add ecx, edx
mov qword [rsp], r10
add ecx, r9d
mov r9d, r8d
mov r12d, ecx
mov eax, ecx
ror r12d, 0xf
rol eax, 9
xor r12d, eax
xor r12d, ecx
mov ecx, dword [rbp + 0x298]
add ecx, 6
mov dword [rbp + 0x298], ecx
lea eax, [rcx - 2]
cmp eax, 0x40
jl 0x1800489f0
mov eax, dword [rsp + 8]
xor eax, r8d
mov dword [rbp + reloc.SHELL32.dll_IsUserAnAdmin], r13d
mov r13, qword [rbp + 0x290]
mov dword [r13 + 8], eax
mov eax, dword [rsp + 0xc]
xor eax, edi
mov dword [r13 + 0xc], eax
mov eax, dword [rsp + 0x10]
xor eax, ebx
mov dword [r13 + 0x10], eax
mov eax, dword [rsp + 0x14]
xor eax, dword [rbp + reloc.SHELL32.dll_IsUserAnAdmin]
mov dword [r13 + 0x14], eax
mov eax, dword [rsp + 0x18]
xor eax, r12d
mov dword [r13 + 0x18], eax
mov eax, dword [rsp + 0x1c]
xor eax, r15d
mov dword [r13 + 0x1c], eax
mov eax, dword [rsp + 0x20]
xor eax, r14d
mov dword [r13 + 0x20], eax
mov eax, dword [rsp + 0x24]
xor eax, esi
mov dword [r13 + 0x24], eax
add rsp, 0x348
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret