Function at 0x140032370
Capabilities:
Encode data using xor
Get file attributes

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x318], rbx
mov rax, qword [0x14022b078]
xor rax, rsp
mov qword [rbp + 0x1b8], rax
mov r12, r8
mov qword [rsp + 0x78], r8
mov qword [rbp - 0x80], rdx
xor ebx, ebx
mov dword [rsp + 0x58], ebx
mov r14d, ebx
mov rdx, rcx
lea rcx, [rbp + 0xc8]
call fcn.14002f990
nop
movdqa xmm0, xmmword [0x1401da830]
movdqa xmmword [rbp], xmm0
mov word [rbp - 0x10], bx
movdqa xmmword [rbp + 0x20], xmm0
mov word [rbp + 0x10], bx
movdqa xmmword [rbp + 0x40], xmm0
mov word [rbp + 0x30], bx
movdqa xmmword [rbp + 0x60], xmm0
mov word [rbp + 0x50], bx
mov dword [rbp + 0x70], ebx
mov byte [rbp + 0x74], bl
lea rdx, [rbp - 0x10]
mov rcx, r12
call fcn.140032250
lea rcx, [rbp - 0x10]
call fcn.1400320f0
lea rax, [rbp + 0xc8]
cmp r12, rax
je 0x14003244a
lea rdx, [rbp + 0xc8]
cmp qword [rbp + 0xe0], 8
cmovae rdx, qword [rbp + 0xc8]
mov r8, qword [rbp + 0xd8]
mov rcx, r12
call fcn.140017000
cmp qword [rbp + 0xd8], 0
je 0x140032ef9
lea rdx, [rbp + 0xc8]
lea rcx, [rbp + 0x198]
call fcn.14002f990
lea rcx, [rbp + 0x198]
cmp qword [rbp + 0x1b0], 8
cmovae rcx, qword [rbp + 0x198]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
mov rdx, qword [rbp + 0x1b0]
cmp rdx, 8
jb 0x1400324d0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x198]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400324cb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032f74
call fcn.14013f180
cmp edi, 0xffffffff
je 0x140032ef9
mov qword [rbp + 0x98], rbx
lea rcx, [rbp + 0xc8]
cmp qword [rbp + 0xe0], 8
cmovae rcx, qword [rbp + 0xc8]
lea rax, [rbp + 0x98]
mov qword [rsp + 0x38], rax
lea rax, [0x1401d64b8]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
call qword [sym.imp.ole32.dll_StgOpenStorageEx]
test eax, eax
js 0x140032ed8
cmp qword [rbp + 0x98], 0
je 0x140032ed8
mov qword [rbp + 0x80], rbx
lea rdx, [rbp + 0xc8]
lea rcx, [rbp + 0xa0]
call fcn.1400305b0
nop
mov rcx, qword [rbp + 0xb0]
test rcx, rcx
je 0x140032e36
mov rdx, qword [rbp + 0xb8]
mov rax, rdx
sub rax, rcx
cmp rax, 4
jb 0x1400325b7
lea rsi, [rcx + 4]
mov qword [rbp + 0xb0], rsi
lea rdi, [rbp + 0xa0]
cmp rdx, 8
cmovae rdi, qword [rbp + 0xa0]
lea rcx, [rdi + rcx*2]
mov r8d, 8
lea rdx, str..xml
call fcn.14015dc80
mov word [rdi + rsi*2], bx
jmp 0x1400325da
mov qword [rsp + 0x20], 4
lea r9, str..xml
xor r8d, r8d
lea edx, [r8 + 4]
lea rcx, [rbp + 0xa0]
call fcn.1400249f0
lea rcx, [r12 + 0x60]
lea rax, [rbp + 0xa0]
cmp rcx, rax
je 0x14003260e
lea rdx, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 8
cmovae rdx, qword [rbp + 0xa0]
mov r8, qword [rbp + 0xb0]
call fcn.140017000
mov rdi, qword [rbp + 0x98]
lea rdx, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 8
cmovae rdx, qword [rbp + 0xa0]
lea rcx, [rsp + 0x48]
call fcn.140017210
nop
mov rdx, qword [rax]
test rdx, rdx
je 0x140032644
mov rdx, qword [rdx]
jmp 0x140032647
mov rdx, rbx
mov rax, qword [rdi]
lea rcx, [rbp + 0x80]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9d, SafeArrayUnlock
xor r8d, r8d
mov rcx, rdi
mov rax, qword [rax + 0x20]
call qword [case.0x14001c280.0]
mov esi, eax
mov rdi, qword [rsp + 0x48]
test rdi, rdi
je 0x1400326c0
mov eax, 0xffffffff
lock xadd dword [rdi + 0x10], eax
cmp eax, 1
jne 0x1400326c0
test rdi, rdi
je 0x1400326c0
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400326a1
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], rbx
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1400326b3
call fcn.14013f180
mov qword [rdi + 8], rbx
mov edx, SafeArrayCopy
mov rcx, rdi
call fcn.14013f180
mov rcx, qword [rbp + 0x80]
test esi, esi
js 0x140032ecd
test rcx, rcx
je 0x140032ecd
mov qword [rsp + 0x50], rcx
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14001c280.0]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
mov r15d, ebx
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400327c7
xor eax, eax
mov qword [rbp + 0x140], rax
mov qword [rbp + 0x148], rax
mov qword [rbp + 0x150], rax
lea r8, [rsp + 0x40]
mov edx, 0x800
lea rcx, [rbp + 0x140]
call fcn.140024120
nop
mov rsi, qword [rbp + 0x148]
mov rdi, qword [rbp + 0x140]
sub rsi, rdi
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
lea r9, [rbp + 0xc0]
mov r8d, esi
mov rdx, rdi
mov rax, qword [rax + 0x18]
call qword [case.0x14001c280.0]
mov ecx, dword [rbp + 0xc0]
add r15d, ecx
test eax, eax
js 0x140032783
cmp rsi, rcx
je 0x140032750
jmp 0x140032786
mov r15d, ebx
test rdi, rdi
je 0x1400327c2
mov rdx, qword [rbp + 0x150]
sub rdx, rdi
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400327ba
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032f7a
mov rcx, rdi
call fcn.14013f180
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400327d9
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14001c280.0]
mov rcx, qword [rbp + 0x80]
test r15d, r15d
je 0x140032ec2
mov rax, qword [rcx]
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rax, qword [rax + 0x28]
call qword [case.0x14001c280.0]
test eax, eax
js 0x140032eb7
xor eax, eax
mov qword [rbp + 0xe8], rax
mov qword [rbp + 0xf0], rax
mov qword [rbp + 0xf8], rax
mov edx, r15d
lea r8, [rsp + 0x41]
lea rcx, [rbp + 0xe8]
call fcn.140024120
nop
mov r13, qword [rbp + 0xf0]
mov r15, qword [rbp + 0xe8]
sub r13, r15
mov rcx, qword [rbp + 0x80]
mov rax, qword [rcx]
lea r9, [rbp + 0xc4]
mov r8d, r13d
mov rdx, r15
mov rax, qword [rax + 0x18]
call qword [case.0x14001c280.0]
test eax, eax
js 0x140032df4
mov eax, dword [rbp + 0xc4]
cmp rax, r13
jne 0x140032df4
mov r8d, r13d
mov rdx, r15
lea rcx, [rbp - 0x30]
call fcn.140030850
lea rsi, [r12 + 0x40]
mov rdx, rax
mov rcx, rsi
call fcn.14001e0a0
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x1400328db
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400328d6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032f80
call fcn.14013f180
cmp qword [r12 + 0x50], 0
je 0x140032dec
mov qword [rbp + 0x88], rbx
mov rcx, qword [rbp + 0x98]
mov qword [rsp + 0x60], rcx
test rcx, rcx
je 0x140032911
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14001c280.0]
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
mov qword [rbp + 0x88], rbx
mov edi, 1
mov dword [rsp + 0x58], edi
test rcx, rcx
je 0x1400329bb
mov qword [rbp + 0x90], rbx
lea r8, [rbp + 0x90]
xor edx, edx
call qword [sym.imp.ole32.dll_StgCreatePropSetStg]
test eax, eax
js 0x14003299d
mov rcx, qword [rbp + 0x90]
test rcx, rcx
je 0x1400329a4
mov rax, qword [rcx]
lea r9, [rbp + 0x88]
lea r8d, [rdi + 0xf]
lea rdx, [0x1401d64a8]
mov rax, qword [rax + 0x20]
call qword [case.0x14001c280.0]
test eax, eax
jns 0x14003299d
mov rcx, qword [rbp + 0x88]
test rcx, rcx
je 0x14003299d
mov qword [rbp + 0x88], rbx
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14001c280.0]
mov rcx, qword [rbp + 0x90]
test rcx, rcx
je 0x1400329b6
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14001c280.0]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400329cd
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14001c280.0]
cmp qword [rbp + 0x88], 0
je 0x140032dcb
movdqa xmm0, xmmword [0x1401da830]
movdqu xmmword [rbp + 0x188], xmm0
mov word [rbp + 0x178], bx
movdqu xmmword [rbp - 0x68], xmm0
mov word [rbp - 0x78], bx
lea r9, str.MD5Checksum
xor r8d, r8d
lea edx, [r8 + 0xb]
lea rcx, [rbp - 0x78]
call fcn.140016ea0
nop
mov rcx, qword [rbp + 0x88]
mov qword [rsp + 0x68], rcx
test rcx, rcx
je 0x140032a31
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14001c280.0]
lea r8, [rbp + 0x178]
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x68]
call fcn.140031ec0
mov r12d, eax
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x140032a89
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032a84
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032f86
call fcn.14013f180
test r12d, r12d
js 0x140032d7d
lea rcx, [rbp + 0x178]
cmp qword [rbp + 0x190], 8
cmovae rcx, qword [rbp + 0x178]
mov r8, rsi
cmp qword [rsi + 0x18], 8
jb 0x140032ab6
mov r8, qword [rsi]
mov rdx, qword [rsi + 0x10]
cmp rdx, qword [rbp + 0x188]
jne 0x140032d75
test rdx, rdx
je 0x140032ae8
sub r8, rcx
nop
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x140032d75
add rcx, 2
sub rdx, 1
jne 0x140032ad0
xor sil, sil
movdqa xmm0, xmmword [0x1401da830]
movdqu xmmword [rbp + 0x168], xmm0
mov word [rbp + 0x158], bx
movdqu xmmword [rbp - 0x48], xmm0
mov word [rbp - 0x58], bx
lea r9, str.IsCompressed
xor r8d, r8d
lea edx, [r8 + 0xc]
lea rcx, [rbp - 0x58]
call fcn.140016ea0
nop
mov rcx, qword [rbp + 0x88]
mov qword [rsp + 0x70], rcx
test rcx, rcx
je 0x140032b41
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14001c280.0]
lea r8, [rbp + 0x158]
lea rdx, [rbp - 0x58]
lea rcx, [rsp + 0x70]
call fcn.140031ec0
mov r12d, eax
mov rdx, qword [rbp - 0x40]
cmp rdx, 8
jb 0x140032b99
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032b94
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032f8c
call fcn.14013f180
test r12d, r12d
js 0x140032beb
lea rdx, [rbp + 0x158]
cmp qword [rbp + 0x170], 8
cmovae rdx, qword [rbp + 0x158]
cmp qword [rbp + 0x168], 1
jne 0x140032be8
lea rcx, [0x1401d81f8]
sub rdx, rcx
nop dword [rax]
movzx eax, word [rcx]
cmp word [rdx + rcx], ax
jne 0x140032be8
add rcx, 2
sub rdi, 1
jne 0x140032bd0
mov sil, 1
jmp 0x140032beb
xor sil, sil
mov r12, qword [rsp + 0x78]
mov byte [r12 + 0x84], sil
xor eax, eax
mov qword [rbp + 0x120], rax
mov qword [rbp + 0x128], rax
lea rax, vtable.Utils::WriteableMemoryBufferFromUnicodeFileWithObfuscationWithCompression.0
mov qword [rbp + 0x100], rax
mov rdx, rbx
mov qword [rbp + 0x108], rbx
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x110], xmm0
movdqa xmm0, xmmword [0x1401da830]
movdqa xmmword [rbp + 0x130], xmm0
mov word [rbp + 0x120], bx
test r13, r13
je 0x140032c64
mov r8, qword [rbp + 0xf0]
mov rdx, r15
lea rcx, [rbp + 0x108]
call fcn.14002f1a0
mov rdx, qword [rbp + 0x108]
mov r10, qword [rbp + 0x110]
mov r8, r10
sub r8, rdx
test rdx, rdx
je 0x140032c9c
test r8, r8
je 0x140032c9c
mov rcx, rdx
mov r9, r8
imul eax, r8d, 0x10003
inc eax
mov r8d, eax
shr eax, 0x10
xor byte [rcx], al
lea rcx, [rcx + 1]
sub r9, 1
jne 0x140032c81
test sil, sil
je 0x140032ce4
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rsi, rax
lea rcx, [rbp + 0x100]
call fcn.140031d00
movzx edi, al
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub eax, esi
mov dword [r12 + 0x80], eax
test dil, dil
jne 0x140032cd6
mov r14d, 0xffffffec
jmp 0x140032d20
mov r10, qword [rbp + 0x110]
mov rdx, qword [rbp + 0x108]
sub r10, rdx
test rdx, rdx
je 0x140032d1a
cmp r10, 4
jbe 0x140032d1a
cmp byte [rdx], 0xff
jne 0x140032d1a
cmp byte [rdx + 1], 0xfe
jne 0x140032d1a
cmp byte [rdx + 2], 0
jne 0x140032d09
cmp byte [rdx + 3], 0
je 0x140032d1a
mov r8d, r10d
add r8, rdx
mov rcx, qword [rbp - 0x80]
call fcn.14002f1a0
jmp 0x140032d20
mov r14d, 0xfffffff1
lea rcx, [rbp + 0x100]
call fcn.140031b30
nop
mov rdx, qword [rbp + 0x170]
cmp rdx, 8
jb 0x140032d83
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x158]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032d6e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032f92
call fcn.14013f180
jmp 0x140032d83
mov r14d, 0xffffffea
jmp 0x140032d83
mov r14d, 0xffffffe9
mov rdx, qword [rbp + 0x190]
cmp rdx, 8
jb 0x140032dd1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x178]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032dc4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032f98
call fcn.14013f180
jmp 0x140032dd1
mov r14d, 0xfffffff0
mov rcx, qword [rbp + 0x88]
test rcx, rcx
je 0x140032dfa
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14001c280.0]
jmp 0x140032dfa
mov r14d, 0xffffffeb
jmp 0x140032dfa
mov r14d, 0xffffffe8
test r15, r15
je 0x140032e36
mov rdx, qword [rbp + 0xf8]
sub rdx, r15
mov rax, r15
cmp rdx, 0x1000
jb 0x140032e2e
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032f9e
mov rcx, r15
call fcn.14013f180
mov rcx, qword [rbp + 0x80]
mov rdx, qword [rbp + 0xb8]
cmp rdx, 8
jb 0x140032e8a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032e7e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032fa4
call fcn.14013f180
mov rcx, qword [rbp + 0x80]
mov qword [rbp + 0xb0], rbx
mov qword [rbp + 0xb8], 7
mov word [rbp + 0xa0], bx
test rcx, rcx
je 0x140032ede
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14001c280.0]
jmp 0x140032ede
mov r14d, 0xffffffe7
jmp 0x140032e36
mov r14d, 0xffffffe6
jmp 0x140032e3d
mov r14d, 0xffffffe5
jmp 0x140032e3d
mov r14d, 0xffffffe4
mov rcx, qword [rbp + 0x98]
test rcx, rcx
je 0x140032eff
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14001c280.0]
jmp 0x140032eff
mov r14d, 0xfffffff5
mov rdx, qword [rbp + 0xe0]
cmp rdx, 8
jb 0x140032f41
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xc8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032f3c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032f6e
call fcn.14013f180
mov eax, r14d
mov rcx, qword [rbp + 0x1b8]
xor rcx, rsp
call fcn.14013f550
mov rbx, qword [rsp + 0x318]
add rsp, 0x2c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14016111c
nop
call fcn.14016111c
nop
call fcn.14016111c
nop
call fcn.14016111c
nop
call fcn.14016111c
nop
call fcn.14016111c
nop
call fcn.14016111c
nop
call fcn.14016111c
nop
call fcn.14016111c
nop
call fcn.14016111c
int3