Function at 0x14003c4cc
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x818]
sub rsp, 0x8f0
mov qword [rbp - 0x68], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x140197e90]
xor rax, rsp
mov qword [rbp + 0x7e0], rax
mov rsi, rcx
mov qword [rbp - 0x60], rcx
xor r12d, r12d
mov dword [rsp + 0x48], r12d
mov qword [rsp + 0x58], r12
mov dword [rsp + 0x60], r12d
mov qword [rsp + 0x68], r12
lea r13d, [r12 + 1]
mov r9d, r13d
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Pathsiexplore.exe
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x58]
call fcn.140018038
test eax, eax
je 0x14003c970
mov r9d, r13d
lea r8, str.IE.AssocFile.HTM_shellopencommand
mov rdx, 0xffffffff80000000
lea rcx, [rsp + 0x58]
call fcn.140018038
test eax, eax
je 0x14003c970
mov r8d, dword [0x14019fd80]
lea ecx, [r8 + 2]
lea eax, [r8 + 1]
imul ecx, eax
imul ecx, r8d
mov ebx, 0x38e38e39
mov eax, ebx
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, r13d
jne 0x14003c5f2
movsd xmm3, qword [0x140134f70]
xorps xmm2, xmm2
movd xmm4, r8d
cvtdq2pd xmm4, xmm4
addsd xmm2, xmm3
movaps xmm0, xmm2
mulsd xmm0, xmm2
comisd xmm0, xmm4
jbe 0x14003c5da
subsd xmm2, xmm3
divsd xmm3, qword [0x140134f98]
movaps xmm1, xmm2
mulsd xmm1, xmm2
movaps xmm0, xmm4
subsd xmm0, xmm1
comisd xmm0, xmmword [0x140134f68]
ja 0x14003c5bd
lea rcx, [rsp + 0x40]
call fcn.1400221c0
nop
mov rcx, qword [rsp + 0x40]
or rdi, 0xffffffffffffffff
cmp dword [rcx - 0x10], r12d
je 0x14003c7e1
mov r9d, dword [0x14019fd80]
mov r8d, r9d
imul r8d, r9d
imul r8d, r9d
mov eax, ebx
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
sub r8d, eax
cmp r8d, 5
jne 0x14003c6ab
mov r14d, r12d
lea r15, [rbp - 0x58]
mov r10d, r12d
lea ebx, [r10 + 1]
lea ecx, [r14 + 1]
mov eax, r9d
cdq
idiv ecx
mov r8d, edx
mov ecx, r9d
sub ecx, r14d
imul r8d, ecx
mov eax, r9d
cdq
idiv ebx
add r8d, eax
sub r8d, r10d
mov dword [r15], r8d
mov edx, r8d
lea rcx, [0x140130a90]
call fcn.1400b991c
mov r10d, ebx
add r15, 4
cmp ebx, 4
jge 0x14003c694
mov r9d, dword [0x14019fd80]
jmp 0x14003c646
add r14d, r13d
cmp r14d, 3
jge 0x14003c6a6
mov r9d, dword [0x14019fd80]
jmp 0x14003c643
mov rcx, qword [rsp + 0x40]
mov edx, dword [rcx - 0x10]
lea eax, [rdx - 1]
test eax, eax
js 0x14003c7d6
cmp eax, edx
jg 0x14003c7d6
cdqe
cmp word [rcx + rax*2], 0x5c
je 0x14003c6de
mov r8d, r13d
lea rdx, [0x140130a20]
lea rcx, [rsp + 0x40]
call fcn.14000df38
lea r8, [0x1401332e8]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x70]
call fcn.140017478
nop
lea rcx, [rsp + 0x70]
call fcn.140022490
test al, al
je 0x14003c7b5
mov ecx, dword [0x14019fd80]
imul ecx, ecx
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
add eax, eax
sub ecx, eax
cmp ecx, 8
jne 0x14003c756
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
lea rdx, [rsp + 0x70]
mov rcx, rsi
call fcn.14000291c
mov dword [rsp + 0x48], r13d
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
or rdi, 0xffffffffffffffff
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x14003c78c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x14003caeb
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
jmp 0x14003caeb
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x14003c7e1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14003c7e1
mov ecx, 0x80070057
call fcn.140001874
int3
lea rcx, [rbp - 0x78]
call fcn.14002237c
nop
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140001d7c
nop
mov rdx, qword [rbp - 0x78]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x14003c817
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rsp + 0x40]
cmp dword [rax - 0x10], r12d
je 0x14003c95a
mov r8d, dword [0x14019fd80]
lea edx, [r8 + 2]
lea ecx, [r8 + 1]
imul edx, ecx
imul edx, r8d
and edx, 0x8000000f
jge 0x14003c84d
sub edx, r13d
or edx, 0xfffffff0
add edx, r13d
cmp edx, 0xd
jne 0x14003c892
mov r10d, r12d
mov r9d, r10d
mov r11d, 8
mov edx, r9d
and edx, r13d
sub edx, r13d
not edx
and edx, r8d
mov ecx, r9d
sar ecx, 1
mov r9d, edx
xor r9d, ecx
sub r11, r13
jne 0x14003c85e
add r8d, r9d
add r10d, r13d
cmp r10d, 0x100
jl 0x14003c855
mov dword [0x14019fd80], r8d
mov r9d, dword [rax - 0x10]
lea ecx, [r9 - 1]
test ecx, ecx
js 0x14003c94f
cmp ecx, r9d
jg 0x14003c94f
movsxd rcx, ecx
cmp word [rax + rcx*2], 0x5c
je 0x14003c8c9
mov r8d, r13d
lea rdx, [0x140130a20]
lea rcx, [rsp + 0x40]
call fcn.14000df38
lea r8, [0x1401332e8]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x78]
call fcn.140017478
nop
lea rcx, [rsp + 0x78]
call fcn.140022490
test al, al
je 0x14003c92e
lea rdx, [rsp + 0x78]
mov rcx, rsi
call fcn.14000291c
mov dword [rsp + 0x48], r13d
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x14003c920
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
jmp 0x14003cad4
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x14003c95a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14003c95a
mov ecx, 0x80070057
call fcn.140001874
int3
lea rdx, [0x14012e2f8]
mov rcx, rsi
call fcn.140001cb0
mov dword [rsp + 0x48], r13d
jmp 0x14003c920
mov word [rbp - 0x20], r12w
xor edx, edx
mov r8d, 0x7fe
lea rcx, [rbp - 0x1e]
call fcn.1400be450
mov eax, dword [0x14019fd80]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x6bca1af3
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x13
sub ecx, edx
cmp ecx, 0x10
jne 0x14003c9b8
call fcn.1400b99c8
mov dword [0x14019fd80], eax
mov dword [rbp - 0x80], 0x400
lea rcx, [0x1401979a8]
mov rax, qword [0x1401979a8]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x50], rbx
lea r9, [rbp - 0x80]
lea r8, [rbp - 0x20]
lea rdx, [0x14012e2f8]
lea rcx, [rsp + 0x58]
call fcn.140018118
or rdi, 0xffffffffffffffff
test eax, eax
jne 0x14003ca21
lea rcx, [rbp - 0x20]
mov rax, rdi
inc rax
cmp word [rcx + rax*2], r12w
jne 0x14003ca01
mov r8d, eax
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x50]
call fcn.140001e74
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14003ca36
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x58], r12
mov dword [rsp + 0x60], r12d
cmp dword [rbx - 0x10], r12d
jge 0x14003ca4c
mov ecx, 0x80070057
call fcn.140001874
int3
cmp word [rbx], 0x22
jne 0x14003cabe
cmp dword [rbx - 0x10], r13d
jl 0x14003ca6d
lea rcx, [rbx + 2]
lea rdx, [0x1401332e4]
call fcn.1400b9dcc
test rax, rax
jne 0x14003ca71
mov eax, edi
jmp 0x14003ca77
sub rax, rbx
sar rax, 1
lea r9d, [rax - 1]
mov r8d, r13d
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x50]
call fcn.14000d430
nop
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140001d7c
nop
mov rdx, qword [rbp - 0x70]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x14003cab9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x50]
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.14000291c
mov dword [rsp + 0x48], r13d
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x14003caeb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14003cb00
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x58], r12
mov rax, rsi
mov dword [rsp + 0x60], r12d
mov rcx, qword [rbp + 0x7e0]
xor rcx, rsp
call fcn.1400b9010
lea r11, [rsp + 0x8f0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret