Function at 0x140031050
Capabilities:
Encode data using xor
Get file attributes

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x318], rbx
mov rax, qword [0x140228058]
xor rax, rsp
mov qword [rbp + 0x1b8], rax
mov r12, r8
mov qword [rsp + 0x78], r8
mov qword [rbp - 0x80], rdx
xor ebx, ebx
mov dword [rsp + 0x58], ebx
mov r14d, ebx
mov rdx, rcx
lea rcx, [rbp + 0xc8]
call fcn.14002e350
nop
movdqa xmm0, xmmword [0x1401d8170]
movdqa xmmword [rbp], xmm0
mov word [rbp - 0x10], bx
movdqa xmmword [rbp + 0x20], xmm0
mov word [rbp + 0x10], bx
movdqa xmmword [rbp + 0x40], xmm0
mov word [rbp + 0x30], bx
movdqa xmmword [rbp + 0x60], xmm0
mov word [rbp + 0x50], bx
mov dword [rbp + 0x70], ebx
mov byte [rbp + 0x74], bl
lea rdx, [rbp - 0x10]
mov rcx, r12
call fcn.140030f30
lea rcx, [rbp - 0x10]
call fcn.140030dd0
lea rax, [rbp + 0xc8]
cmp r12, rax
je 0x14003112a
lea rdx, [rbp + 0xc8]
cmp qword [rbp + 0xe0], 8
cmovae rdx, qword [rbp + 0xc8]
mov r8, qword [rbp + 0xd8]
mov rcx, r12
call fcn.1400159c0
cmp qword [rbp + 0xd8], 0
je 0x140031bd9
lea rdx, [rbp + 0xc8]
lea rcx, [rbp + 0x198]
call fcn.14002e350
lea rcx, [rbp + 0x198]
cmp qword [rbp + 0x1b0], 8
cmovae rcx, qword [rbp + 0x198]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
mov rdx, qword [rbp + 0x1b0]
cmp rdx, 8
jb 0x1400311b0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x198]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400311ab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031c54
call fcn.14013db80
cmp edi, 0xffffffff
je 0x140031bd9
mov qword [rbp + 0x98], rbx
lea rcx, [rbp + 0xc8]
cmp qword [rbp + 0xe0], 8
cmovae rcx, qword [rbp + 0xc8]
lea rax, [rbp + 0x98]
mov qword [rsp + 0x38], rax
lea rax, [0x1401d4108]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
call qword [sym.imp.ole32.dll_StgOpenStorageEx]
test eax, eax
js 0x140031bb8
cmp qword [rbp + 0x98], 0
je 0x140031bb8
mov qword [rbp + 0x80], rbx
lea rdx, [rbp + 0xc8]
lea rcx, [rbp + 0xa0]
call fcn.14002ef70
nop
mov rcx, qword [rbp + 0xb0]
test rcx, rcx
je 0x140031b16
mov rdx, qword [rbp + 0xb8]
mov rax, rdx
sub rax, rcx
cmp rax, 4
jb 0x140031297
lea rsi, [rcx + 4]
mov qword [rbp + 0xb0], rsi
lea rdi, [rbp + 0xa0]
cmp rdx, 8
cmovae rdi, qword [rbp + 0xa0]
lea rcx, [rdi + rcx*2]
mov r8d, 8
lea rdx, str..xml
call fcn.14015c680
mov word [rdi + rsi*2], bx
jmp 0x1400312ba
mov qword [rsp + 0x20], 4
lea r9, str..xml
xor r8d, r8d
lea edx, [r8 + 4]
lea rcx, [rbp + 0xa0]
call fcn.1400233b0
lea rcx, [r12 + 0x60]
lea rax, [rbp + 0xa0]
cmp rcx, rax
je 0x1400312ee
lea rdx, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 8
cmovae rdx, qword [rbp + 0xa0]
mov r8, qword [rbp + 0xb0]
call fcn.1400159c0
mov rdi, qword [rbp + 0x98]
lea rdx, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 8
cmovae rdx, qword [rbp + 0xa0]
lea rcx, [rsp + 0x48]
call fcn.140015bd0
nop
mov rdx, qword [rax]
test rdx, rdx
je 0x140031324
mov rdx, qword [rdx]
jmp 0x140031327
mov rdx, rbx
mov rax, qword [rdi]
lea rcx, [rbp + 0x80]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9d, SafeArrayUnlock
xor r8d, r8d
mov rcx, rdi
mov rax, qword [rax + 0x20]
call qword [case.0x14001ac40.0]
mov esi, eax
mov rdi, qword [rsp + 0x48]
test rdi, rdi
je 0x1400313a0
mov eax, 0xffffffff
lock xadd dword [rdi + 0x10], eax
cmp eax, 1
jne 0x1400313a0
test rdi, rdi
je 0x1400313a0
mov rcx, qword [rdi]
test rcx, rcx
je 0x140031381
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], rbx
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140031393
call fcn.14013db80
mov qword [rdi + 8], rbx
mov edx, SafeArrayCopy
mov rcx, rdi
call fcn.14013db80
mov rcx, qword [rbp + 0x80]
test esi, esi
js 0x140031bad
test rcx, rcx
je 0x140031bad
mov qword [rsp + 0x50], rcx
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14001ac40.0]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
mov r15d, ebx
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400314a7
xor eax, eax
mov qword [rbp + 0x140], rax
mov qword [rbp + 0x148], rax
mov qword [rbp + 0x150], rax
lea r8, [rsp + 0x40]
mov edx, 0x800
lea rcx, [rbp + 0x140]
call fcn.140022ae0
nop
mov rsi, qword [rbp + 0x148]
mov rdi, qword [rbp + 0x140]
sub rsi, rdi
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
lea r9, [rbp + 0xc0]
mov r8d, esi
mov rdx, rdi
mov rax, qword [rax + 0x18]
call qword [case.0x14001ac40.0]
mov ecx, dword [rbp + 0xc0]
add r15d, ecx
test eax, eax
js 0x140031463
cmp rsi, rcx
je 0x140031430
jmp 0x140031466
mov r15d, ebx
test rdi, rdi
je 0x1400314a2
mov rdx, qword [rbp + 0x150]
sub rdx, rdi
mov rax, rdi
cmp rdx, 0x1000
jb 0x14003149a
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031c5a
mov rcx, rdi
call fcn.14013db80
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400314b9
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14001ac40.0]
mov rcx, qword [rbp + 0x80]
test r15d, r15d
je 0x140031ba2
mov rax, qword [rcx]
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rax, qword [rax + 0x28]
call qword [case.0x14001ac40.0]
test eax, eax
js 0x140031b97
xor eax, eax
mov qword [rbp + 0xe8], rax
mov qword [rbp + 0xf0], rax
mov qword [rbp + 0xf8], rax
mov edx, r15d
lea r8, [rsp + 0x41]
lea rcx, [rbp + 0xe8]
call fcn.140022ae0
nop
mov r13, qword [rbp + 0xf0]
mov r15, qword [rbp + 0xe8]
sub r13, r15
mov rcx, qword [rbp + 0x80]
mov rax, qword [rcx]
lea r9, [rbp + 0xc4]
mov r8d, r13d
mov rdx, r15
mov rax, qword [rax + 0x18]
call qword [case.0x14001ac40.0]
test eax, eax
js 0x140031ad4
mov eax, dword [rbp + 0xc4]
cmp rax, r13
jne 0x140031ad4
mov r8d, r13d
mov rdx, r15
lea rcx, [rbp - 0x30]
call fcn.14002f510
lea rsi, [r12 + 0x40]
mov rdx, rax
mov rcx, rsi
call fcn.14001ca60
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x1400315bb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400315b6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031c60
call fcn.14013db80
cmp qword [r12 + 0x50], 0
je 0x140031acc
mov qword [rbp + 0x88], rbx
mov rcx, qword [rbp + 0x98]
mov qword [rsp + 0x60], rcx
test rcx, rcx
je 0x1400315f1
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14001ac40.0]
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
mov qword [rbp + 0x88], rbx
mov edi, 1
mov dword [rsp + 0x58], edi
test rcx, rcx
je 0x14003169b
mov qword [rbp + 0x90], rbx
lea r8, [rbp + 0x90]
xor edx, edx
call qword [sym.imp.ole32.dll_StgCreatePropSetStg]
test eax, eax
js 0x14003167d
mov rcx, qword [rbp + 0x90]
test rcx, rcx
je 0x140031684
mov rax, qword [rcx]
lea r9, [rbp + 0x88]
lea r8d, [rdi + 0xf]
lea rdx, [0x1401d40f8]
mov rax, qword [rax + 0x20]
call qword [case.0x14001ac40.0]
test eax, eax
jns 0x14003167d
mov rcx, qword [rbp + 0x88]
test rcx, rcx
je 0x14003167d
mov qword [rbp + 0x88], rbx
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14001ac40.0]
mov rcx, qword [rbp + 0x90]
test rcx, rcx
je 0x140031696
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14001ac40.0]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400316ad
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14001ac40.0]
cmp qword [rbp + 0x88], 0
je 0x140031aab
movdqa xmm0, xmmword [0x1401d8170]
movdqu xmmword [rbp + 0x188], xmm0
mov word [rbp + 0x178], bx
movdqu xmmword [rbp - 0x68], xmm0
mov word [rbp - 0x78], bx
lea r9, str.MD5Checksum
xor r8d, r8d
lea edx, [r8 + 0xb]
lea rcx, [rbp - 0x78]
call fcn.140015860
nop
mov rcx, qword [rbp + 0x88]
mov qword [rsp + 0x68], rcx
test rcx, rcx
je 0x140031711
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14001ac40.0]
lea r8, [rbp + 0x178]
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x68]
call fcn.140030ba0
mov r12d, eax
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x140031769
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031764
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031c66
call fcn.14013db80
test r12d, r12d
js 0x140031a5d
lea rcx, [rbp + 0x178]
cmp qword [rbp + 0x190], 8
cmovae rcx, qword [rbp + 0x178]
mov r8, rsi
cmp qword [rsi + 0x18], 8
jb 0x140031796
mov r8, qword [rsi]
mov rdx, qword [rsi + 0x10]
cmp rdx, qword [rbp + 0x188]
jne 0x140031a55
test rdx, rdx
je 0x1400317c8
sub r8, rcx
nop
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x140031a55
add rcx, 2
sub rdx, 1
jne 0x1400317b0
xor sil, sil
movdqa xmm0, xmmword [0x1401d8170]
movdqu xmmword [rbp + 0x168], xmm0
mov word [rbp + 0x158], bx
movdqu xmmword [rbp - 0x48], xmm0
mov word [rbp - 0x58], bx
lea r9, str.IsCompressed
xor r8d, r8d
lea edx, [r8 + 0xc]
lea rcx, [rbp - 0x58]
call fcn.140015860
nop
mov rcx, qword [rbp + 0x88]
mov qword [rsp + 0x70], rcx
test rcx, rcx
je 0x140031821
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14001ac40.0]
lea r8, [rbp + 0x158]
lea rdx, [rbp - 0x58]
lea rcx, [rsp + 0x70]
call fcn.140030ba0
mov r12d, eax
mov rdx, qword [rbp - 0x40]
cmp rdx, 8
jb 0x140031879
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031874
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031c6c
call fcn.14013db80
test r12d, r12d
js 0x1400318cb
lea rdx, [rbp + 0x158]
cmp qword [rbp + 0x170], 8
cmovae rdx, qword [rbp + 0x158]
cmp qword [rbp + 0x168], 1
jne 0x1400318c8
lea rcx, [0x1401d5b48]
sub rdx, rcx
nop dword [rax]
movzx eax, word [rcx]
cmp word [rdx + rcx], ax
jne 0x1400318c8
add rcx, 2
sub rdi, 1
jne 0x1400318b0
mov sil, 1
jmp 0x1400318cb
xor sil, sil
mov r12, qword [rsp + 0x78]
mov byte [r12 + 0x84], sil
xor eax, eax
mov qword [rbp + 0x120], rax
mov qword [rbp + 0x128], rax
lea rax, vtable.Utils::WriteableMemoryBufferFromUnicodeFileWithObfuscationWithCompression.0
mov qword [rbp + 0x100], rax
mov rdx, rbx
mov qword [rbp + 0x108], rbx
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x110], xmm0
movdqa xmm0, xmmword [0x1401d8170]
movdqa xmmword [rbp + 0x130], xmm0
mov word [rbp + 0x120], bx
test r13, r13
je 0x140031944
mov r8, qword [rbp + 0xf0]
mov rdx, r15
lea rcx, [rbp + 0x108]
call fcn.14002db60
mov rdx, qword [rbp + 0x108]
mov r10, qword [rbp + 0x110]
mov r8, r10
sub r8, rdx
test rdx, rdx
je 0x14003197c
test r8, r8
je 0x14003197c
mov rcx, rdx
mov r9, r8
imul eax, r8d, 0x10003
inc eax
mov r8d, eax
shr eax, 0x10
xor byte [rcx], al
lea rcx, [rcx + 1]
sub r9, 1
jne 0x140031961
test sil, sil
je 0x1400319c4
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rsi, rax
lea rcx, [rbp + 0x100]
call fcn.1400309e0
movzx edi, al
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub eax, esi
mov dword [r12 + 0x80], eax
test dil, dil
jne 0x1400319b6
mov r14d, 0xffffffec
jmp 0x140031a00
mov r10, qword [rbp + 0x110]
mov rdx, qword [rbp + 0x108]
sub r10, rdx
test rdx, rdx
je 0x1400319fa
cmp r10, 4
jbe 0x1400319fa
cmp byte [rdx], 0xff
jne 0x1400319fa
cmp byte [rdx + 1], 0xfe
jne 0x1400319fa
cmp byte [rdx + 2], 0
jne 0x1400319e9
cmp byte [rdx + 3], 0
je 0x1400319fa
mov r8d, r10d
add r8, rdx
mov rcx, qword [rbp - 0x80]
call fcn.14002db60
jmp 0x140031a00
mov r14d, 0xfffffff1
lea rcx, [rbp + 0x100]
call fcn.140030810
nop
mov rdx, qword [rbp + 0x170]
cmp rdx, 8
jb 0x140031a63
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x158]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031a4e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031c72
call fcn.14013db80
jmp 0x140031a63
mov r14d, 0xffffffea
jmp 0x140031a63
mov r14d, 0xffffffe9
mov rdx, qword [rbp + 0x190]
cmp rdx, 8
jb 0x140031ab1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x178]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031aa4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031c78
call fcn.14013db80
jmp 0x140031ab1
mov r14d, 0xfffffff0
mov rcx, qword [rbp + 0x88]
test rcx, rcx
je 0x140031ada
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14001ac40.0]
jmp 0x140031ada
mov r14d, 0xffffffeb
jmp 0x140031ada
mov r14d, 0xffffffe8
test r15, r15
je 0x140031b16
mov rdx, qword [rbp + 0xf8]
sub rdx, r15
mov rax, r15
cmp rdx, 0x1000
jb 0x140031b0e
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031c7e
mov rcx, r15
call fcn.14013db80
mov rcx, qword [rbp + 0x80]
mov rdx, qword [rbp + 0xb8]
cmp rdx, 8
jb 0x140031b6a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031b5e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031c84
call fcn.14013db80
mov rcx, qword [rbp + 0x80]
mov qword [rbp + 0xb0], rbx
mov qword [rbp + 0xb8], 7
mov word [rbp + 0xa0], bx
test rcx, rcx
je 0x140031bbe
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14001ac40.0]
jmp 0x140031bbe
mov r14d, 0xffffffe7
jmp 0x140031b16
mov r14d, 0xffffffe6
jmp 0x140031b1d
mov r14d, 0xffffffe5
jmp 0x140031b1d
mov r14d, 0xffffffe4
mov rcx, qword [rbp + 0x98]
test rcx, rcx
je 0x140031bdf
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14001ac40.0]
jmp 0x140031bdf
mov r14d, 0xfffffff5
mov rdx, qword [rbp + 0xe0]
cmp rdx, 8
jb 0x140031c21
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xc8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031c1c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031c4e
call fcn.14013db80
mov eax, r14d
mov rcx, qword [rbp + 0x1b8]
xor rcx, rsp
call fcn.14013df50
mov rbx, qword [rsp + 0x318]
add rsp, 0x2c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14015fb1c
nop
call fcn.14015fb1c
nop
call fcn.14015fb1c
nop
call fcn.14015fb1c
nop
call fcn.14015fb1c
nop
call fcn.14015fb1c
nop
call fcn.14015fb1c
nop
call fcn.14015fb1c
nop
call fcn.14015fb1c
nop
call fcn.14015fb1c
int3