Function at 0x14000c8f0
Capabilities:
Check for time delay via gettickcount
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov qword [rbp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x198], rbx
mov r15, r8
mov r14, rdx
mov rdi, rcx
mov qword [rbp + 0x38], r8
mov r9d, dword [0x1401c4d60]
mov ecx, r9d
imul ecx, r9d
mov eax, 0x6bca1af3
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x13
sub ecx, edx
mov r13d, 1
cmp ecx, 0xf
jne 0x14000c975
mov ecx, r13d
cmp r9d, ecx
jle 0x14000c96f
nop dword [rax]
mov eax, r9d
cdq
idiv ecx
inc ecx
add ecx, edx
cmp ecx, r9d
jl 0x14000c960
mov dword [0x1401c4d60], ecx
xor r12b, r12b
xor ebx, ebx
mov qword [rsp + 0x50], rbx
mov eax, dword [0x1401c4d60]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xf
sub ecx, edx
cmp ecx, 1
jne 0x14000c9cb
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0xcccccccd
mul ecx
shr edx, 6
lea eax, [rdx + rdx*4]
shl eax, 4
sub ecx, eax
lea eax, [rcx + 1]
mov dword [0x1401c4d60], eax
mov qword [rsp + 0x58], rbx
mov rcx, qword [rdi + 0xa0]
or rbx, 0xffffffffffffffff
test rcx, rcx
jne 0x14000c9f6
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14000c9f1
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
jmp 0x14000d259
mov rax, qword [rcx]
lea rdx, [rsp + 0x58]
call qword [rax + VariantChangeTypeEx]
mov esi, eax
mov rcx, qword [rsp + 0x58]
test rcx, rcx
jne 0x14000ca7c
lea rcx, [0x1401bc9a8]
mov rax, qword [0x1401bc9a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x58], rax
mov r8d, esi
lea rdx, str.runJSFunction_get_Document__d
lea rcx, [rbp - 0x58]
call fcn.1400119e0
mov rax, qword [rdi]
lea rdx, [rbp - 0x58]
mov rcx, rdi
call qword [rax + RegisterTypeLib]
nop
mov rdx, qword [rbp - 0x58]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14000ca66
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14000ca77
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
jmp 0x14000d259
mov rax, qword [rcx]
lea r8, [rsp + 0x50]
lea rdx, str._D_3
call qword [rax]
mov esi, eax
cmp qword [rsp + 0x50], 0
jne 0x14000cb03
lea rcx, [0x1401bc9a8]
mov rax, qword [0x1401bc9a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x78], rax
mov r8d, esi
lea rdx, str.runJSFunction_QueryInterface__d
lea rcx, [rbp - 0x78]
call fcn.1400119e0
mov rax, qword [rdi]
lea rdx, [rbp - 0x78]
mov rcx, rdi
call qword [rax + RegisterTypeLib]
nop
mov rdx, qword [rbp - 0x78]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14000caed
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14000cafe
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
jmp 0x14000d259
mov qword [rsp + 0x60], 0
mov ecx, dword [0x1401c4d60]
imul ecx, ecx
mov eax, 0x30c30c31
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 0xb
jne 0x14000cb53
mov r8d, r13d
mov eax, r13d
mov edx, 0xce
nop dword [rax + rax]
lea ecx, [rax + r8]
lea r8d, [rax]
mov eax, ecx
dec edx
jns 0x14000cb40
mov dword [0x1401c4d60], ecx
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
lea rdx, [rsp + 0x60]
call qword [rax + 0x38]
mov esi, eax
mov ecx, dword [0x1401c4d60]
lea r8d, [rcx + 2]
lea eax, [rcx + 1]
imul r8d, eax
imul r8d, ecx
mov eax, 0x38e38e39
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub r8d, eax
cmp r8d, 2
jne 0x14000cbae
lea ecx, [r8 + 2]
call fcn.1400cea88
mov rcx, rax
mov eax, dword [0x1401c4d60]
mov dword [rcx], eax
cmp qword [rsp + 0x60], 0
jne 0x14000cc33
lea rcx, [0x1401bc9a8]
mov rax, qword [0x1401bc9a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x70], rax
mov r8d, esi
lea rdx, str.runJSFunction_get_Script__d
lea rcx, [rbp - 0x70]
call fcn.1400119e0
mov rax, qword [rdi]
lea rdx, [rbp - 0x70]
mov rcx, rdi
call qword [rax + RegisterTypeLib]
nop
mov rdx, qword [rbp - 0x70]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14000cc0c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14000cc1d
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14000cc2e
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
jmp 0x14000d259
mov rcx, qword [r14]
test rcx, rcx
jne 0x14000cc45
xor r14d, r14d
mov qword [rsp + 0x68], r14
jmp 0x14000cc63
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rsp + 0x68], rax
test rax, rax
jne 0x14000cc60
mov ecx, 0x8007000e
call fcn.140001920
int3
xor r14d, r14d
mov ecx, dword [0x1401c4d60]
lea r8d, [rcx + 2]
lea eax, [rcx + 1]
imul r8d, eax
imul r8d, ecx
mov eax, 0x30c30c31
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub r8d, edx
cmp r8d, 5
jne 0x14000cd06
test ecx, ecx
je 0x14000cd06
nop word [rax + rax]
mov eax, ecx
and eax, 0x80000001
jge 0x14000ccb0
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x14000ccc5
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
mov ecx, eax
mov dword [0x1401c4d60], eax
jmp 0x14000ccd2
lea ecx, [rcx*2 + 1]
mov dword [0x1401c4d60], ecx
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
mov edx, ecx
sub edx, eax
je 0x14000ccf4
sub edx, 2
je 0x14000ccf7
dec edx
je 0x14000ccf9
jmp 0x14000cd02
add ecx, 2
inc ecx
add ecx, 2
mov dword [0x1401c4d60], ecx
test ecx, ecx
jne 0x14000cca0
mov dword [rsp + 0x70], r14d
mov r8d, ecx
imul r8d, ecx
mov eax, 0x66666667
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub r8d, eax
cmp r8d, 2
jne 0x14000cd6e
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x64
sub ecx, edx
add ecx, 0x141
movsxd rdx, ecx
mov eax, 4
mul rdx
cmovo rax, rbx
mov rcx, rax
call fcn.1400cd918
mov rcx, rax
call fcn.1400cf37c
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], 0x800
mov r9d, r13d
lea r8, [rsp + 0x68]
lea rdx, [0x140144048]
call qword [rax + 0x28]
mov esi, eax
test eax, eax
jns 0x14000cf43
lea rcx, [0x1401bc9a8]
mov rax, qword [0x1401bc9a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x80], rax
mov ecx, dword [0x1401c4d60]
imul ecx, ecx
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 2
sub ecx, eax
cmp ecx, 6
jne 0x14000cdef
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1401c4d60], eax
mov r8d, esi
lea rdx, str.runJSFunction_GetIDsOfNames__d
lea rcx, [rbp - 0x80]
call fcn.1400119e0
cmp esi, 0x80020006
jne 0x14000cee6
mov rdx, qword [rsp + 0x68]
lea rcx, [rbp - 0x20]
call fcn.140002100
mov r14, rax
lea rcx, [0x1401bc9a8]
mov rax, qword [0x1401bc9a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x78], rax
lea rdx, [0x14014da2c]
test rdx, 0xffffffffffff0000
jne 0x14000ce6a
movzx esi, dx
mov ecx, esi
call fcn.1400019e0
test rax, rax
je 0x14000ce78
mov r8d, esi
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.1400025a0
jmp 0x14000ce78
mov r8d, r13d
lea rcx, [rsp + 0x78]
call fcn.1400022b0
nop
mov r8, r14
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x18]
call fcn.14000f690
nop
mov rdx, qword [rax]
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x80]
call fcn.140010150
nop
mov rdx, qword [rbp - 0x18]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14000ceb4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14000cece
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x20]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14000cee6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
lea rdx, [rbp - 0x80]
mov rcx, rdi
call qword [rax + RegisterTypeLib]
nop
mov rdx, qword [rbp - 0x80]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14000cf10
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14000cf2d
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14000cf3e
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
jmp 0x14000d259
xor eax, eax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov r8d, dword [0x1401c4d60]
lea ecx, [r8 + 2]
lea eax, [r8 + 1]
imul ecx, eax
imul ecx, r8d
mov eax, 0x4ec4ec4f
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xd
sub ecx, edx
cmp ecx, 0xc
jne 0x14000cfc4
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x7b
movsxd rcx, r8d
mov eax, 4
mul rcx
cmovo rax, rbx
mov rcx, rax
call fcn.1400cd918
mov rcx, rax
call fcn.1400cf37c
mov r8d, dword [0x1401c4d60]
mov dword [rbp - 0x40], r13d
mov ecx, r8d
imul ecx, r8d
imul ecx, r8d
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xe
sub ecx, edx
cmp ecx, 9
jne 0x14000d09a
mov edx, r14d
nop word [rax + rax]
mov ecx, edx
and ecx, 1
dec ecx
not ecx
and ecx, r8d
mov eax, edx
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, r8d
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, r8d
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, r8d
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, r8d
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, r8d
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, r8d
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, r8d
sar ecx, 1
xor eax, ecx
add r8d, eax
inc edx
cmp edx, 0x100
jl 0x14000d000
mov dword [0x1401c4d60], r8d
mov eax, 0x18
mul r13
cmovo rax, rbx
mov rcx, rax
call fcn.1400cd918
mov qword [rbp - 0x50], rax
mov dword [rbp - 0x3c], r14d
mov rcx, qword [r15]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rcx, rax
mov rax, qword [rbp - 0x50]
mov qword [rax + 8], rcx
mov ecx, 8
mov rax, qword [rbp - 0x50]
mov word [rax], cx
xor eax, eax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
mov qword [rbp], rax
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rax
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x28], rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
lea rcx, [rbp - 0x38]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
call fcn.14000aac0
test al, al
jne 0x14000d12f
call fcn.1400cebc4
mov ecx, dword [0x1401c4d60]
cmp ecx, eax
jne 0x14000d12f
dec ecx
mov dword [0x1401c4d60], ecx
mov dword [rbp - 0x60], 0xffffffff
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
lea rdx, [rbp - 0x60]
mov qword [rsp + 0x40], rdx
lea rdx, [rbp - 0x10]
mov qword [rsp + 0x38], rdx
lea rdx, [rbp - 0x38]
mov qword [rsp + 0x30], rdx
lea rdx, [rbp - 0x50]
mov qword [rsp + 0x28], rdx
mov word [rsp + 0x20], r13w
xor r9d, r9d
lea r8, [0x140144048]
mov edx, dword [rsp + 0x70]
call qword [rax + 0x30]
mov esi, eax
mov rcx, qword [rbp - 0x50]
call fcn.1400cf37c
test esi, esi
jns 0x14000d21d
lea rcx, [0x1401bc9a8]
mov rax, qword [0x1401bc9a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x68], rax
mov r8d, esi
lea rdx, str.runJSFunction_Invoke__d
lea rcx, [rbp - 0x68]
call fcn.1400119e0
mov rax, qword [rdi]
lea rdx, [rbp - 0x68]
mov rcx, rdi
call qword [rax + RegisterTypeLib]
nop
mov rdx, qword [rbp - 0x68]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14000d1e2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rbp - 0x38]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14000d20a
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14000d21b
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
jmp 0x14000d259
mov r12b, 1
lea rcx, [rbp - 0x38]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14000d248
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14000d259
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14000d26a
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rdx, qword [r15]
sub rdx, 0x18
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14000d282
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
movzx eax, r12b
mov rbx, qword [rsp + 0x198]
add rsp, 0x140
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret