Function at 0x140001130
Capabilities:
Encode data using xor
Load windows common language runtime

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xa0
mov rbx, rcx
mov rdi, qword [rcx + 8]
mov r9d, 4
mov r8d, 0x3000
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
mov r8, rdi
mov rdx, qword [rbx]
mov rcx, rax
call fcn.140011720
xor r15d, r15d
mov edx, r15d
test rdi, rdi
je 0x14000120d
cmp rdi, 0x40
jb 0x1400011ec
mov rcx, rdi
and rcx, 0xffffffffffffffc0
movdqa xmm2, xmmword [0x140013420]
lea rax, [rsi + 0x20]
nop
movdqu xmm0, xmmword [rax - 0x20]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rax - 0x20], xmm1
movdqu xmm0, xmmword [rax - 0x10]
xorps xmm0, xmm2
movdqu xmmword [rax - 0x10], xmm0
movdqu xmm1, xmmword [rax]
xorps xmm1, xmm2
movdqu xmmword [rax], xmm1
movdqu xmm0, xmmword [rax + 0x10]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rax + 0x10], xmm1
add rdx, 0x40
lea rax, [rax + 0x40]
cmp rdx, rcx
jb 0x1400011a0
cmp rdx, rdi
jae 0x14000120d
lea rax, [rdx + rsi]
mov rcx, rdi
sub rcx, rdx
nop word [rax + rax]
xor byte [rax], 0xa5
lea rax, [rax + 1]
sub rcx, 1
jne 0x140001200
mov edx, 2
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov qword [rbp - 0x41], r15
lea r8, [rbp - 0x41]
lea rdx, [0x140013390]
lea rcx, [0x1400133a0]
call sub.mscoree.dll_CLRCreateInstance
mov qword [rbp - 0x51], r15
mov rcx, qword [rbp - 0x41]
mov rax, qword [rcx]
lea r9, [rbp - 0x51]
lea r8, [0x1400133b0]
lea rdx, str.v4.0.30319
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov rcx, qword [rbp - 0x51]
mov rax, qword [rcx]
lea rdx, [rbp + 0x67]
call qword [rax + 0x50]
mov qword [rbp - 0x49], r15
mov rcx, qword [rbp - 0x51]
mov rax, qword [rcx]
lea r9, [rbp - 0x49]
lea r8, [0x1400133d0]
lea rdx, [0x1400133c0]
call qword [rax + 0x48]
mov rcx, qword [rbp - 0x49]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov qword [rbp - 0x59], r15
mov rcx, qword [rbp - 0x49]
mov rax, qword [rcx]
mov qword [rbp - 0x59], r15
lea rdx, [rbp - 0x59]
call qword [rax + 0x68]
mov qword [rbp + 0x7f], r15
mov rcx, qword [rbp - 0x59]
test rcx, rcx
je 0x140001450
mov rax, qword [rcx]
mov qword [rbp + 0x7f], r15
lea r8, [rbp + 0x7f]
lea rdx, [0x140013408]
call qword [rax]
mov qword [rbp + 0x6f], r15
mov dword [rbp - 0x39], edi
mov dword [rbp - 0x35], r15d
mov ecx, 0x11
lea r8, [rbp - 0x39]
mov r12d, 1
mov edx, r12d
call qword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
mov r14, rax
mov qword [rbp - 0x31], r15
lea rdx, [rbp - 0x31]
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_SafeArrayUnaccessData]
mov r8, rdi
mov rdx, rsi
mov rcx, qword [rbp - 0x31]
call fcn.140011720
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SafeArrayGetElement]
mov rbx, qword [rbp + 0x7f]
test rbx, rbx
je 0x140001445
mov rax, qword [rbx]
mov rdi, qword [rax + 0x168]
mov rcx, qword [rbp + 0x6f]
test rcx, rcx
je 0x14000133e
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov qword [rbp + 0x6f], r15
lea r8, [rbp + 0x6f]
mov rdx, r14
mov rcx, rbx
call rdi
mov qword [rbp + 0x77], r15
mov rcx, qword [rbp + 0x6f]
test rcx, rcx
je 0x14000145b
mov rax, qword [rcx]
mov qword [rbp + 0x77], r15
lea rdx, [rbp + 0x77]
call qword [rax + pe_nt_image_headers64]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x11], xmm0
mov qword [rbp - 1], rax
xorps xmm1, xmm1
movups xmmword [rbp - 0x29], xmm1
mov qword [rbp - 0x19], rax
mov word [rbp - 0x29], r12w
mov ecx, SafeArrayDestroy
mov r8d, r12d
xor edx, edx
call qword [sym.imp.OLEAUT32.dll_SafeArrayCopyData]
mov rbx, rax
lea rcx, [0x1400133f8]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov r8, rax
xor edx, edx
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SafeArrayCopy]
mov rcx, qword [rbp + 0x77]
test rcx, rcx
je 0x14000145b
mov rdx, qword [rcx]
mov r10, qword [rdx + 0x128]
movups xmm0, xmmword [rbp - 0x29]
movaps xmmword [rbp + 7], xmm0
movsd xmm1, qword [rbp - 0x19]
movsd qword [rbp + 0x17], xmm1
lea r9, [rbp - 0x11]
mov r8, rbx
lea rdx, [rbp + 7]
call r10
nop
mov rcx, qword [rbp + 0x77]
test rcx, rcx
je 0x140001403
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rbp + 0x6f]
test rcx, rcx
je 0x140001413
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rbp + 0x7f]
test rcx, rcx
je 0x140001423
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rbp - 0x59]
test rcx, rcx
je 0x140001433
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
add rsp, 0xa0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80004003
call fcn.1400015f0
nop
mov ecx, 0x80004003
call fcn.1400015f0
nop
mov ecx, 0x80004003
call fcn.1400015f0
int3