Function at 0x140030e80
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x2f8], rbx
mov rax, qword [0x140200d38]
xor rax, rsp
mov qword [rbp + 0x198], rax
mov r12, r8
mov qword [rsp + 0x78], r8
mov qword [rbp - 0x80], rdx
xor ebx, ebx
mov dword [rsp + 0x58], ebx
mov r15d, ebx
mov rdx, rcx
lea rcx, [rbp + 0xc8]
call fcn.14002f1e0
nop
movdqa xmm0, xmmword [0x1401b5c90]
movdqa xmmword [rbp], xmm0
mov word [rbp - 0x10], bx
movdqa xmmword [rbp + 0x20], xmm0
mov word [rbp + 0x10], bx
movdqa xmmword [rbp + 0x40], xmm0
mov word [rbp + 0x30], bx
movdqa xmmword [rbp + 0x60], xmm0
mov word [rbp + 0x50], bx
mov dword [rbp + 0x70], ebx
mov byte [rbp + 0x74], bl
lea rdx, [rbp - 0x10]
mov rcx, r12
call fcn.140030d60
lea rcx, [rbp - 0x10]
call fcn.140030c00
lea rax, [rbp + 0xc8]
cmp r12, rax
je 0x140030f5a
lea rdx, [rbp + 0xc8]
cmp qword [rbp + 0xe0], 8
cmovae rdx, qword [rbp + 0xc8]
mov r8, qword [rbp + 0xd8]
mov rcx, r12
call fcn.1400150c0
lea rcx, [rbp + 0xc8]
call fcn.14002ff10
test al, al
je 0x14003191e
mov qword [rbp + 0x98], rbx
lea rcx, [rbp + 0xc8]
cmp qword [rbp + 0xe0], 8
cmovae rcx, qword [rbp + 0xc8]
lea rax, [rbp + 0x98]
mov qword [rsp + 0x38], rax
lea rax, [0x1401b1b88]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
call qword [sym.imp.ole32.dll_StgOpenStorageEx]
test eax, eax
js 0x140031904
cmp qword [rbp + 0x98], 0
je 0x140031904
mov qword [rbp + 0x80], rbx
lea rdx, [rbp + 0xc8]
lea rcx, [rbp + 0xa0]
call fcn.14002fd80
nop
mov rcx, qword [rbp + 0xb0]
test rcx, rcx
je 0x140031869
mov rdx, qword [rbp + 0xb8]
mov rax, rdx
sub rax, rcx
cmp rax, 4
jb 0x14003104c
lea rsi, [rcx + 4]
mov qword [rbp + 0xb0], rsi
lea rdi, [rbp + 0xa0]
cmp rdx, 8
cmovae rdi, qword [rbp + 0xa0]
lea rcx, [rdi + rcx*2]
mov r8d, 8
lea rdx, str..xml
call fcn.14013fdb0
mov word [rdi + rsi*2], bx
jmp 0x14003106f
mov qword [rsp + 0x20], 4
lea r9, str..xml
xor r8d, r8d
lea edx, [r8 + 4]
lea rcx, [rbp + 0xa0]
call fcn.140022280
lea rcx, [r12 + 0x60]
lea rax, [rbp + 0xa0]
cmp rcx, rax
je 0x1400310a3
lea rdx, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 8
cmovae rdx, qword [rbp + 0xa0]
mov r8, qword [rbp + 0xb0]
call fcn.1400150c0
mov rdi, qword [rbp + 0x98]
lea rdx, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 8
cmovae rdx, qword [rbp + 0xa0]
lea rcx, [rsp + 0x48]
call fcn.1400152d0
nop
mov rdx, qword [rax]
test rdx, rdx
je 0x1400310d9
mov rdx, qword [rdx]
jmp 0x1400310dc
mov rdx, rbx
mov rax, qword [rdi]
lea rcx, [rbp + 0x80]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9d, SafeArrayUnlock
xor r8d, r8d
mov rcx, rdi
call qword [rax + 0x20]
mov esi, eax
mov rdi, qword [rsp + 0x48]
test rdi, rdi
je 0x14003114e
mov ecx, 0xffffffff
lock xadd dword [rdi + 0x10], ecx
cmp ecx, 1
jne 0x14003114e
test rdi, rdi
je 0x14003114e
mov rcx, qword [rdi]
test rcx, rcx
je 0x14003112f
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], rbx
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140031141
call fcn.1401218ec
mov qword [rdi + 8], rbx
mov edx, SafeArrayCopy
mov rcx, rdi
call fcn.1401218ec
mov rcx, qword [rbp + 0x80]
test esi, esi
js 0x1400318f9
test rcx, rcx
je 0x1400318f9
mov qword [rsp + 0x50], rcx
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
mov r14d, ebx
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140031240
xor eax, eax
mov qword [rbp + 0x140], rax
mov qword [rbp + 0x148], rax
mov qword [rbp + 0x150], rax
lea r8, [rsp + 0x40]
mov edx, 0x800
lea rcx, [rbp + 0x140]
call fcn.140021970
nop
mov rsi, qword [rbp + 0x148]
mov rdi, qword [rbp + 0x140]
sub rsi, rdi
nop dword [rax + rax]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
lea r9, [rbp + 0xc0]
mov r8d, esi
mov rdx, rdi
call qword [rax + SafeArrayCopy]
mov ecx, dword [rbp + 0xc0]
add r14d, ecx
test eax, eax
js 0x1400311fc
cmp rsi, rcx
je 0x1400311d0
jmp 0x1400311ff
mov r14d, ebx
test rdi, rdi
je 0x14003123b
mov rdx, qword [rbp + 0x150]
sub rdx, rdi
mov rax, rdi
cmp rdx, 0x1000
jb 0x140031233
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031999
mov rcx, rdi
call fcn.1401218ec
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14003124b
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x80]
test r14d, r14d
je 0x1400318ee
mov rax, qword [rcx]
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
call qword [rax + 0x28]
test eax, eax
js 0x1400318e3
xor eax, eax
mov qword [rbp + 0xe8], rax
mov qword [rbp + 0xf0], rax
mov qword [rbp + 0xf8], rax
mov edx, r14d
lea r8, [rsp + 0x41]
lea rcx, [rbp + 0xe8]
call fcn.140021970
nop
mov r13, qword [rbp + 0xf0]
mov r14, qword [rbp + 0xe8]
sub r13, r14
mov rcx, qword [rbp + 0x80]
mov rax, qword [rcx]
lea r9, [rbp + 0xc4]
mov r8d, r13d
mov rdx, r14
call qword [rax + SafeArrayCopy]
test eax, eax
js 0x140031827
mov eax, dword [rbp + 0xc4]
cmp rax, r13
jne 0x140031827
mov r8d, r13d
mov rdx, r14
lea rcx, [rbp - 0x30]
call fcn.14002ffc0
lea rsi, [r12 + 0x40]
mov rdx, rax
mov rcx, rsi
call fcn.14001bb00
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x14003133f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003133a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003199f
call fcn.1401218ec
cmp qword [r12 + 0x50], 0
je 0x14003181f
mov qword [rbp + 0x88], rbx
mov rcx, qword [rbp + 0x98]
mov qword [rsp + 0x60], rcx
test rcx, rcx
je 0x14003136e
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
mov qword [rbp + 0x88], rbx
mov edi, 1
mov dword [rsp + 0x58], edi
test rcx, rcx
je 0x1400313ff
mov qword [rbp + 0x90], rbx
lea r8, [rbp + 0x90]
xor edx, edx
call qword [sym.imp.ole32.dll_StgCreatePropSetStg]
test eax, eax
js 0x1400313e8
mov rcx, qword [rbp + 0x90]
test rcx, rcx
je 0x1400313ef
mov rax, qword [rcx]
lea r9, [rbp + 0x88]
lea r8d, [rdi + 0xf]
lea rdx, [0x1401b1b78]
call qword [rax + 0x20]
test eax, eax
jns 0x1400313e8
mov rcx, qword [rbp + 0x88]
test rcx, rcx
je 0x1400313e8
mov qword [rbp + 0x88], rbx
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x90]
test rcx, rcx
je 0x1400313fa
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14003140a
mov rax, qword [rcx]
call qword [rax + 0x10]
cmp qword [rbp + 0x88], 0
je 0x140031805
movdqa xmm0, xmmword [0x1401b5c90]
movdqu xmmword [rbp + 0x188], xmm0
mov word [rbp + 0x178], bx
movdqu xmmword [rbp - 0x68], xmm0
mov word [rbp - 0x78], bx
lea r9, str.MD5Checksum
xor r8d, r8d
lea edx, [r8 + 0xb]
lea rcx, [rbp - 0x78]
call fcn.140014f60
nop
mov rcx, qword [rbp + 0x88]
mov qword [rsp + 0x68], rcx
test rcx, rcx
je 0x140031467
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea r8, [rbp + 0x178]
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x68]
call fcn.1400309e0
mov r12d, eax
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x1400314bf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400314ba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400319a5
call fcn.1401218ec
test r12d, r12d
js 0x1400317b7
lea rcx, [rbp + 0x178]
cmp qword [rbp + 0x190], 8
cmovae rcx, qword [rbp + 0x178]
mov r8, rsi
cmp qword [rsi + 0x18], 8
jb 0x1400314ec
mov r8, qword [rsi]
mov rdx, qword [rsi + 0x10]
cmp rdx, qword [rbp + 0x188]
jne 0x1400317af
test rdx, rdx
je 0x140031528
sub r8, rcx
nop word [rax + rax]
movzx eax, word [rcx]
cmp word [rcx + r8], ax
jne 0x1400317af
add rcx, 2
sub rdx, 1
jne 0x140031510
xor sil, sil
movdqa xmm0, xmmword [0x1401b5c90]
movdqu xmmword [rbp + 0x168], xmm0
mov word [rbp + 0x158], bx
movdqu xmmword [rbp - 0x48], xmm0
mov word [rbp - 0x58], bx
lea r9, str.IsCompressed
xor r8d, r8d
lea edx, [r8 + 0xc]
lea rcx, [rbp - 0x58]
call fcn.140014f60
nop
mov rcx, qword [rbp + 0x88]
mov qword [rsp + 0x70], rcx
test rcx, rcx
je 0x14003157a
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea r8, [rbp + 0x158]
lea rdx, [rbp - 0x58]
lea rcx, [rsp + 0x70]
call fcn.1400309e0
mov r12d, eax
mov rdx, qword [rbp - 0x40]
cmp rdx, 8
jb 0x1400315d2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400315cd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400319ab
call fcn.1401218ec
test r12d, r12d
js 0x14003161d
lea rdx, [rbp + 0x158]
cmp qword [rbp + 0x170], 8
cmovae rdx, qword [rbp + 0x158]
cmp qword [rbp + 0x168], 1
jne 0x14003161a
lea rcx, [0x1401b3be8]
sub rdx, rcx
movzx eax, word [rcx]
cmp word [rdx + rcx], ax
jne 0x14003161a
add rcx, 2
sub rdi, 1
jne 0x140031602
mov sil, 1
jmp 0x14003161d
xor sil, sil
mov r12, qword [rsp + 0x78]
mov byte [r12 + 0x84], sil
xor eax, eax
mov qword [rbp + 0x120], rax
mov qword [rbp + 0x128], rax
lea rax, vtable.Utils::WriteableMemoryBufferFromUnicodeFileWithObfuscationWithCompression.0
mov qword [rbp + 0x100], rax
mov rdx, rbx
mov qword [rbp + 0x108], rbx
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x110], xmm0
movdqa xmm0, xmmword [0x1401b5c90]
movdqa xmmword [rbp + 0x130], xmm0
mov word [rbp + 0x120], bx
test r13, r13
je 0x140031696
mov r8, qword [rbp + 0xf0]
mov rdx, r14
lea rcx, [rbp + 0x108]
call fcn.14002b7b0
mov rdx, qword [rbp + 0x108]
mov r10, qword [rbp + 0x110]
mov r8, r10
sub r8, rdx
test rdx, rdx
je 0x1400316db
test r8, r8
je 0x1400316db
mov rcx, rdx
mov r9, r8
nop dword [rax]
nop word [rax + rax]
imul eax, r8d, 0x10003
inc eax
mov r8d, eax
shr eax, 0x10
xor byte [rcx], al
lea rcx, [rcx + 1]
sub r9, 1
jne 0x1400316c0
test sil, sil
je 0x140031723
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rsi, rax
lea rcx, [rbp + 0x100]
call fcn.140030840
movzx edi, al
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub eax, esi
mov dword [r12 + 0x80], eax
test dil, dil
jne 0x140031715
mov r15d, 0xffffffec
jmp 0x14003175a
mov r10, qword [rbp + 0x110]
mov rdx, qword [rbp + 0x108]
sub r10, rdx
cmp r10, 4
jbe 0x140031754
cmp byte [rdx], 0xff
jne 0x140031754
cmp byte [rdx + 1], 0xfe
jne 0x140031754
cmp byte [rdx + 2], 0
jne 0x140031743
cmp byte [rdx + 3], 0
je 0x140031754
mov r8d, r10d
add r8, rdx
mov rcx, qword [rbp - 0x80]
call fcn.14002b7b0
jmp 0x14003175a
mov r15d, 0xfffffff1
lea rcx, [rbp + 0x100]
call fcn.140030670
nop
mov rdx, qword [rbp + 0x170]
cmp rdx, 8
jb 0x1400317bd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x158]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400317a8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400319b1
call fcn.1401218ec
jmp 0x1400317bd
mov r15d, 0xffffffea
jmp 0x1400317bd
mov r15d, 0xffffffe9
mov rdx, qword [rbp + 0x190]
cmp rdx, 8
jb 0x14003180b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x178]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400317fe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400319b7
call fcn.1401218ec
jmp 0x14003180b
mov r15d, 0xfffffff0
mov rcx, qword [rbp + 0x88]
test rcx, rcx
je 0x14003182d
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x14003182d
mov r15d, 0xffffffeb
jmp 0x14003182d
mov r15d, 0xffffffe8
test r14, r14
je 0x140031869
mov rdx, qword [rbp + 0xf8]
sub rdx, r14
mov rax, r14
cmp rdx, 0x1000
jb 0x140031861
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400319bd
mov rcx, r14
call fcn.1401218ec
mov rcx, qword [rbp + 0x80]
mov rdx, qword [rbp + 0xb8]
cmp rdx, 8
jb 0x1400318bd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400318b1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400319c3
call fcn.1401218ec
mov rcx, qword [rbp + 0x80]
mov qword [rbp + 0xb0], rbx
mov qword [rbp + 0xb8], 7
mov word [rbp + 0xa0], bx
test rcx, rcx
je 0x14003190a
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x14003190a
mov r15d, 0xffffffe7
jmp 0x140031869
mov r15d, 0xffffffe6
jmp 0x140031870
mov r15d, 0xffffffe5
jmp 0x140031870
mov r15d, 0xffffffe4
mov rcx, qword [rbp + 0x98]
test rcx, rcx
je 0x140031924
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x140031924
mov r15d, 0xfffffff5
mov rdx, qword [rbp + 0xe0]
cmp rdx, 8
jb 0x140031966
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xc8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031961
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031993
call fcn.1401218ec
mov eax, r15d
mov rcx, qword [rbp + 0x198]
xor rcx, rsp
call fcn.140121cc0
mov rbx, qword [rsp + 0x2f8]
add rsp, 0x2a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1401431ac
nop
call fcn.1401431ac
nop
call fcn.1401431ac
nop
call fcn.1401431ac
nop
call fcn.1401431ac
nop
call fcn.1401431ac
nop
call fcn.1401431ac
nop
call fcn.1401431ac
nop
call fcn.1401431ac
int3