Function at 0x100031130
Capabilities:
Encode data using xor
Get file size
Read file via mapping

Disassembly:
mov qword [rsp + 8], rcx
mov rax, rsp
sub rsp, 0xb8
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov qword [rax - 8], rsi
mov qword [rax - 0x10], rdi
mov qword [rax - 0x18], r12
mov qword [rax - 0x20], r13
mov qword [rax - 0x28], r14
mov qword [rax - 0x30], r15
mov rsi, rdx
mov r12, rcx
xor r15d, r15d
mov r13d, r15d
mov dword [rax - 0x78], r15d
lea rcx, [0x1000a9318]
mov rax, qword [0x1000a9318]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x48], rbx
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
lea r14, [r15 - 1]
cmp dword [rdx + 8], r15d
je 0x1000311f3
cmp dword [rdx + 0x10], r15d
jge 0x1000311c5
cmp dword [rbx - 0xc], r15d
jge 0x1000311ba
mov ecx, 0x80070057
call fcn.100013860
int3
mov dword [rbx - 0x10], r15d
mov word [rbx], 0
jmp 0x1000311f3
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1000311dc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x48], rbx
mov r13d, dword [rsp + 0x40]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
mov qword [rsp + 0x60], rax
cmp rax, r14
je 0x10003157c
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
cmp eax, 0xffffffff
je 0x100031573
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], ebp
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 2]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rsp + 0x68], rax
test rax, rax
je 0x100031573
mov qword [rsp + 0x20], rbp
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r15, rax
test rax, rax
je 0x100031565
mov qword [rsp + 0x58], rax
movzx r12d, word [rax]
mov ecx, r12d
cmp r12d, 0xbbef
je 0x1000312ca
cmp r12d, 0xfeff
je 0x1000312bf
cmp r12d, 0xfffe
jne 0x1000312ee
shr ebp, 1
lea edi, [rbp - 1]
jmp 0x10003136e
mov edi, ebp
shr edi, 1
dec edi
jmp 0x10003136e
cmp ebp, 2
jbe 0x1000312ee
cmp byte [rax + 2], 0xbf
jne 0x1000312ee
mov esi, 0xfde9
lea r9, [rax + 3]
mov qword [rsp + 0x58], r9
add ebp, 0xfffffffd
xor r9d, r9d
jmp 0x100031432
mov dword [rsp + 0x44], r14d
lea r8, [rsp + 0x44]
mov edx, ebp
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_IsTextUnicode]
test eax, eax
je 0x10003130d
mov edi, ebp
shr edi, 1
jmp 0x10003136e
mov r8d, 1
xor r9d, r9d
mov ecx, r9d
mov edx, r9d
test ebp, ebp
jle 0x100031366
mov rdi, r15
movzx eax, byte [rdi]
test al, 0x80
cmovne r8d, r9d
test ecx, ecx
jne 0x100031341
cmp al, 0x80
jb 0x10003134a
inc ecx
add al, al
js 0x100031334
add ecx, 0xffffffff
je 0x100031366
jmp 0x10003134a
and al, 0xc0
cmp al, 0x80
jne 0x100031366
add ecx, 0xffffffff
inc edx
inc rdi
cmp edx, ebp
jl 0x100031323
test ecx, ecx
jne 0x100031366
test r8d, r8d
jne 0x100031366
mov esi, 0xfde9
jmp 0x100031432
mov esi, r9d
jmp 0x100031432
lea esi, [rdi + 1]
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, esi
or eax, ecx
jge 0x100031393
mov edx, esi
lea rcx, [rsp + 0x48]
call fcn.1000140c0
mov rbx, qword [rsp + 0x48]
test esi, esi
js 0x100031427
cmp esi, dword [rbx - 0xc]
jg 0x100031427
mov dword [rbx - 0x10], esi
movsxd rax, esi
mov word [rbx + rax*2], 0
cmp r12w, 0xfeff
jne 0x1000313cf
mov r8d, edi
add r8, r8
lea rdx, [r15 + 2]
mov rcx, rbx
call sub.msvcrt.dll_memcpy
jmp 0x1000314f0
cmp r12w, 0xfffe
jne 0x100031411
lea rdx, [r15 + 2]
test edi, edi
je 0x1000314f0
mov r9, rbx
sub r9, rdx
mov r8d, edi
nop
movzx ecx, byte [rdx + 1]
movzx eax, word [rdx]
shl ax, 8
xor cx, ax
mov word [r9 + rdx], cx
add rdx, 2
dec r8
jne 0x1000313f0
jmp 0x1000314f0
mov r8d, edi
add r8, r8
mov rdx, r15
mov rcx, rbx
call sub.msvcrt.dll_memcpy
jmp 0x1000314f0
mov ecx, 0x80070057
call fcn.100013860
int3
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], r9
mov r9d, ebp
mov r8, qword [rsp + 0x58]
xor edx, edx
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
test eax, eax
je 0x10003154f
lea r12d, [rax + 1]
mov edx, 1
sub edx, dword [rbx - 8]
mov ecx, dword [rbx - 0xc]
sub ecx, r12d
or ecx, edx
jge 0x100031480
mov edx, r12d
lea rcx, [rsp + 0x48]
call fcn.1000140c0
mov rbx, qword [rsp + 0x48]
test r12d, r12d
js 0x1000316ee
cmp r12d, dword [rbx - 0xc]
jg 0x1000316ee
mov dword [rbx - 0x10], r12d
movsxd rax, r12d
mov word [rbx + rax*2], 0
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
mov r9d, ebp
mov r8, qword [rsp + 0x58]
xor edx, edx
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x1000314f0
mov rcx, r14
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
test ecx, ecx
js 0x1000314e5
cmp ecx, dword [rbx - 0xc]
jg 0x1000314e5
mov dword [rbx - 0x10], ecx
movsxd rax, ecx
mov word [rbx + rax*2], 0
jmp 0x10003154f
mov ecx, 0x80070057
call fcn.100013860
int3
mov rax, rbx
test edi, edi
je 0x100031514
mov ecx, edi
nop
nop
cmp word [rax], 0
jne 0x10003150b
mov word [rax], 0x20
add rax, 2
dec rcx
jne 0x100031500
mov eax, edi
mov word [rbx + rax*2], 0
xor eax, eax
mov rcx, r14
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
test ecx, ecx
js 0x100031544
cmp ecx, dword [rbx - 0xc]
jg 0x100031544
mov dword [rbx - 0x10], ecx
movsxd rax, ecx
mov word [rbx + rax*2], 0
jmp 0x10003154f
mov ecx, 0x80070057
call fcn.100013860
int3
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rdi, qword [rsp + 0x60]
mov r12, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r15d, r15d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rbx - 0x10], 0
jne 0x10003160f
lea rcx, [0x1000a9318]
mov rax, qword [0x1000a9318]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x50], rdi
lea rdx, [rdi - 0x18]
mov rsi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x1000315fd
cmp dword [rdx + 0x10], 0
jge 0x1000315cf
cmp dword [rdi - 0xc], 0
jge 0x1000315c4
mov ecx, 0x80070057
call fcn.100013860
int3
mov dword [rdi - 0x10], r15d
mov word [rdi], 0
jmp 0x1000315fd
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1000315e6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x50], rdi
mov rbx, qword [rsp + 0x48]
lea rsi, [rsp + 0x50]
mov r13d, 1
mov dword [rsp + 0x40], r13d
jmp 0x100031619
lea rsi, [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsi]
mov rcx, qword [rsi - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rsi - 8], 0
jl 0x10003164e
cmp rax, qword [rsi - 0x18]
jne 0x10003164e
lea rbp, [rsi - 0x18]
lock inc dword [rsi - 8]
mov rbx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov r13d, dword [rsp + 0x40]
jmp 0x100031687
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rsi - 0x10]
call qword [rax]
mov rbp, rax
test rax, rax
jne 0x10003166a
call fcn.100013cb0
int3
mov eax, dword [rsi - 0x10]
mov dword [rbp + 8], eax
mov eax, dword [rsi - 0x10]
inc eax
movsxd r8, eax
add r8, r8
mov rdx, rsi
lea rcx, [rbp + 0x18]
call sub.msvcrt.dll_memcpy
lea rax, [rbp + 0x18]
mov qword [r12], rax
or r13d, 2
mov dword [rsp + 0x40], r13d
test r13b, 1
je 0x1000316ce
and r13d, 0xfffffffe
mov dword [rsp + 0x40], r13d
lea rdx, [rdi - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1000316c9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x48]
jmp 0x1000316ce
mov rbx, qword [rsp + 0x48]
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], r14d
dec r14d
test r14d, r14d
jg 0x1000316e9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, r12
jmp 0x1000316f9
mov ecx, 0x80070057
call fcn.100013860
nop
mov rbx, qword [rsp + 0xd0]
mov rbp, qword [rsp + 0xd8]
mov rsi, qword [rsp + 0xb0]
mov rdi, qword [rsp + 0xa8]
mov r12, qword [rsp + 0xa0]
mov r13, qword [rsp + 0x98]
mov r14, qword [rsp + 0x90]
mov r15, qword [rsp + 0x88]
add rsp, 0xb8
ret