Function at 0x1401b6bd0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x110
mov rax, qword [0x14049bcb8]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov r14, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
mov ecx, 0x68
call fcn.14020335c
mov qword [rsp + 0x38], rax
test rax, rax
je 0x1401b6c23
mov rcx, rax
call fcn.1401b7480
xor esi, esi
jmp 0x1401b6c27
xor esi, esi
mov eax, esi
mov qword [rdi], rax
mov byte [rax + 0x20], 0
test r14, r14
je 0x1401b6f61
mov rdx, r14
mov rcx, qword [rdi]
call qword [sym.imp.VBoxRT.dll_public:_class_RTCString____ptr64___cdecl_RTCString::operator_class_RTCString_const____ptr64____ptr64]
lea rcx, [rsp + 0x70]
call qword [sym.imp.VBoxRT.dll_public:_void___cdecl_xml::XmlFileParser::constructor_void____ptr64]
nop
mov ecx, 8
call fcn.14020335c
mov qword [rsp + 0x38], rax
test rax, rax
je 0x1401b6c71
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_public:_void___cdecl_xml::Document::constructor_void____ptr64]
mov rcx, rax
jmp 0x1401b6c74
mov rcx, rsi
mov rax, qword [rdi]
mov qword [rax + 0x28], rcx
mov r8, qword [rdi]
mov r8, qword [r8 + 0x28]
mov rdx, r14
lea rcx, [rsp + 0x70]
call qword [sym.imp.VBoxRT.dll_public:_void___cdecl_xml::XmlFileParser::read_class_RTCString_const____ptr64__class_xml::Document____ptr64____ptr64]
mov rax, qword [rdi]
mov byte [rax + 0x20], 1
mov rcx, qword [rdi]
mov rcx, qword [rcx + 0x28]
call qword [sym.imp.VBoxRT.dll_public:_class_xml::ElementNode____ptr64___cdecl_xml::Document::getRootElement_void____ptr64]
mov rcx, qword [rdi]
mov qword [rcx + 0x38], rax
mov rax, qword [rdi]
mov rcx, qword [rax + 0x38]
test rcx, rcx
je 0x1401b6fdd
lea r8, [0x14032c140]
xor edx, edx
call qword [sym.imp.VBoxRT.dll_public:_bool___cdecl_xml::Node::nameEqualsNS_char_const____ptr64__char_const____ptr64_const___ptr64]
test al, al
je 0x1401b6fdd
mov rax, qword [rdi]
lea r8, [rax + 0x40]
xor r9d, r9d
lea rdx, str.version
mov rcx, qword [rax + 0x38]
call qword [reloc.VBoxRT.dll__getAttributeValue_ElementNode_xml__QEBA_NPEBDPEAVRTCString__0_Z]
test al, al
je 0x1401b6fab
mov ecx, 0xb80010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
mov r15, rax
test rax, rax
je 0x1401b6d46
mov rcx, qword [rdi]
add rcx, 0x40
call qword [sym.imp.VBoxRT.dll_public:_char_const____ptr64___cdecl_RTCString::c_str_void_const___ptr64]
mov rbx, rax
mov rcx, qword [rdi]
call qword [sym.imp.VBoxRT.dll_public:_char_const____ptr64___cdecl_RTCString::c_str_void_const___ptr64]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
lea r9, str.Loading_settings_file___s__with_version___s__n
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
mov r8d, 0xb8
mov rcx, r15
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov r8, qword [rdi]
lea rdx, [r8 + 0x40]
mov r8, qword [r8 + 0x38]
mov rcx, rdi
call fcn.1401c4260
mov rcx, qword [rdi]
mov dword [rcx + 0x60], eax
mov rcx, qword [rdi]
mov eax, dword [rcx + 0x60]
mov dword [rcx + 0x64], eax
mov rdx, r14
lea rcx, [rsp + 0x50]
call qword [sym.imp.VBoxRT.dll_public:_void___cdecl_RTCString::constructor_class_RTCString_const____ptr64____ptr64]
lea rax, vtable.com::Utf8Str.0
mov qword [rsp + 0x50], rax
lea rdx, str._custom
lea rcx, [rsp + 0x50]
call qword [sym.imp.VBoxRT.dll_public:_class_RTCString____ptr64___cdecl_RTCString::append_char_const____ptr64____ptr64]
lea rcx, [rsp + 0x50]
call qword [sym.imp.VBoxRT.dll_public:_char_const____ptr64___cdecl_RTCString::c_str_void_const___ptr64]
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_RTFileExists]
test al, al
je 0x1401b6f47
mov qword [rsp + 0x30], 0xffffffffffffffff
mov rbx, rsi
lea rcx, [rsp + 0x50]
call qword [sym.imp.VBoxRT.dll_public:_char_const____ptr64___cdecl_RTCString::c_str_void_const___ptr64]
mov rdx, rax
mov r8d, 0x781
lea rcx, [rsp + 0x30]
call qword [sym.imp.VBoxRT.dll_RTFileOpen]
test eax, eax
js 0x1401b6f47
mov qword [rsp + 0x40], rsi
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.VBoxRT.dll_RTFileQuerySize]
mov r14, qword [rsp + 0x40]
test eax, eax
js 0x1401b6e48
cmp r14, 0x100000
ja 0x1401b6e48
lea rcx, [r14 + 4]
lea rdx, [0x14030eea8]
call qword [sym.imp.VBoxRT.dll_RTMemAllocZTag]
mov rbx, rax
test rax, rax
je 0x1401b6e48
mov qword [rsp + 0x20], rsi
mov r9, r14
mov r8, rax
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.VBoxRT.dll_RTFileReadAt]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.VBoxRT.dll_RTFileClose]
jmp 0x1401b6e5c
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.VBoxRT.dll_RTFileClose]
test rbx, rbx
je 0x1401b6f47
lea rcx, [r14 + 4]
lea rdx, [0x14030eea8]
call qword [sym.imp.VBoxRT.dll_RTMemAllocZTag]
mov r15, rax
mov r8, r14
mov dword [rsp + 0xf0], 0xa30adf59
mov dword [rsp + 0xf4], 0xd180e867
mov dword [rsp + 0xf8], 0xc3aab352
mov dword [rsp + 0xfc], 0x7b9a2944
test r14, r14
je 0x1401b6ed0
mov rdx, rbx
mov r9, rax
sub r9, rbx
nop dword [rax]
mov rax, rdx
sub rax, rbx
and eax, 0xf
movzx eax, byte [rsp + rax + 0xf0]
xor al, byte [rdx]
mov byte [r9 + rdx], al
inc rdx
sub r8, 1
jne 0x1401b6eb0
lea rcx, [rsp + 0x38]
call qword [sym.imp.VBoxRT.dll_public:_void___cdecl_xml::XmlMemParser::constructor_void____ptr64]
nop
mov ecx, 8
call fcn.14020335c
mov qword [rsp + 0xf0], rax
test rax, rax
je 0x1401b6eff
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_public:_void___cdecl_xml::Document::constructor_void____ptr64]
mov rsi, rax
mov rax, qword [rdi]
mov qword [rax + 0x30], rsi
mov rax, qword [rdi]
mov rcx, qword [rax + 0x30]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x50]
mov r8, r14
mov rdx, r15
lea rcx, [rsp + 0x38]
call qword [sym.imp.VBoxRT.dll_public:_void___cdecl_xml::XmlMemParser::read_void_const____ptr64__unsigned_long_long_unsigned___int64___class_RTCString_const____ptr64__class_xml::Document____ptr64____ptr64]
mov rcx, r15
call qword [sym.imp.VBoxRT.dll_RTMemFree]
mov rcx, rbx
call qword [sym.imp.VBoxRT.dll_RTMemFree]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.VBoxRT.dll_public:_void___cdecl_xml::XmlMemParser::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.VBoxRT.dll_public_virtual:_void___cdecl_RTCString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.VBoxRT.dll_public:_void___cdecl_xml::XmlFileParser::destructor_void____ptr64]
nop
jmp 0x1401b6f7f
mov rcx, qword [rdi]
add rcx, 0x40
lea rdx, str.1.12_windows
call qword [sym.imp.VBoxRT.dll_public:_class_RTCString____ptr64___cdecl_RTCString::operator_char_const____ptr64____ptr64]
mov rax, qword [rdi]
mov dword [rax + 0x60], SafeArrayDestroy
mov rax, rdi
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.140202f70
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
mov r8, qword [rdi]
lea r9, str.Required_VirtualBox__version_attribute_is_missing
mov r8, qword [r8 + 0x38]
mov rdx, rdi
lea rcx, [rsp + 0x80]
call fcn.1401b7050
lea rdx, [0x14048fab8]
lea rcx, [rsp + 0x80]
call sub.VCRUNTIME140.dll__CxxThrowException
mov r8, qword [rdi]
lea r9, str.Root_element_in_VirtualBox_settings_files_must_be__VirtualBox_
mov r8, qword [r8 + 0x38]
mov rdx, rdi
lea rcx, [rsp + 0xb8]
call fcn.1401b7050
lea rdx, [0x14048fab8]
lea rcx, [rsp + 0xb8]
call sub.VCRUNTIME140.dll__CxxThrowException
int3