Function at 0x14002a110
Capabilities:
Check if file exists
Encode data using xor
Generate random numbers using a mersenne twister
Get file attributes
Set current directory

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push r15
mov eax, 0x10098
call fcn.1400eb380
sub rsp, rax
test rdx, rdx
mov byte [0x140136910], 1
mov rbx, rdx
mov word [0x1401371f4], 0
cmove rbx, qword [0x1401371c0]
cmp dword [0x1401371f0], 0
jne 0x14002a19c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14002a19c
mov r9, rbx
lea r8, str.Script_file_not_found:_n_s
mov edx, 0x8018
lea rcx, [rsp + 0x50]
call fcn.1400acf50
xor r15d, r15d
lea rcx, [rsp + 0x50]
xorps xmm3, xmm3
mov qword [rsp + 0x20], r15
xor r8d, r8d
lea edx, [r15 + 0x10]
call fcn.1400b2ec0
xor eax, eax
add rsp, 0x10098
pop r15
pop rbx
ret
mov qword [rsp + 0x100c8], rbp
mov ecx, 0x28
mov qword [rsp + 0x10090], rsi
mov qword [rsp + 0x10088], rdi
mov qword [rsp + 0x10080], r14
call fcn.1400a96d0
xor r15d, r15d
mov qword [rsp + 0x100b0], rax
test rax, rax
je 0x14002a8d3
mov esi, dword [0x1401351b0]
lea rcx, vtable.Label.0
mov qword [rax], rcx
lea rdx, [rsp + 0x100b0]
mov qword [rax + 0x10], r15
lea rcx, [0x1400fb87c]
mov qword [rax + 8], rcx
lea rcx, [0x140136640]
mov qword [rax + 0x18], r15
mov qword [rax + 0x20], r15
cmp dword [0x1401371f0], 2
mov qword [0x140136ce8], rax
lea rax, [0x1401135ac]
cmove rbx, rax
mov qword [rsp + 0x100b0], r15
mov r8, rbx
mov byte [rsp + 0x20], r15b
xor r9d, r9d
call fcn.14002a910
mov rbx, qword [rsp + 0x100b0]
mov edi, eax
cmp eax, 3
jne 0x14002a264
mov r8d, esi
lea rcx, [0x140136640]
mov rdx, rbx
call fcn.14002ae60
mov edi, eax
test rbx, rbx
je 0x14002a276
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
cmp edi, 1
jne 0x14002a8da
xor r9d, r9d
mov qword [rsp + 0x20], r15
xor r8d, r8d
lea rcx, [0x140136640]
mov dl, 0x68
call fcn.140034ac0
test eax, eax
je 0x14002a8da
mov rax, qword [0x140136648]
mov qword [rax + 0x10], 1
mov rdi, qword [0x140136640]
test rdi, rdi
je 0x14002a3ae
nop
mov ebp, r15d
cmp byte [rdi + 1], r15b
jbe 0x14002a374
mov r14, r15
mov rsi, qword [rdi + 8]
add rsi, r14
cmp byte [rsi + 1], r15b
je 0x14002a362
mov rbx, qword [rsi + 0x10]
test rbx, rbx
je 0x14002a34f
cmp qword [rbx], r15
je 0x14002a34f
nop
cmp byte [rbx + 0x10], r15b
je 0x14002a346
movzx r8d, word [rbx + 0x12]
lea rcx, [0x140136640]
mov rdx, qword [rbx]
xor r9d, r9d
call fcn.14003d7a0
mov qword [rbx + 8], rax
test rax, rax
jne 0x14002a346
movzx r8d, word [rbx + 0x12]
lea rax, [rsp + 0x100b8]
mov rdx, qword [rbx]
lea r9, [rsp + 0x100b0]
mov byte [rsp + 0x28], 1
mov qword [rsp + 0x20], rax
call fcn.14003d4a0
mov qword [rbx + 8], rax
test rax, rax
je 0x14002a383
add rbx, 0x18
cmp qword [rbx], r15
jne 0x14002a2f0
mov rdx, rsi
mov rcx, rdi
call fcn.140041400
test eax, eax
je 0x14002a8da
movzx eax, byte [rdi + 1]
inc ebp
add r14, 0x20
cmp ebp, eax
jl 0x14002a2d0
mov rdi, qword [rdi + 0x20]
test rdi, rdi
jne 0x14002a2c0
jmp 0x14002a3ae
cmp byte [rsp + 0x100b0], r15b
jne 0x14002a8da
mov r9, qword [rbx]
lea rdx, str.Call_to_nonexistent_function.
xor r8d, r8d
mov rcx, rdi
call fcn.140051140
test eax, eax
je 0x14002a8da
mov rcx, qword [0x140136640]
test rcx, rcx
je 0x14002a43a
nop
movzx eax, byte [rcx]
mov rdx, qword [rcx + 0x20]
mov r8, qword [rcx + 0x18]
cmp al, 8
je 0x14002a3e2
cmp al, 0xe3
jne 0x14002a3d8
mov byte [rcx], reloc.OLEAUT32.dll_SafeArrayGetElemsize
jmp 0x14002a413
mov rcx, rdx
test rdx, rdx
jne 0x14002a3c0
jmp 0x14002a43a
movzx eax, byte [rcx + 0x10]
mov byte [rcx], al
mov rax, qword [0x140136658]
mov qword [rcx + 0x18], rax
mov rax, qword [0x140136658]
test rax, rax
je 0x14002a405
mov qword [rax + 0x20], rcx
jmp 0x14002a40c
mov qword [0x140136650], rcx
mov qword [0x140136658], rcx
test r8, r8
je 0x14002a41e
mov qword [r8 + 0x20], rdx
jmp 0x14002a425
mov qword [0x140136640], rdx
test rdx, rdx
je 0x14002a433
mov qword [rdx + 0x18], r8
mov rcx, rdx
jmp 0x14002a3c0
mov qword [0x140136648], r8
cmp qword [0x140136650], r15
je 0x14002a475
mov rax, qword [0x140136640]
mov rcx, qword [0x140136658]
mov qword [rcx + 0x20], rax
mov rax, qword [0x140136640]
mov rcx, qword [0x140136658]
mov qword [rax + 0x18], rcx
mov rax, qword [0x140136650]
mov qword [0x140136640], rax
mov ecx, dword [0x140136678]
mov edi, r15d
test ecx, ecx
jle 0x14002a4d7
mov rsi, r15
nop word [rax + rax]
mov rax, qword [0x140136670]
mov rbx, qword [rsi + rax]
cmp byte [rbx + 0x5d], r15b
jne 0x14002a4cd
test byte [rbx + 0x5c], 4
jne 0x14002a4cd
mov r8, qword [rbx + 0x30]
lea r9, [rbx + 0x48]
mov rdx, rbx
call fcn.1400521f0
mov r8, qword [rbx + 0x38]
lea r9, [rbx + 0x50]
mov rdx, rbx
call fcn.1400521f0
mov ecx, dword [0x140136678]
inc edi
add rsi, 8
cmp edi, ecx
jl 0x14002a490
mov rcx, qword [0x1401368f0]
test rcx, rcx
je 0x14002a5a6
cmp qword [rcx + 0x20], r15
je 0x14002a599
mov rax, qword [rcx + 0x18]
mov r10, qword [rax]
mov rbx, qword [rax + 0x10]
test r10, r10
je 0x14002a599
lea rax, str.__Class
mov dword [rsp + 0x40], 5
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x100b0]
lea rax, [rsp + 0x100b8]
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x100c0]
mov rcx, r10
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.1400a5fa0
test rax, rax
je 0x14002a56d
mov rcx, qword [rax]
mov rax, rcx
mov dword [0x14013690c], ecx
sar rax, 0x20
mov dword [0x140136908], eax
mov r8, rbx
mov qword [0x140136ce0], r15
lea rdx, str.Unknown_class.
lea rcx, [0x140136640]
call fcn.1400515e0
test eax, eax
je 0x14002a8da
mov rcx, qword [0x1401368f0]
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
mov qword [0x1401368f0], r15
cmp dword [0x140134fe4], r15d
je 0x14002a6ec
mov qword [rsp + 0x28], r15
lea rdx, str.A_Args
xor r9d, r9d
mov dword [rsp + 0x20], 3
xor r8d, r8d
lea rcx, [0x140136640]
call fcn.14003f6b0
mov rsi, qword [0x140136640]
mov rbp, rax
test rsi, rsi
je 0x14002a6ec
nop dword [rax]
mov r14d, r15d
cmp byte [rsi + 1], r15b
jbe 0x14002a6df
mov rdi, r15
mov rbx, qword [rsi + 8]
cmp byte [rdi + rbx], 2
jne 0x14002a664
mov rax, qword [rdi + rbx + 8]
cmp word [rax], r15w
jne 0x14002a6cb
mov r9, qword [rdi + rbx + 0x10]
cmp byte [r9 + 0x23], r15b
jne 0x14002a62a
mov rax, qword [r9 + 0x10]
jmp 0x14002a62d
mov rax, r9
test byte [rax + 0x21], 2
je 0x14002a6cb
cmp r9, rbp
je 0x14002a6cb
mov r9, qword [r9 + 0x28]
lea r8, str.Class_may_be_overwritten.
mov edx, dword [0x140134fe4]
lea rcx, [0x140136640]
mov qword [rsp + 0x20], rsi
call fcn.140051f90
jmp 0x14002a6cb
cmp byte [rdi + rbx + 1], r15b
je 0x14002a6cb
mov rbx, qword [rdi + rbx + 0x18]
cmp dword [rbx + 0x10], 0x44
je 0x14002a6cb
cmp dword [rbx + 0x10], 4
jne 0x14002a6c1
cmp dword [rbx + 8], r15d
je 0x14002a6c1
mov r9, qword [rbx]
cmp byte [r9 + 0x23], r15b
jne 0x14002a691
mov rax, qword [r9 + 0x10]
jmp 0x14002a694
mov rax, r9
test byte [rax + 0x21], 2
je 0x14002a6c1
cmp r9, rbp
je 0x14002a6c1
mov r9, qword [r9 + 0x28]
lea r8, str.Class_may_be_overwritten.
mov edx, dword [0x140134fe4]
lea rcx, [0x140136640]
mov qword [rsp + 0x20], rsi
call fcn.140051f90
add rbx, 0x20
cmp dword [rbx + 0x10], 0x44
jne 0x14002a676
movzx eax, byte [rsi + 1]
inc r14d
add rdi, 0x20
cmp r14d, eax
jl 0x14002a600
mov rsi, qword [rsi + 0x20]
test rsi, rsi
jne 0x14002a5f0
cmp qword [0x140137200], r15
je 0x14002a6fc
xor eax, eax
jmp 0x14002a8df
mov rcx, qword [0x140134280]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
inc dword [0x14013690c]
lea rcx, [0x140136640]
xor r9d, r9d
mov qword [rsp + 0x20], r15
xor r8d, r8d
mov dl, 0x68
call fcn.140034ac0
test eax, eax
je 0x14002a8da
xor r9d, r9d
mov qword [rsp + 0x20], r15
xor r8d, r8d
lea rcx, [0x140136640]
mov dl, 0x68
call fcn.140034ac0
test eax, eax
je 0x14002a8da
mov rax, qword [0x140136648]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r15
mov rcx, qword [rax + 0x18]
mov qword [rcx + 0x10], 1
mov rax, qword [0x140136648]
mov qword [rax + 0x10], 1
mov rax, qword [0x140136ce8]
mov rcx, qword [0x140136648]
mov qword [rax + 0x10], rcx
mov rdx, qword [0x140136640]
call fcn.140040250
test rax, rax
je 0x14002a8da
mov rdx, qword [0x140136640]
lea rcx, [0x140136640]
call fcn.140040740
test rax, rax
je 0x14002a8da
lea rax, [rsp + 0x100b0]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x100b8]
lea rdx, [0x1401135b0]
mov dword [rsp + 0x20], 3
lea rcx, [0x140136640]
call fcn.14003f6b0
test rax, rax
je 0x14002a802
mov qword [0x140134210], rax
jmp 0x14002a844
cmp byte [rsp + 0x100b0], r15b
lea rdx, [0x1401135b0]
mov r9d, dword [rsp + 0x100b8]
lea rcx, [0x140136640]
setne r15b
xor r8d, r8d
inc r15d
mov dword [rsp + 0x20], r15d
call fcn.14003f980
mov qword [0x140134210], rax
test rax, rax
je 0x14002a8da
xor r9d, r9d
mov byte [rsp + 0x20], 1
lea rdx, [0x1400fb96c]
mov rcx, rax
lea r8, [r9 - 1]
call fcn.1400b0830
lea rcx, [rsp + 0x100b0]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [rsp + 0x100b0]
lea r9, [0x140137594]
mov dword [0x140137590], eax
mov r8d, 1
nop word [rax + rax]
mov edx, dword [r9 - 4]
lea r9, [r9 + 4]
shr edx, 0x1e
xor edx, dword [r9 - 8]
imul ecx, edx, 0x6c078965
add ecx, r8d
inc r8d
mov dword [r9 - 4], ecx
cmp r8d, 0x270
jl 0x14002a890
mov dword [0x140132108], 1
mov eax, 1
mov dword [0x140137f50], 1
jmp 0x14002a8df
mov qword [0x140136ce8], r15
mov eax, 0xffffffff
mov rdi, qword [rsp + 0x10088]
mov rsi, qword [rsp + 0x10090]
mov rbp, qword [rsp + 0x100c8]
mov r14, qword [rsp + 0x10080]
add rsp, 0x10098
pop r15
pop rbx
ret