Function at 0x140035d50
Capabilities:
Encode data using xor
Get file attributes

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x318], rbx
mov rax, qword [0x14023c048]
xor rax, rsp
mov qword [rbp + 0x1b8], rax
mov r12, r8
mov qword [rsp + 0x78], r8
mov qword [rbp - 0x80], rdx
xor ebx, ebx
mov dword [rsp + 0x58], ebx
mov r15d, ebx
mov rdx, rcx
lea rcx, [rbp + 0xc8]
call fcn.140032eb0
nop
movdqa xmm0, xmmword [0x1401e87c0]
movdqa xmmword [rbp], xmm0
mov word [rbp - 0x10], bx
movdqa xmmword [rbp + 0x20], xmm0
mov word [rbp + 0x10], bx
movdqa xmmword [rbp + 0x40], xmm0
mov word [rbp + 0x30], bx
movdqa xmmword [rbp + 0x60], xmm0
mov word [rbp + 0x50], bx
mov dword [rbp + 0x70], ebx
mov byte [rbp + 0x74], bl
lea rdx, [rbp - 0x10]
mov rcx, r12
call fcn.140035c30
lea rcx, [rbp - 0x10]
call fcn.140035ad0
lea rax, [rbp + 0xc8]
cmp r12, rax
je 0x140035e2a
lea rdx, [rbp + 0xc8]
cmp qword [rbp + 0xe0], 8
cmovae rdx, qword [rbp + 0xc8]
mov r8, qword [rbp + 0xd8]
mov rcx, r12
call fcn.14001f5f0
cmp qword [rbp + 0xd8], 0
je 0x14003691b
lea rdx, [rbp + 0xc8]
lea rcx, [rbp + 0x198]
call fcn.140032eb0
lea rcx, [rbp + 0x198]
cmp qword [rbp + 0x1b0], 8
cmovae rcx, qword [rbp + 0x198]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
mov rdx, qword [rbp + 0x1b0]
cmp rdx, 8
jb 0x140035eb0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x198]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140035eab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140036996
call fcn.140148ec0
cmp edi, 0xffffffff
je 0x14003691b
mov qword [rbp + 0x90], rbx
lea rcx, [rbp + 0xc8]
cmp qword [rbp + 0xe0], 8
cmovae rcx, qword [rbp + 0xc8]
lea rax, [rbp + 0x90]
mov qword [rsp + 0x38], rax
lea rax, [0x1401e2b08]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
call qword [sym.imp.ole32.dll_StgOpenStorageEx]
test eax, eax
js 0x1400368f9
cmp qword [rbp + 0x90], 0
je 0x1400368f9
mov qword [rbp + 0x80], rbx
lea rdx, [rbp + 0xc8]
lea rcx, [rbp + 0xa0]
call fcn.140033b80
nop
mov rcx, qword [rbp + 0xb0]
test rcx, rcx
je 0x140036856
mov rdx, qword [rbp + 0xb8]
mov rax, rdx
sub rax, rcx
cmp rax, 4
jb 0x140035f97
lea rsi, [rcx + 4]
mov qword [rbp + 0xb0], rsi
lea rdi, [rbp + 0xa0]
cmp rdx, 8
cmovae rdi, qword [rbp + 0xa0]
lea rcx, [rdi + rcx*2]
mov r8d, 8
lea rdx, str..xml
call fcn.1401679c0
mov word [rdi + rsi*2], bx
jmp 0x140035fba
mov qword [rsp + 0x20], 4
lea r9, str..xml
xor r8d, r8d
lea edx, [r8 + 4]
lea rcx, [rbp + 0xa0]
call fcn.14002c6d0
lea rcx, [r12 + 0x60]
lea rax, [rbp + 0xa0]
cmp rcx, rax
je 0x140035fee
lea rdx, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 8
cmovae rdx, qword [rbp + 0xa0]
mov r8, qword [rbp + 0xb0]
call fcn.14001f5f0
mov rdi, qword [rbp + 0x90]
mov rax, qword [rdi]
mov rsi, qword [rax + 0x20]
lea rdx, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 8
cmovae rdx, qword [rbp + 0xa0]
lea rcx, [rsp + 0x48]
call fcn.14001fc60
nop
mov rdx, qword [rax]
test rdx, rdx
je 0x14003602b
mov rdx, qword [rdx]
jmp 0x14003602e
mov rdx, rbx
lea rax, [rbp + 0x80]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
mov r9d, SafeArrayUnlock
xor r8d, r8d
mov rcx, rdi
mov rax, rsi
call qword [case.0x140024b66.0]
mov esi, eax
mov rdi, qword [rsp + 0x48]
test rdi, rdi
je 0x1400360a3
mov eax, 0xffffffff
lock xadd dword [rdi + 0x10], eax
cmp eax, 1
jne 0x1400360a3
test rdi, rdi
je 0x1400360a3
mov rcx, qword [rdi]
test rcx, rcx
je 0x140036084
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], rbx
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140036096
call fcn.140148ec0
mov qword [rdi + 8], rbx
mov edx, SafeArrayCopy
mov rcx, rdi
call fcn.140148ec0
mov rcx, qword [rbp + 0x80]
test esi, esi
js 0x1400368ee
test rcx, rcx
je 0x1400368ee
mov qword [rsp + 0x50], rcx
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140024b66.0]
nop
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
mov r14d, ebx
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400361a7
xor eax, eax
mov qword [rbp + 0x140], rax
mov qword [rbp + 0x148], rax
mov qword [rbp + 0x150], rax
lea r8, [rsp + 0x40]
mov edx, 0x800
lea rcx, [rbp + 0x140]
call fcn.14002bd70
nop
mov rsi, qword [rbp + 0x148]
mov rdi, qword [rbp + 0x140]
sub rsi, rdi
nop dword [rax + rax]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
lea r9, [rbp + 0xc0]
mov r8d, esi
mov rdx, rdi
mov rax, qword [rax + 0x18]
call qword [case.0x140024b66.0]
mov ecx, dword [rbp + 0xc0]
add r14d, ecx
test eax, eax
js 0x140036163
cmp rsi, rcx
je 0x140036130
jmp 0x140036166
mov r14d, ebx
test rdi, rdi
je 0x1400361a2
mov rdx, qword [rbp + 0x150]
sub rdx, rdi
mov rax, rdi
cmp rdx, 0x1000
jb 0x14003619a
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003699c
mov rcx, rdi
call fcn.140148ec0
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400361ba
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140024b66.0]
nop
mov rcx, qword [rbp + 0x80]
test r14d, r14d
je 0x1400368e3
mov rax, qword [rcx]
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rax, qword [rax + 0x28]
call qword [case.0x140024b66.0]
test eax, eax
js 0x1400368d8
xor eax, eax
mov qword [rbp + 0xe8], rax
mov qword [rbp + 0xf0], rax
mov qword [rbp + 0xf8], rax
mov edx, r14d
lea r8, [rsp + 0x41]
lea rcx, [rbp + 0xe8]
call fcn.14002bd70
nop
mov rcx, qword [rbp + 0x80]
mov rax, qword [rcx]
mov r13, qword [rbp + 0xf0]
mov r14, qword [rbp + 0xe8]
sub r13, r14
lea r9, [rbp + 0xc4]
mov r8d, r13d
mov rdx, r14
mov rax, qword [rax + 0x18]
call qword [case.0x140024b66.0]
test eax, eax
js 0x140036814
mov eax, dword [rbp + 0xc4]
cmp rax, r13
jne 0x140036814
mov r8d, r13d
mov rdx, r14
lea rcx, [rbp - 0x30]
call fcn.140034130
lea rsi, [r12 + 0x40]
mov rdx, rax
mov rcx, rsi
call fcn.14001c770
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x1400362bc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400362b7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400369a2
call fcn.140148ec0
cmp qword [r12 + 0x50], 0
je 0x14003680c
mov qword [rbp + 0x88], rbx
mov rcx, qword [rbp + 0x90]
mov qword [rsp + 0x60], rcx
test rcx, rcx
je 0x1400362f2
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140024b66.0]
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
mov qword [rbp + 0x88], rbx
mov edi, 1
mov dword [rsp + 0x58], edi
test rcx, rcx
je 0x14003639e
mov qword [rbp + 0x98], rbx
lea r8, [rbp + 0x98]
xor edx, edx
call qword [sym.imp.ole32.dll_StgCreatePropSetStg]
test eax, eax
js 0x14003637f
mov rcx, qword [rbp + 0x98]
test rcx, rcx
je 0x140036386
mov rax, qword [rcx]
lea r9, [rbp + 0x88]
lea r8d, [rdi + 0xf]
lea rdx, [0x1401e2af8]
mov rax, qword [rax + 0x20]
call qword [case.0x140024b66.0]
test eax, eax
jns 0x14003637f
mov rcx, qword [rbp + 0x88]
test rcx, rcx
je 0x14003637f
mov qword [rbp + 0x88], rbx
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140024b66.0]
nop
mov rcx, qword [rbp + 0x98]
test rcx, rcx
je 0x140036399
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140024b66.0]
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400363b1
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140024b66.0]
nop
cmp qword [rbp + 0x88], 0
je 0x1400367ea
movdqa xmm0, xmmword [0x1401e87c0]
movdqu xmmword [rbp + 0x188], xmm0
mov word [rbp + 0x178], bx
movdqu xmmword [rbp - 0x68], xmm0
mov word [rbp - 0x78], bx
lea r9, str.MD5Checksum
xor r8d, r8d
lea edx, [r8 + 0xb]
lea rcx, [rbp - 0x78]
call fcn.14001f490
nop
mov rcx, qword [rbp + 0x88]
mov qword [rsp + 0x68], rcx
test rcx, rcx
je 0x140036416
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140024b66.0]
nop
lea r8, [rbp + 0x178]
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x68]
call fcn.1400358a0
mov r12d, eax
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x14003646e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140036469
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400369a8
call fcn.140148ec0
test r12d, r12d
js 0x14003679c
lea rax, [rbp + 0x178]
cmp qword [rbp + 0x190], 8
cmovae rax, qword [rbp + 0x178]
mov rcx, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 8
jb 0x14003649c
mov rsi, qword [rsi]
cmp rcx, qword [rbp + 0x188]
jne 0x1400364db
test rcx, rcx
je 0x1400364e6
movzx edx, word [rsi]
movzx r8d, word [rax]
cmp dx, r8w
jb 0x1400364db
sub rsi, rax
cmp dx, r8w
ja 0x1400364db
cmp rcx, 1
je 0x1400364e6
dec rcx
add rax, 2
movzx edx, word [rax + rsi]
movzx r8d, word [rax]
cmp dx, r8w
jae 0x1400364be
mov r15d, 0xffffffea
jmp 0x1400367a2
xor sil, sil
movdqa xmm0, xmmword [0x1401e87c0]
movdqu xmmword [rbp + 0x168], xmm0
mov word [rbp + 0x158], bx
movdqu xmmword [rbp - 0x48], xmm0
mov word [rbp - 0x58], bx
lea r9, str.IsCompressed
xor r8d, r8d
lea edx, [r8 + 0xc]
lea rcx, [rbp - 0x58]
call fcn.14001f490
nop
mov rcx, qword [rbp + 0x88]
mov qword [rsp + 0x70], rcx
test rcx, rcx
je 0x140036540
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140024b66.0]
nop
lea r8, [rbp + 0x158]
lea rdx, [rbp - 0x58]
lea rcx, [rsp + 0x70]
call fcn.1400358a0
mov r12d, eax
mov rdx, qword [rbp - 0x40]
cmp rdx, 8
jb 0x140036598
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140036593
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400369ae
call fcn.140148ec0
test r12d, r12d
js 0x1400365fc
lea r8, [rbp + 0x158]
cmp qword [rbp + 0x170], 8
cmovae r8, qword [rbp + 0x158]
cmp qword [rbp + 0x168], 1
jne 0x1400365f9
lea rax, [0x1401e5f78]
movzx ecx, word [r8]
mov edx, 0x31
cmp cx, dx
jb 0x1400365f9
sub r8, rax
cmp cx, dx
ja 0x1400365f9
cmp rdi, 1
je 0x1400366f5
dec rdi
add rax, 2
movzx ecx, word [rax + r8]
movzx edx, word [rax]
cmp cx, dx
jae 0x1400365d9
xor sil, sil
mov r12, qword [rsp + 0x78]
mov byte [r12 + 0x84], sil
xor eax, eax
mov qword [rbp + 0x120], rax
mov qword [rbp + 0x128], rax
lea rax, vtable.Utils::WriteableMemoryBufferFromUnicodeFileWithObfuscationWithCompression.0
mov qword [rbp + 0x100], rax
mov rdx, rbx
mov qword [rbp + 0x108], rbx
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x110], xmm0
movdqa xmm0, xmmword [0x1401e87c0]
movdqa xmmword [rbp + 0x130], xmm0
mov word [rbp + 0x120], bx
test r13, r13
je 0x140036675
mov r8, qword [rbp + 0xf0]
mov rdx, r14
lea rcx, [rbp + 0x108]
call fcn.140032660
mov rdx, qword [rbp + 0x108]
mov r10, qword [rbp + 0x110]
mov r8, r10
sub r8, rdx
test rdx, rdx
je 0x1400366bb
test r8, r8
je 0x1400366bb
mov rcx, rdx
mov r9, r8
nop dword [rax]
nop word [rax + rax]
imul eax, r8d, 0x10003
inc eax
mov r8d, eax
shr eax, 0x10
xor byte [rcx], al
lea rcx, [rcx + 1]
sub r9, 1
jne 0x1400366a0
test sil, sil
je 0x14003670b
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rsi, rax
lea rcx, [rbp + 0x100]
call fcn.1400356e0
movzx edi, al
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub eax, esi
mov dword [r12 + 0x80], eax
test dil, dil
jne 0x1400366fd
mov r15d, 0xffffffec
jmp 0x140036747
mov sil, 1
jmp 0x1400365fc
mov r10, qword [rbp + 0x110]
mov rdx, qword [rbp + 0x108]
sub r10, rdx
test rdx, rdx
je 0x140036741
cmp r10, 4
jbe 0x140036741
cmp byte [rdx], 0xff
jne 0x140036741
cmp byte [rdx + 1], 0xfe
jne 0x140036741
cmp byte [rdx + 2], 0
jne 0x140036730
cmp byte [rdx + 3], 0
je 0x140036741
mov r8d, r10d
add r8, rdx
mov rcx, qword [rbp - 0x80]
call fcn.140032660
jmp 0x140036747
mov r15d, 0xfffffff1
lea rcx, [rbp + 0x100]
call fcn.140035510
nop
mov rdx, qword [rbp + 0x170]
cmp rdx, 8
jb 0x1400367a2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x158]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140036795
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400369b4
call fcn.140148ec0
jmp 0x1400367a2
mov r15d, 0xffffffe9
mov rdx, qword [rbp + 0x190]
cmp rdx, 8
jb 0x1400367f0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x178]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400367e3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400369ba
call fcn.140148ec0
jmp 0x1400367f0
mov r15d, 0xfffffff0
mov rcx, qword [rbp + 0x88]
test rcx, rcx
je 0x14003680a
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140024b66.0]
nop
jmp 0x14003681a
mov r15d, 0xffffffeb
jmp 0x14003681a
mov r15d, 0xffffffe8
test r14, r14
je 0x140036856
mov rdx, qword [rbp + 0xf8]
sub rdx, r14
mov rax, r14
cmp rdx, 0x1000
jb 0x14003684e
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400369c0
mov rcx, r14
call fcn.140148ec0
mov rcx, qword [rbp + 0x80]
mov rdx, qword [rbp + 0xb8]
cmp rdx, 8
jb 0x1400368aa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003689e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400369c6
call fcn.140148ec0
mov rcx, qword [rbp + 0x80]
mov qword [rbp + 0xb0], rbx
mov qword [rbp + 0xb8], 7
mov word [rbp + 0xa0], bx
test rcx, rcx
je 0x1400368d6
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140024b66.0]
nop
jmp 0x1400368ff
mov r15d, 0xffffffe7
jmp 0x140036856
mov r15d, 0xffffffe6
jmp 0x14003685d
mov r15d, 0xffffffe5
jmp 0x14003685d
mov r15d, 0xffffffe4
mov rcx, qword [rbp + 0x90]
test rcx, rcx
je 0x140036919
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140024b66.0]
nop
jmp 0x140036921
mov r15d, 0xfffffff5
mov rdx, qword [rbp + 0xe0]
cmp rdx, 8
jb 0x140036963
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xc8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003695e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140036990
call fcn.140148ec0
mov eax, r15d
mov rcx, qword [rbp + 0x1b8]
xor rcx, rsp
call fcn.140149290
mov rbx, qword [rsp + 0x318]
add rsp, 0x2c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14016ae5c
nop
call fcn.14016ae5c
nop
call fcn.14016ae5c
nop
call fcn.14016ae5c
nop
call fcn.14016ae5c
nop
call fcn.14016ae5c
nop
call fcn.14016ae5c
nop
call fcn.14016ae5c
nop
call fcn.14016ae5c
nop
call fcn.14016ae5c
int3