Function at 0x180064460
Capabilities:
Access peb ldr_data
Encode data using xor
Get process filename

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xe0
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
movaps xmmword [rax - 0x78], xmm10
movaps xmmword [rax - 0x88], xmm11
movaps xmmword [rsp + 0x70], xmm12
movaps xmmword [rsp + 0x60], xmm13
movaps xmmword [rsp + 0x50], xmm14
mov rax, qword [0x18011f040]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rax, qword gs:[0x60]
xor esi, esi
mov rbp, rcx
mov r15, qword [rax + 0x10]
movsxd rax, dword [r15 + 0x3c]
mov r12d, dword [rax + r15 + 0x50]
test r12d, r12d
jle 0x1800648bb
mov r13d, dword [0x18011f090]
lea rdi, [r15 + 3]
movdqa xmm9, xmmword [0x18010ac80]
movdqa xmm10, xmmword [0x18010ac60]
movdqa xmm11, xmmword [0x18010ac50]
movdqa xmm12, xmmword [0x18010ac40]
movdqa xmm13, xmmword [0x18010ac30]
movdqa xmm14, xmmword [0x18010ac10]
movdqa xmm7, xmmword [0x18010ade0]
movdqa xmm8, xmmword [0x18010acd0]
movdqa xmm6, xmmword [0x18010b0e0]
nop dword [rax]
movzx eax, byte [rdi - 3]
sub al, 0x48
test al, 0xfb
jne 0x1800648ad
cmp byte [rdi - 2], 0x8d
jne 0x1800648ad
mov eax, dword [rdi]
add eax, 7
movsxd r14, esi
movsxd rbx, eax
mov rax, qword gs:[0x60]
add rbx, r14
add rbx, r15
mov rdx, qword [rax + 0x10]
cmp rbx, rdx
jbe 0x1800648ad
movsxd rax, dword [rdx + 0x3c]
mov ecx, dword [rax + rdx + 0x50]
add rcx, rdx
cmp rbx, rcx
jae 0x1800648ad
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.180029f60
cmp word [rbp + 0x2e], 0
je 0x180064842
xor ecx, ecx
cmp r13d, 2
jl 0x18006480b
movdqa xmm2, xmm14
movdqa xmm0, xmm14
punpckldq xmm2, xmm14
pmuldq xmm2, xmm6
punpckhdq xmm0, xmm14
pmuldq xmm0, xmm6
shufps xmm2, xmm0, 0xdd
movdqa xmm0, xmm14
psrad xmm2, 4
movdqa xmm1, xmm2
psrld xmm1, 0x1f
paddd xmm1, xmm2
pmulld xmm1, xmm8
psubd xmm0, xmm1
pshufhw xmm0, xmm0, 0xd8
pshuflw xmm1, xmm0, 0xd8
movq xmm0, qword [rbp]
pshufd xmm2, xmm1, 0xd8
paddw xmm2, xmm7
xorps xmm2, xmm0
movdqa xmm0, xmm13
movq qword [rbp], xmm2
movdqa xmm2, xmm13
punpckldq xmm2, xmm13
pmuldq xmm2, xmm6
punpckhdq xmm0, xmm13
pmuldq xmm0, xmm6
shufps xmm2, xmm0, 0xdd
movdqa xmm0, xmm13
psrad xmm2, 4
movdqa xmm1, xmm2
psrld xmm1, 0x1f
paddd xmm1, xmm2
pmulld xmm1, xmm8
psubd xmm0, xmm1
pshufhw xmm0, xmm0, 0xd8
pshuflw xmm1, xmm0, 0xd8
movq xmm0, qword [rbp + 8]
pshufd xmm2, xmm1, 0xd8
paddw xmm2, xmm7
xorps xmm2, xmm0
movdqa xmm0, xmm12
movq qword [rbp + 8], xmm2
movdqa xmm2, xmm12
punpckldq xmm2, xmm12
pmuldq xmm2, xmm6
punpckhdq xmm0, xmm12
pmuldq xmm0, xmm6
shufps xmm2, xmm0, 0xdd
movdqa xmm0, xmm12
psrad xmm2, 4
movdqa xmm1, xmm2
psrld xmm1, 0x1f
paddd xmm1, xmm2
pmulld xmm1, xmm8
psubd xmm0, xmm1
pshufhw xmm0, xmm0, 0xd8
pshuflw xmm1, xmm0, 0xd8
movq xmm0, qword [rbp + 0x10]
pshufd xmm2, xmm1, 0xd8
paddw xmm2, xmm7
xorps xmm2, xmm0
movdqa xmm0, xmm11
movq qword [rbp + 0x10], xmm2
movdqa xmm2, xmm11
punpckldq xmm2, xmm11
punpckhdq xmm0, xmm11
pmuldq xmm2, xmm6
pmuldq xmm0, xmm6
shufps xmm2, xmm0, 0xdd
movdqa xmm0, xmm11
psrad xmm2, 4
movdqa xmm1, xmm2
psrld xmm1, 0x1f
paddd xmm1, xmm2
pmulld xmm1, xmm8
psubd xmm0, xmm1
pshufhw xmm0, xmm0, 0xd8
pshuflw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
paddw xmm2, xmm7
movq xmm0, qword [rbp + 0x18]
xorps xmm2, xmm0
movdqa xmm0, xmm10
movq qword [rbp + 0x18], xmm2
movdqa xmm2, xmm10
punpckldq xmm2, xmm10
pmuldq xmm2, xmm6
punpckhdq xmm0, xmm10
pmuldq xmm0, xmm6
shufps xmm2, xmm0, 0xdd
movdqa xmm0, xmm10
psrad xmm2, 4
movdqa xmm1, xmm2
psrld xmm1, 0x1f
paddd xmm1, xmm2
pmulld xmm1, xmm8
psubd xmm0, xmm1
pshufhw xmm0, xmm0, 0xd8
pshuflw xmm1, xmm0, 0xd8
movq xmm0, qword [rbp + 0x20]
pshufd xmm2, xmm1, 0xd8
paddw xmm2, xmm7
xorps xmm2, xmm0
movdqa xmm0, xmm9
movq qword [rbp + 0x20], xmm2
movdqa xmm2, xmm9
punpckldq xmm2, xmm9
punpckhdq xmm0, xmm9
pmuldq xmm2, xmm6
pmuldq xmm0, xmm6
shufps xmm2, xmm0, 0xdd
movdqa xmm0, xmm9
psrad xmm2, 4
movdqa xmm1, xmm2
psrld xmm1, 0x1f
paddd xmm1, xmm2
pmulld xmm1, xmm8
psubd xmm0, xmm1
pshufhw xmm0, xmm0, 0xd8
pshuflw xmm1, xmm0, 0xd8
movq xmm0, qword [rbp + 0x28]
pshufd xmm2, xmm1, 0xd8
paddw xmm2, xmm7
xorps xmm2, xmm0
movq qword [rbp + 0x28], xmm2
jmp 0x180064842
mov r8, rbp
nop
mov eax, 0x3521cfb3
lea r8, [r8 + 2]
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movzx eax, ax
imul edx, eax, 0x35
movzx eax, cx
inc ecx
sub ax, dx
add ax, 0x36
xor word [r8 - 2], ax
cmp ecx, 0x18
jl 0x180064810
mov rax, rbp
sub rbx, rbp
nop dword [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + rbx]
sub edx, ecx
jne 0x180064863
add rax, 2
test ecx, ecx
jne 0x180064850
test edx, edx
mov rdx, qword [rsp + 0x38]
je 0x180064919
cmp rdx, 7
jbe 0x1800648ad
mov rcx, qword [rsp + 0x20]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800648a8
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18006495e
call fcn.1800c3c28
inc esi
inc rdi
cmp esi, r12d
jl 0x180064540
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1800c3890
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
movaps xmm12, xmmword [r11 - 0x70]
movaps xmm13, xmmword [r11 - 0x80]
movaps xmm14, xmmword [rsp + 0x50]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rbx, [r14 + r15]
cmp rdx, 7
jbe 0x180064956
mov rcx, qword [rsp + 0x20]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180064951
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18006495e
call fcn.1800c3c28
mov rax, rbx
jmp 0x1800648bd
call fcn.1800c99b4
int3