Function at 0x140053990
Capabilities:
Access peb ldr_data
Delete file
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x1400af040]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov rdi, rcx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140053a79
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140053a56
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140053a56
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r11 + r9*4]
mov ecx, dword [rdx + r10]
add rcx, r10
mov r8d, 0xba079dce
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140053a51
nop
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x140053a30
cmp r8d, 0x49e0c384
je 0x140053a5b
test r9d, r9d
jne 0x140053a10
mov rax, qword [rax]
jmp 0x1400539e0
mov r8d, dword [rbx + 0x1c]
add r8, r10
mov edx, dword [rbx + 0x24]
add rdx, r10
movzx edx, word [rdx + r9*2]
mov eax, dword [r8 + rdx*4]
add rax, r10
mov rcx, rdi
call rax
lea rcx, [rsp + 0x30]
call fcn.1400526d0
nop
mov rcx, rax
call fcn.14005e730
movzx ebx, al
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x140053ad4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140053acf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140053acf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007fc40
test bl, bl
jne 0x140053adf
xor al, al
jmp 0x140053ca5
lea rcx, [rsp + 0x50]
call fcn.1400528f0
nop
xor edx, edx
mov r8d, 0x108
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 7
cmova rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x70]
call fcn.140057c80
nop
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
movsxd rbx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
movsxd r14, eax
imul r14, rbx
movabs rax, 0x431bde82d7b634db
imul r14
sar rdx, 0x13
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0x1e8480
sub r14, rax
add r14d, 0x8af0
movsxd rsi, r14d
mov rcx, rsi
call fcn.14007ffc4
mov rdi, rax
xor ebx, ebx
test r14d, r14d
je 0x140053ba3
nop
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x80808081
imul r8d
add edx, r8d
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xff
sub r8d, ecx
mov byte [rbx + rdi], r8b
inc rbx
cmp rbx, rsi
jb 0x140053b70
movsxd r8, r14d
mov rdx, rdi
lea rcx, [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator__void_const___ptr64]
lea rcx, [rsp + 0x78]
call fcn.1400581a0
test rax, rax
jne 0x140053bf1
mov rax, qword [rsp + 0x70]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x70]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov rcx, rdi
call fcn.14007fc40
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 7
cmova rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wremove]
nop
test eax, eax
sete bl
mov rax, qword [rsp + 0x70]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x70], rax
mov rax, qword [rsp + 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x6c], edx
lea rcx, [rsp + 0x78]
call fcn.140057c10
lea rcx, [rbp - 0x80]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x18]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x140053ca2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140053c9d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140053c9d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007fc40
movzx eax, bl
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.14007f7f0
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret