Function at 0x140004d80
Capabilities:
Connect pipe
Create pipe
Encode data using xor
Read file on windows
Write file on windows
Write pipe

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x410]
sub rsp, 0x510
mov rax, qword [0x1400d8180]
xor rax, rsp
mov qword [rbp + 0x400], rax
lea rcx, str.nidavellir::build::dll_auth_check
call qword [sym.imp.VMProtectSDK64.dll_VMProtectBegin]
movdqa xmm1, xmmword [0x1400bd310]
movdqu xmmword [rbp - 0x80], xmm1
mov dl, 0x26
movzx r8d, dl
mov r9b, 0x23
mov r10b, 0x38
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rbp - 0x7f], al
xor byte [rbp - 0x7e], cl
xor byte [rbp - 0x7d], cl
xor byte [rbp - 0x7c], cl
xor byte [rbp - 0x7b], cl
xor byte [rbp - 0x7a], cl
xor byte [rbp - 0x79], cl
xor byte [rbp - 0x78], cl
xor byte [rbp - 0x77], cl
xor byte [rbp - 0x76], cl
xor byte [rbp - 0x75], cl
xor byte [rbp - 0x74], cl
xor byte [rbp - 0x73], cl
xor byte [rbp - 0x72], cl
xor byte [rbp - 0x71], cl
xor dl, cl
mov byte [rbp - 0x70], dl
xor r8b, cl
mov byte [rbp - 0x6f], r8b
xor r9b, cl
mov byte [rbp - 0x6e], r9b
xor r10b, cl
mov byte [rbp - 0x6d], r10b
mov byte [rbp - 0x6c], 0
mov dword [rbp - 0x68], 0x18
xor r14d, r14d
mov dword [rbp - 0x58], r14d
movdqa xmm1, xmmword [0x1400bd2a0]
movdqu xmmword [rsp + 0x70], xmm1
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x71], al
xor byte [rsp + 0x72], cl
xor byte [rsp + 0x73], cl
xor byte [rsp + 0x74], cl
xor byte [rsp + 0x75], cl
xor byte [rsp + 0x76], cl
xor byte [rsp + 0x77], cl
xor byte [rsp + 0x78], cl
xor byte [rsp + 0x79], cl
xor byte [rsp + 0x7a], cl
xor byte [rsp + 0x7b], cl
xor byte [rsp + 0x7c], cl
xor byte [rsp + 0x7d], cl
xor byte [rsp + 0x7e], cl
mov byte [rsp + 0x7f], r14b
xor r9d, r9d
lea r8, [rbp - 0x60]
lea edx, [r14 + 1]
lea rcx, [rsp + 0x71]
call qword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorA]
test eax, eax
je 0x140005407
lea rax, [rbp - 0x68]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 0x400
lea r9d, [r14 + 1]
xor r8d, r8d
lea edx, [r14 + 3]
lea rcx, [rbp - 0x7f]
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov rbx, rax
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp rbx, 0xffffffffffffffff
je 0x140005407
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
je 0x1400053fe
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0x10]
mov r8d, 0x400
lea rdx, [rbp]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400053fe
movdqa xmm1, xmmword [0x1400bd4d0]
movdqu xmmword [rsp + 0x48], xmm1
movdqa xmm2, xmmword [0x1400bd2b0]
movdqu xmmword [rsp + 0x58], xmm2
mov dl, 0x3a
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x49], al
xor byte [rsp + 0x4a], cl
xor byte [rsp + 0x4b], cl
xor byte [rsp + 0x4c], cl
xor byte [rsp + 0x4d], cl
xor byte [rsp + 0x4e], cl
xor byte [rsp + 0x4f], cl
xor byte [rsp + 0x50], cl
xor byte [rsp + 0x51], cl
xor byte [rsp + 0x52], cl
xor byte [rsp + 0x53], cl
xor byte [rsp + 0x54], cl
xor byte [rsp + 0x55], cl
xor byte [rsp + 0x56], cl
xor byte [rsp + 0x57], cl
movd eax, xmm2
xor al, cl
mov byte [rsp + 0x58], al
xor byte [rsp + 0x59], cl
xor byte [rsp + 0x5a], cl
xor byte [rsp + 0x5b], cl
xor byte [rsp + 0x5c], cl
xor byte [rsp + 0x5d], cl
xor byte [rsp + 0x5e], cl
xor byte [rsp + 0x5f], cl
xor byte [rsp + 0x60], cl
xor byte [rsp + 0x61], cl
xor byte [rsp + 0x62], cl
xor byte [rsp + 0x63], cl
xor byte [rsp + 0x64], cl
xor byte [rsp + 0x65], cl
xor byte [rsp + 0x66], cl
xor byte [rsp + 0x67], cl
xor dl, cl
mov byte [rsp + 0x68], dl
mov byte [rsp + 0x69], r14b
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x38], r14
lea rax, [rsp + 0x49]
mov rsi, 0xffffffffffffffff
mov r8, rsi
inc r8
cmp byte [rax + r8], r14b
jne 0x140005020
lea rdx, [rsp + 0x49]
lea rcx, [rbp - 0x50]
call fcn.140003090
nop
mov r8d, dword [rbp - 0x40]
inc r8d
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0xf
cmova rdx, qword [rbp - 0x50]
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0xc]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
test eax, eax
jne 0x140005079
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.VMProtectSDK64.dll_VMProtectEnd]
xor bl, bl
jmp 0x1400053bb
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp - 0x50]
mov r10, qword [rbp - 0x50]
mov r9, qword [rbp - 0x38]
cmp r9, 0xf
cmova rdx, r10
lea rcx, [rbp - 0x50]
cmova rcx, r10
mov r8, qword [rbp - 0x40]
add r8, rcx
mov rcx, r14
mov rax, r8
sub rax, rdx
cmp rdx, r8
cmova rax, r14
test rax, rax
je 0x140005127
cmp rax, 0x40
jb 0x140005127
and rax, 0xffffffffffffffc0
movdqa xmm2, xmmword [0x1400bd520]
nop dword [rax]
movdqu xmm0, xmmword [rdx]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rdx], xmm1
movdqu xmm0, xmmword [rdx + 0x10]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rdx + 0x10], xmm1
movdqu xmm0, xmmword [rdx + 0x20]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rdx + 0x20], xmm1
movdqu xmm0, xmmword [rdx + 0x30]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rdx + 0x30], xmm1
add rdx, 0x40
add rcx, 0x40
cmp rcx, rax
jne 0x1400050d0
mov r9, qword [rbp - 0x38]
mov r10, qword [rbp - 0x50]
cmp rdx, r8
je 0x140005143
nop dword [rax]
xor byte [rdx], 0x8c
inc rdx
cmp rdx, r8
jne 0x140005130
mov r9, qword [rbp - 0x38]
mov r10, qword [rbp - 0x50]
mov word [rsp + 0x40], 0x24
mov byte [rsp + 0x41], 0
lea rax, [rsp + 0x41]
mov rdi, rsi
inc rdi
cmp byte [rax + rdi], 0
jne 0x140005157
cmp rdi, r9
ja 0x14000518b
lea rbx, [rbp - 0x50]
cmp r9, 0xf
cmova rbx, r10
mov qword [rbp - 0x40], rdi
mov r8, rdi
lea rdx, [rsp + 0x41]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rdi], 0
jmp 0x14000519f
lea r9, [rsp + 0x41]
xor r8d, r8d
mov rdx, rdi
lea rcx, [rbp - 0x50]
call fcn.140001c30
mov rdi, qword [rbp - 0x40]
lea rbx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0xf
cmova rbx, qword [rbp - 0x50]
lea rcx, str.nidavellir::decryption::secure_erase_memory
call qword [sym.imp.VMProtectSDK64.dll_VMProtectBeginUltra]
mov rax, r14
test rdi, rdi
je 0x1400051dc
nop word [rax + rax]
mov byte [rax + rbx], 0
inc rax
cmp rax, rdi
jb 0x1400051d0
call qword [sym.imp.VMProtectSDK64.dll_VMProtectEnd]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], r14
lea rax, [rbp - 0x7f]
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140005200
lea rdx, [rbp - 0x7f]
lea rcx, [rbp - 0x30]
call fcn.140003090
nop
lea rdx, [rbp - 0x30]
mov r10, qword [rbp - 0x30]
mov r9, qword [rbp - 0x18]
cmp r9, 0xf
cmova rdx, r10
lea rcx, [rbp - 0x30]
cmova rcx, r10
mov r8, qword [rbp - 0x20]
add r8, rcx
mov rcx, r14
mov rax, r8
sub rax, rdx
cmp rdx, r8
cmova rax, r14
test rax, rax
je 0x1400052b7
cmp rax, 0x40
jb 0x1400052b7
and rax, 0xffffffffffffffc0
movdqa xmm1, xmmword [0x1400bd520]
nop dword [rax]
nop word [rax + rax]
movdqu xmm0, xmmword [rdx]
xorps xmm0, xmm1
movdqu xmmword [rdx], xmm0
movdqu xmm0, xmmword [rdx + 0x10]
xorps xmm0, xmm1
movdqu xmmword [rdx + 0x10], xmm0
movdqu xmm0, xmmword [rdx + 0x20]
xorps xmm0, xmm1
movdqu xmmword [rdx + 0x20], xmm0
movdqu xmm0, xmmword [rdx + 0x30]
xorps xmm0, xmm1
movdqu xmmword [rdx + 0x30], xmm0
add rdx, 0x40
add rcx, 0x40
cmp rcx, rax
jne 0x140005270
mov r9, qword [rbp - 0x18]
mov r10, qword [rbp - 0x30]
cmp rdx, r8
je 0x1400052d3
nop dword [rax]
xor byte [rdx], 0x8c
inc rdx
cmp rdx, r8
jne 0x1400052c0
mov r9, qword [rbp - 0x18]
mov r10, qword [rbp - 0x30]
mov word [rsp + 0x44], 0x24
mov byte [rsp + 0x45], 0
lea rax, [rsp + 0x45]
inc rsi
cmp byte [rax + rsi], 0
jne 0x1400052e4
cmp rsi, r9
ja 0x140005318
lea rbx, [rbp - 0x30]
cmp r9, 0xf
cmova rbx, r10
mov qword [rbp - 0x20], rsi
mov r8, rsi
lea rdx, [rsp + 0x45]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rsi], 0
jmp 0x14000532c
lea r9, [rsp + 0x45]
xor r8d, r8d
mov rdx, rsi
lea rcx, [rbp - 0x30]
call fcn.140001c30
mov rdi, qword [rbp - 0x20]
lea rbx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0xf
cmova rbx, qword [rbp - 0x30]
lea rcx, str.nidavellir::decryption::secure_erase_memory
call qword [sym.imp.VMProtectSDK64.dll_VMProtectBeginUltra]
mov rax, r14
test rdi, rdi
je 0x14000535f
mov byte [rax + rbx], 0
inc rax
cmp rax, rdi
jb 0x140005353
call qword [sym.imp.VMProtectSDK64.dll_VMProtectEnd]
call qword [sym.imp.VMProtectSDK64.dll_VMProtectEnd]
mov bl, 1
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x1400053ab
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400053a6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400053a6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a874c
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x30], 0
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x1400053f9
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400053f4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400053f4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a874c
movzx eax, bl
jmp 0x14000540f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.VMProtectSDK64.dll_VMProtectEnd]
xor al, al
mov rcx, qword [rbp + 0x400]
xor rcx, rsp
call fcn.1400a86f0
lea r11, [rsp + 0x510]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret