Function at 0x5bb700
Capabilities:
Access peb ldr_data
Run powershell expression

Disassembly:
lea r12, [rsp - 0x58]
cmp r12, qword [r14 + 0x10]
jbe 0x5bba26
push rbp
mov rbp, rsp
sub rsp, 0xd0
mov qword [rsp + 0x118], rbx
mov qword [rsp + 0x130], rsi
cmp byte [0x009d9d04], 0
je 0x5bb995
mov qword [rsp + 0x120], rcx
mov qword [rsp + 0x118], rbx
mov qword [rsp + 0x128], rdi
movups xmmword [rsp + 0x80], xmm15
movups xmmword [rsp + 0x90], xmm15
movups xmmword [rsp + 0xa0], xmm15
movups xmmword [rsp + 0xb0], xmm15
test byte [rax], al
mov rbx, rax
mov rcx, rsi
mov rdi, r8
mov rsi, r9
lea rax, [rsp + 0x80]
call fcn.005bb340
mov rcx, qword [rsp + 0xe8]
lea rdx, [rcx - 0x10]
mov r8, qword [rsp + 0xf0]
cmp r8, rdx
jb 0x5bba18
mov qword [rsp + 0x70], rdx
mov rax, qword [rsp + 0x120]
lea rbx, [rcx + rax]
lea rbx, [rbx - 0x10]
mov qword [rsp + 0x68], rbx
nop
mov rsi, qword [rsp + 0x128]
cmp rsi, rbx
jl 0x5bb7e3
jb 0x5bba0d
mov rdi, qword [rsp + 0x118]
jmp 0x5bb822
mov rcx, rax
mov rdi, qword [rsp + 0x118]
lea rax, [0x006a5ea0]
call fcn.0044bac0
mov rcx, qword [rsp + 0xe8]
mov rdx, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x68]
mov r8, qword [rsp + 0xf0]
mov rsi, rbx
mov rdi, rax
mov rax, qword [rsp + 0x120]
cmp rax, rbx
ja 0x5bba05
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0xc8], rdi
mov r9, rsi
sub rsi, rax
mov r10, rsi
neg rsi
sar rsi, 0x3f
and rax, rsi
lea rsi, [rdi + rax]
cmp rcx, 0x10
jne 0x5bb85f
mov r11, qword [rsp + 0xe0]
jmp 0x5bb8a9
nop
jne 0x5bb86c
mov r11, qword [rsp + 0xe0]
jmp 0x5bb8a9
mov r11, qword [rsp + 0xe0]
cmp r11, rsi
je 0x5bb8a9
mov r12, rsi
lea r13, [rcx + r11]
lea r13, [r13 - 0x11]
nop
cmp r13, rsi
jb 0x5bb8a6
mov rsi, r11
lea r13, [rcx + r12]
lea r13, [r13 - 0x11]
cmp r13, r11
jae 0x5bb9f0
mov r11, rsi
mov rsi, r12
jmp 0x5bb8a9
mov rsi, r12
mov qword [rsp + 0xc0], rsi
mov qword [rsp], rsi
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], r10
lea rax, [rsp + 0x80]
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], 0x10
mov qword [rsp + 0x28], 0x10
mov qword [rsp + 0x30], r11
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], r8
mov rax, qword [rsp + 0xf8]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x108]
mov qword [rsp + 0x58], rax
call fcn.005bc780
xorps xmm15, xmm15
mov r14, qword [0x009d9398]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp byte [rsp + 0x60], 0
jne 0x5bb976
mov rdx, qword [rsp + 0xe8]
nop word [rax + rax]
cmp rdx, 0x10
je 0x5bb958
mov rax, qword [rsp + 0xc0]
mov rbx, qword [rsp + 0x70]
call fcn.00467e60
mov rdi, qword [0x0096cd30]
mov rsi, qword [0x0096cd38]
xor eax, eax
xor ebx, ebx
mov rcx, rbx
add rsp, 0xd0
pop rbp
ret
mov rax, qword [rsp + 0xc8]
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x78]
xor edi, edi
xor esi, esi
add rsp, 0xd0
pop rbp
ret
mov rdx, qword [rsp + 0xe0]
mov qword [rsp], rdx
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 8], rdx
mov rdx, qword [rsp + 0xf0]
mov qword [rsp + 0x10], rdx
mov rdx, qword [rsp + 0xf8]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x100]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsp + 0x108]
mov qword [rsp + 0x28], rdx
call fcn.005bc080
add rsp, 0xd0
pop rbp
ret
lea rax, [0x006a5b60]
lea rbx, [0x007895a0]
nop
call fcn.00436ea0
mov rcx, rbx
call fcn.00467820
mov rcx, rbx
mov rdx, rsi
call fcn.004677e0
mov rcx, rdx
mov rdx, r8
nop
call fcn.004677e0
nop
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
call fcn.004654a0
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov r8, qword [rsp + 0x60]
mov r9, qword [rsp + 0x68]
jmp fcn.005bb700