Function at 0x1400530b0
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov dword [rax + 0x18], r8d
mov dword [rax + 0x10], edx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x57]
sub rsp, 0xd0
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
mov r12, r9
xor ebx, ebx
mov dword [rbp - 0x19], ebx
mov dword [rbp - 0x41], ebx
mov r14d, dword [rbp + 0x7f]
lea r13d, [r14 + 0x10]
mov rax, qword gs:[0x60]
mov qword [rbp - 0x11], rax
movups xmm3, xmmword [str.dCTxVWS_K__t_4ExCiL_IEnGL4___n_5____N]
movups xmmword [rsp + 0x30], xmm3
movdqa xmm7, xmmword [0x1400c2ed0]
mov r15d, dword [0x1400e1258]
movdqa xmm0, xmm3
psrldq xmm0, 0xf
movd eax, xmm0
test al, al
je 0x1400532f9
mov r8d, ebx
cmp r15d, 2
jl 0x1400532cb
movdqa xmm4, xmmword [0x1400d7b70]
movdqa xmm5, xmmword [0x1400d7b60]
movdqa xmm6, xmmword [0x1400c9560]
movdqa xmm2, xmmword [0x1400c2e60]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm6
movd eax, xmm3
movd xmm0, eax
xorps xmm2, xmm0
movd dword [rsp + 0x30], xmm2
movdqa xmm2, xmmword [0x1400c2e70]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm6
movd xmm0, dword [rbp - 0x7d]
xorps xmm2, xmm0
movd dword [rbp - 0x7d], xmm2
movdqa xmm3, xmmword [0x1400c2e80]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm3, xmm0
andps xmm3, xmm7
packuswb xmm3, xmm3
packuswb xmm3, xmm3
paddb xmm3, xmm6
movd xmm0, dword [rbp - 0x79]
xorps xmm3, xmm0
movd dword [rbp - 0x79], xmm3
movdqa xmm2, xmmword [0x1400c2e90]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm6
movd xmm0, dword [rbp - 0x75]
xorps xmm2, xmm0
movd dword [rbp - 0x75], xmm2
jmp 0x1400532f9
lea r9, [rsp + 0x30]
mov eax, 0x51eb851f
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
movzx eax, r8b
sub al, cl
add al, 0x36
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x10
jl 0x1400532d0
xorps xmm0, xmm0
movups xmmword [rbp - 0x61], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x51], xmm1
lea rax, [rsp + 0x30]
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rax + r8], bl
jne 0x140053317
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x61]
call fcn.140001620
nop
lea rsi, [rbp - 0x61]
cmp qword [rbp - 0x49], 0xf
cmova rsi, qword [rbp - 0x61]
movsd xmm0, qword [0x1400d7ab0]
movsd qword [rsp + 0x30], xmm0
movzx eax, word [0x1400d7ab8]
mov word [rbp - 0x79], ax
cmp byte [0x1400d7ab9], 0
je 0x140053388
mov byte [rsp + 0x30], 0x6e
xor byte [rbp - 0x80], 0x37
xor byte [rbp - 0x7f], 0x38
xor byte [rbp - 0x7e], 0x39
xor byte [rbp - 0x7d], 0x3a
xor byte [rbp - 0x7c], 0x3b
xor byte [rbp - 0x7b], 0x3c
xor byte [rbp - 0x7a], 0x3d
xor byte [rbp - 0x79], 0x3e
xor byte [rbp - 0x78], 0x3f
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x29], xmm1
lea rax, [rsp + 0x30]
mov r8, rdi
nop
inc r8
cmp byte [rax + r8], 0
jne 0x1400533a0
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x39]
call fcn.140001620
nop
lea rdx, [rbp - 0x39]
cmp qword [rbp - 0x21], 0xf
cmova rdx, qword [rbp - 0x39]
mov r8, rsi
lea rcx, [0x1400e14d8]
call fcn.140050b40
mov rsi, rax
mov rdx, qword [rbp - 0x21]
cmp rdx, 0xf
jbe 0x140053417
inc rdx
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140053412
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140053412
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140059504
movdqa xmm0, xmmword [0x1400c2e50]
movdqu xmmword [rbp - 0x29], xmm0
mov byte [rbp - 0x39], 0
mov rdx, qword [rbp - 0x49]
cmp rdx, 0xf
jbe 0x14005346e
inc rdx
mov rcx, qword [rbp - 0x61]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140053461
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140053461
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140059504
movdqa xmm0, xmmword [0x1400c2e50]
movdqu xmmword [rbp - 0x51], xmm0
mov byte [rbp - 0x61], 0
test rsi, rsi
je 0x140053bb8
mov r8d, r13d
xor edx, edx
mov rcx, qword [rbp - 0x11]
mov rcx, qword [rcx + 0x30]
call rsi
mov rsi, rax
test rax, rax
je 0x140053bb3
mov eax, dword [rbp + 0x67]
mov dword [rsi], eax
mov eax, dword [rbp + 0x6f]
mov dword [rsi + 8], eax
mov dword [rsi + 0xc], r14d
mov dword [rsi + 4], 1
movups xmm6, xmmword [0x1400d7ad0]
movups xmmword [rsp + 0x30], xmm6
movsd xmm0, qword [0x1400d7ae0]
movsd qword [rbp - 0x71], xmm0
movzx eax, byte [0x1400d7ae8]
mov byte [rbp - 0x69], al
mov r8d, ebx
cmp r15d, 2
jl 0x140053747
movdqa xmm4, xmmword [0x1400d7b70]
movdqa xmm5, xmmword [0x1400d7b60]
movdqa xmm3, xmmword [0x1400c2e60]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm3, xmm0
andps xmm3, xmm7
packuswb xmm3, xmm3
packuswb xmm3, xmm3
mov ecx, dword [0x1400c9560]
movd xmm0, ecx
paddb xmm3, xmm0
movd eax, xmm6
movd xmm0, eax
xorps xmm3, xmm0
movd dword [rsp + 0x30], xmm3
movdqa xmm2, xmmword [0x1400c2e70]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, ecx
paddb xmm2, xmm0
movd xmm1, dword [rbp - 0x7d]
xorps xmm2, xmm1
movd dword [rbp - 0x7d], xmm2
movdqa xmm3, xmmword [0x1400c2e80]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm3, xmm0
andps xmm3, xmm7
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd xmm0, ecx
paddb xmm3, xmm0
movd xmm1, dword [rbp - 0x79]
xorps xmm3, xmm1
movd dword [rbp - 0x79], xmm3
movdqa xmm2, xmmword [0x1400c2e90]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, ecx
paddb xmm2, xmm0
movd xmm1, dword [rbp - 0x75]
xorps xmm2, xmm1
movd dword [rbp - 0x75], xmm2
movdqa xmm3, xmmword [0x1400c2ea0]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm3, xmm0
andps xmm3, xmm7
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd xmm0, ecx
paddb xmm3, xmm0
movd xmm1, dword [rbp - 0x71]
xorps xmm3, xmm1
movd dword [rbp - 0x71], xmm3
movdqa xmm2, xmmword [0x1400c2eb0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, ecx
paddb xmm2, xmm0
movd xmm1, dword [rbp - 0x6d]
xorps xmm2, xmm1
movd dword [rbp - 0x6d], xmm2
mov r8d, 0x18
mov eax, r8d
lea r9, [rsp + 0x30]
add r9, rax
nop dword [rax]
nop word [rax + rax]
mov eax, 0x51eb851f
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x32
movzx eax, r8b
sub al, cl
add al, 0x36
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x19
jl 0x140053760
xorps xmm0, xmm0
movups xmmword [rbp - 0x61], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x51], xmm1
lea rax, [rsp + 0x30]
mov r8, rdi
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400537b0
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x61]
call fcn.140001620
nop
lea rdx, [rbp - 0x61]
cmp qword [rbp - 0x49], 0xf
cmova rdx, qword [rbp - 0x61]
lea rax, [rbp - 0x19]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r13d
mov r9, rsi
mov r8d, 0x4c
lea rcx, [0x1400e14c8]
call fcn.14004d7a0
mov r14d, eax
mov rdx, qword [rbp - 0x49]
cmp rdx, 0xf
jbe 0x14005383b
inc rdx
mov rcx, qword [rbp - 0x61]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140053836
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140053836
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140059504
movdqa xmm0, xmmword [0x1400c2e50]
movdqu xmmword [rbp - 0x51], xmm0
mov byte [rbp - 0x61], 0
lea eax, [r14 - 0x80000000]
test eax, eax
js 0x140053860
cmp r14d, 0xc0000023
jne 0x140053866
mov eax, dword [rsi + 0xc]
mov dword [rbp - 0x41], eax
test r14d, r14d
js 0x140053880
test r12, r12
je 0x140053880
mov r8d, dword [rsi + 0xc]
lea rdx, [rsi + 0x10]
mov rcx, r12
call sub.VCRUNTIME140.dll_memcpy
movsd xmm0, qword [0x1400d7b00]
movsd qword [rsp + 0x30], xmm0
mov ecx, dword [0x1400d7b08]
mov dword [rbp - 0x79], ecx
cmp byte [0x1400d7b0b], 0
je 0x140053a25
cmp r15d, 2
jl 0x1400539ec
movdqa xmm4, xmmword [0x1400d7b70]
movdqa xmm5, xmmword [0x1400d7b60]
movdqa xmm3, xmmword [0x1400c2e60]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm3, xmm0
andps xmm3, xmm7
packuswb xmm3, xmm3
packuswb xmm3, xmm3
mov eax, dword [0x1400c9560]
movd xmm0, eax
paddb xmm3, xmm0
movd xmm0, dword [0x1400d7b00]
xorps xmm3, xmm0
movd dword [rsp + 0x30], xmm3
movdqa xmm2, xmmword [0x1400c2e70]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, eax
paddb xmm2, xmm0
movd xmm1, dword [rbp - 0x7d]
xorps xmm2, xmm1
movd dword [rbp - 0x7d], xmm2
movdqa xmm3, xmmword [0x1400c2e80]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm3, xmm0
andps xmm3, xmm7
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd xmm0, eax
paddb xmm3, xmm0
movd xmm1, ecx
xorps xmm3, xmm1
movd dword [rbp - 0x79], xmm3
jmp 0x140053a25
lea r8, [rsp + 0x30]
nop dword [rax]
nop word [rax + rax]
mov eax, 0x51eb851f
mul ebx
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
movzx eax, bl
sub al, cl
add al, 0x36
xor byte [r8], al
inc ebx
lea r8, [r8 + 1]
cmp ebx, 0xc
jl 0x140053a00
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x29], xmm1
lea rax, [rsp + 0x30]
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140053a40
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x39]
call fcn.140001620
nop
lea rbx, [rbp - 0x39]
cmp qword [rbp - 0x21], 0xf
cmova rbx, qword [rbp - 0x39]
movsd xmm0, qword [0x1400d7af0]
movsd qword [rsp + 0x30], xmm0
movzx eax, word [0x1400d7af8]
mov word [rbp - 0x79], ax
cmp byte [0x1400d7af9], 0
je 0x140053ab2
mov byte [rsp + 0x30], 0x6e
xor byte [rbp - 0x80], 0x37
xor byte [rbp - 0x7f], 0x38
xor byte [rbp - 0x7e], 0x39
xor byte [rbp - 0x7d], 0x3a
xor byte [rbp - 0x7c], 0x3b
xor byte [rbp - 0x7b], 0x3c
xor byte [rbp - 0x7a], 0x3d
xor byte [rbp - 0x79], 0x3e
xor byte [rbp - 0x78], 0x3f
xorps xmm0, xmm0
movups xmmword [rbp - 0x61], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x51], xmm1
lea rax, [rsp + 0x30]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140053ac6
mov r8, rdi
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x61]
call fcn.140001620
nop
lea rdx, [rbp - 0x61]
cmp qword [rbp - 0x49], 0xf
cmova rdx, qword [rbp - 0x61]
mov r8, rbx
lea rcx, [0x1400e14d8]
call fcn.140050b40
mov rbx, rax
mov rdx, qword [rbp - 0x49]
cmp rdx, 0xf
jbe 0x140053b3f
inc rdx
mov rcx, qword [rbp - 0x61]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140053b3a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140053b3a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140059504
movdqa xmm0, xmmword [0x1400c2e50]
movdqu xmmword [rbp - 0x51], xmm0
mov byte [rbp - 0x61], 0
mov rdx, qword [rbp - 0x21]
cmp rdx, 0xf
jbe 0x140053b96
inc rdx
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140053b89
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140053b89
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140059504
movdqa xmm0, xmmword [0x1400c2e50]
movdqu xmmword [rbp - 0x29], xmm0
mov byte [rbp - 0x39], 0
test rbx, rbx
je 0x140053bb8
mov r8, rsi
xor edx, edx
mov rax, qword [rbp - 0x11]
mov rcx, qword [rax + 0x30]
call rbx
mov eax, dword [rbp - 0x41]
jmp 0x140053bba
xor eax, eax
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret