Function at 0x1400553a0
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Create directory
Encrypt data using salsa20 or chacha
Get common file path
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
push rbp
push rbx
push rdi
push r12
push r14
lea rbp, [r11 - 0x308]
sub rsp, 0x3e0
mov rax, qword [0x1401b5030]
xor rax, rsp
mov qword [rbp + 0x2d0], rax
mov rax, qword gs:[0x60]
mov r12, rdx
xor edi, edi
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], r15
mov rbx, rcx
mov rdx, qword [rax + 0x18]
mov r14, qword [rdx + 0x10]
cmp qword [r14 + 0x60], rdi
je 0x14005549c
nop dword [rax]
nop dword [rax + rax]
mov r11, qword [r14 + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov ecx, dword [rax + r11 + 0x88]
test ecx, ecx
je 0x14005548f
mov r8d, dword [r11 + rcx + 0x20]
lea rax, [r11 + rcx]
mov r10d, dword [rax + 0x24]
add r8, r11
mov r15d, dword [rax + 0x1c]
add r10, r11
mov esi, dword [rax + 0x18]
add r15, r11
mov r9, rdi
test rsi, rsi
je 0x14005548f
nop dword [rax]
mov edx, dword [r8]
mov eax, 0x8620a707
add rdx, r11
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14005547f
nop word [rax + rax]
rol eax, 5
lea rdx, [rdx + 1]
movsx ecx, cl
add eax, ecx
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x140055460
cmp eax, 0x1473e25e
je 0x140055989
inc r9
add r8, 4
add r10, 2
cmp r9, rsi
jb 0x140055440
mov r14, qword [r14]
cmp qword [r14 + 0x60], rdi
jne 0x140055400
mov rdx, rdi
mov ecx, 0x3e8
call rdx
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov r14, qword [rcx + 0x10]
cmp qword [r14 + 0x60], rdi
je 0x14005556d
nop dword [rax]
nop word [rax + rax]
mov r11, qword [r14 + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov ecx, dword [rax + r11 + 0x88]
test ecx, ecx
je 0x140055560
mov r8d, dword [r11 + rcx + 0x20]
lea rax, [r11 + rcx]
mov r10d, dword [rax + 0x24]
add r8, r11
mov r15d, dword [rax + 0x1c]
add r10, r11
mov esi, dword [rax + 0x18]
add r15, r11
mov r9, rdi
test rsi, rsi
je 0x140055560
nop dword [rax]
mov edx, dword [r8]
mov ecx, 0x8620a707
add rdx, r11
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x140055550
nop word [rax + rax]
rol ecx, 5
lea rdx, [rdx + 1]
movsx eax, al
add ecx, eax
movzx eax, byte [rdx - 1]
test al, al
jne 0x140055530
cmp ecx, 0x8a71afae
je 0x140055999
inc r9
add r8, 4
add r10, 2
cmp r9, rsi
jb 0x140055510
mov r14, qword [r14]
cmp qword [r14 + 0x60], rdi
jne 0x1400554d0
mov r10, rdi
mov qword [rsp + 0x28], rdi
lea r8, [0x1400501f0]
xor r9d, r9d
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call r10
mov r15, qword [rsp + 0x428]
test rax, rax
je 0x1400555a0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call fcn.140056540
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rbx + rax + 0x13], dil
jne 0x1400555b0
test rax, rax
je 0x1400556d7
xor eax, eax
mov dword [rsp + 0x70], 0xcd3453b9
mov qword [rsp + 0x61], rax
lea rdx, [0x1402b5d10]
mov dword [rsp + 0x69], eax
lea rcx, [rsp + 0x30]
mov eax, dword [rsp + 0x70]
xorps xmm0, xmm0
movups xmmword [rsp + 0x31], xmm0
mov dword [rsp + 0x34], eax
mov r8d, 0x20
movups xmmword [rsp + 0x41], xmm0
mov dword [rsp + 0x74], 0x2e892e65
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x38], eax
movups xmmword [rsp + 0x51], xmm0
mov dword [rsp + 0x78], 0x7f0ab1c3
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x3c], eax
mov dword [rsp + 0x7c], 0x6e8692cc
mov eax, dword [rsp + 0x7c]
mov dword [rsp + 0x40], eax
mov dword [rbp - 0x70], 0x11d10708
mov eax, dword [rbp - 0x70]
mov dword [rsp + 0x48], eax
mov dword [rbp - 0x6c], 0x10d43f23
mov eax, dword [rbp - 0x6c]
mov dword [rsp + 0x4c], eax
mov dword [rbp - 0x80], 0x21ce698
mov eax, dword [rbp - 0x80]
mov dword [rsp + 0x5c], eax
mov dword [rbp - 0x7c], 0x13aab263
mov eax, dword [rbp - 0x7c]
mov dword [rsp + 0x60], eax
mov dword [rbp - 0x78], 0xd217083
mov eax, dword [rbp - 0x78]
mov dword [rsp + 0x64], eax
mov dword [rbp - 0x74], 0x1d8a9947
mov eax, dword [rbp - 0x74]
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x30], 0x61707865
mov dword [rsp + 0x44], 0x3320646e
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x58], 0x79622d32
mov dword [rsp + 0x6c], 0x6b206574
call fcn.14004b220
xor edx, edx
lea rcx, [rbx + 0x13]
mov r8d, 0xfa
call fcn.14011fff0
movups xmm0, xmmword [0x1402b5d10]
movups xmmword [rbx + 0x13], xmm0
movups xmm1, xmmword [0x1402b5d20]
movups xmmword [rbx + 0x23], xmm1
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x24c]
mov byte [rcx + 0x4b3], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x24d]
mov byte [rcx + 0x4b4], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x24e]
mov byte [rcx + 0x4b5], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x24f]
mov byte [rcx + 0x4b6], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x250]
mov byte [rcx + 0x4b7], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x251]
mov byte [rcx + 0x4b8], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x252]
mov byte [rcx + 0x4b9], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x253]
mov byte [rcx + 0x4ba], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x254]
mov byte [rcx + 0x4bb], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x255]
mov byte [rcx + 0x4bc], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x256]
mov byte [rcx + 0x4bd], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x257]
mov byte [rcx + 0x4be], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x258]
mov byte [rcx + 0x4bf], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x259]
mov byte [rcx + 0x4c0], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x25a]
mov byte [rcx + 0x4c1], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x25b]
mov byte [rcx + 0x4c2], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x25c]
mov byte [rcx + 0x4c3], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x25d]
mov byte [rcx + 0x4c4], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x25e]
mov byte [rcx + 0x4c5], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x25f]
mov byte [rcx + 0x4c6], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x260]
mov byte [rcx + 0x4c7], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x261]
mov byte [rcx + 0x4c8], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x262]
mov byte [rcx + 0x4c9], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x263]
mov byte [rcx + 0x4ca], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x264]
mov byte [rcx + 0x4cb], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x265]
mov byte [rcx + 0x4cc], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x266]
mov byte [rcx + 0x4cd], al
movzx eax, byte [rbx + 0x267]
mov rcx, qword [rbx + 0x5b0]
mov byte [rcx + 0x4ce], al
movzx eax, byte [rbx + 0x268]
mov rcx, qword [rbx + 0x5b0]
mov byte [rcx + 0x4cf], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x269]
mov byte [rcx + 0x4d0], al
mov rcx, qword [rbx + 0x5b0]
mov rax, qword [rcx + 0x330]
mov qword [rcx + 0x338], rax
mov rdx, qword [rbx + 0x270]
mov rax, qword [rbx + 0x278]
sub rax, rdx
sar rax, 2
test rax, rax
je 0x1400559d1
mov rsi, rdi
mov rcx, qword [rbx + 0x5b0]
lea r8, [rsi + rdx]
add rcx, 0x330
mov rdx, qword [rcx + 8]
cmp rdx, qword [rcx + 0x10]
je 0x1400559a9
mov eax, dword [r8]
mov dword [rdx], eax
add qword [rcx + 8], 4
jmp 0x1400559ae
movzx eax, word [r10]
mov edx, dword [r15 + rax*4]
add rdx, r11
jmp 0x14005549f
movzx eax, word [r10]
mov r10d, dword [r15 + rax*4]
add r10, r11
jmp 0x140055570
call fcn.14002de10
mov rdx, qword [rbx + 0x270]
inc edi
mov rcx, qword [rbx + 0x278]
add rsi, 4
sub rcx, rdx
movsxd rax, edi
sar rcx, 2
cmp rax, rcx
jb 0x140055961
movzx eax, byte [rbx + 0x288]
mov rcx, qword [rbx + 0x5b0]
mov byte [rcx + 0x326], al
movzx eax, byte [rbx + 0x23c]
mov rcx, qword [rbx + 0x5b0]
mov byte [rcx + 0x7f5], al
movzx eax, byte [rbx + 0x10]
mov rcx, qword [rbx + 0x5b0]
mov byte [rcx + 0x6d0], al
movzx eax, byte [rbx + 0x23d]
mov rcx, qword [rbx + 0x5b0]
mov byte [rcx + 0x6d1], al
movzx eax, byte [rbx + 0x23e]
mov rcx, qword [rbx + 0x5b0]
mov byte [rcx + 0x6d2], al
movzx eax, byte [rbx + 0x23f]
mov rcx, qword [rbx + 0x5b0]
mov byte [rcx + 0x6d3], al
movzx eax, byte [rbx + 0x240]
mov rcx, qword [rbx + 0x5b0]
mov byte [rcx + 0x6d4], al
movzx eax, byte [rbx + 0x241]
mov rcx, qword [rbx + 0x5b0]
mov byte [rcx + 0x6d5], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x242]
mov byte [rcx + 0x6d6], al
mov rcx, qword [rbx + 0x5b0]
mov eax, dword [rbx + 0x244]
mov dword [rcx + 0x6d8], eax
mov eax, dword [rbx + 0x248]
mov rcx, qword [rbx + 0x5b0]
mov dword [rcx + 0x6dc], eax
movzx eax, byte [rbx + 0x289]
mov rcx, qword [rbx + 0x5b0]
mov byte [rcx + 0x348], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x28a]
mov byte [rcx + 0x357], al
mov eax, dword [rbx + 0x28c]
mov rcx, qword [rbx + 0x5b0]
mov dword [rcx + 0x328], eax
movzx eax, byte [rbx + 0x290]
mov rcx, qword [rbx + 0x5b0]
mov byte [rcx + 0x354], al
movzx eax, byte [rbx + 0x291]
mov rcx, qword [rbx + 0x5b0]
mov byte [rcx + 0x97d], al
movzx eax, byte [rbx + 0x238]
mov rcx, qword [rbx + 0x5b0]
mov byte [rcx + 0x31e], al
movzx eax, byte [rbx + 0x292]
mov rcx, qword [rbx + 0x5b0]
mov byte [rcx + 0x325], al
movzx eax, byte [rbx + 0x239]
mov rcx, qword [rbx + 0x5b0]
mov byte [rcx + 0x361], al
movzx eax, byte [rbx + 0x23a]
mov rcx, qword [rbx + 0x5b0]
mov byte [rcx + 0x362], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x23b]
mov byte [rcx + 0x363], al
mov rcx, qword [rbx + 0x5b0]
mov eax, dword [rbx + 0x298]
mov dword [rcx + 0x364], eax
mov rcx, qword [rbx + 0x5b0]
mov eax, dword [rbx + 0x29c]
mov dword [rcx + 0x368], eax
mov rcx, qword [rbx + 0x5b0]
mov eax, dword [rbx + 0x294]
mov dword [rcx + 0x380], eax
mov rcx, qword [rbx + 0x5b0]
mov eax, dword [rbx + 0x2a0]
mov dword [rcx + 0x384], eax
mov rcx, qword [rbx + 0x5b0]
mov eax, dword [rbx + 0x2a4]
mov dword [rcx + 0x7f0], eax
mov rcx, qword [rbx + 0x5b0]
mov eax, dword [rbx + 0x2a8]
mov dword [rcx + 0x7f8], eax
mov eax, dword [rbx + 0x2ac]
lea r8, [rbx + 0x2d6]
mov rcx, qword [rbx + 0x5b0]
mov edx, 0x104
mov dword [rcx + 0xc], eax
movzx eax, byte [rbx + 0x2b0]
mov rcx, qword [rbx + 0x5b0]
mov byte [rcx + 0x398], al
movzx eax, byte [rbx + 0x2b1]
mov rcx, qword [rbx + 0x5b0]
mov byte [rcx + 0x399], al
movzx eax, byte [rbx + 0x2b2]
mov rcx, qword [rbx + 0x5b0]
mov byte [rcx + 0x36c], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x2b8]
mov byte [rcx + 0x374], al
mov rcx, qword [rbx + 0x5b0]
mov eax, dword [rbx + 0x2b4]
mov dword [rcx + 0x370], eax
mov rcx, qword [rbx + 0x5b0]
mov eax, dword [rbx + 0x2bc]
mov dword [rcx + 0x378], eax
mov eax, dword [rbx + 0x2c0]
mov rcx, qword [rbx + 0x5b0]
mov dword [rcx + 0x35c], eax
movzx eax, byte [rbx + 0x2c5]
mov rcx, qword [rbx + 0x5b0]
mov byte [rcx + 0x37c], al
movzx eax, byte [rbx + 0x2cc]
mov rcx, qword [rbx + 0x5b0]
mov byte [rcx + 0x37d], al
movzx eax, byte [rbx + 0x2cd]
mov rcx, qword [rbx + 0x5b0]
mov byte [rcx + 0x349], al
movzx eax, byte [rbx + 0x2ce]
mov rcx, qword [rbx + 0x5b0]
mov byte [rcx + 0x34a], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x2cf]
mov byte [rcx + 0x34b], al
mov rcx, qword [rbx + 0x5b0]
mov eax, dword [rbx + 0x2c8]
mov dword [rcx + 0x214], eax
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x2d0]
mov byte [rcx + 0x807], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x2d1]
mov byte [rcx + 0x321], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x2d4]
mov byte [rcx + 0x324], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x2d2]
mov byte [rcx + 0x322], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x2d3]
mov byte [rcx + 0x323], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x2d5]
mov byte [rcx + 0x39a], al
mov rcx, qword [rbx + 0x5b0]
add rcx, 0x39b
call fcn.14012209c
mov rcx, qword [rbx + 0x5b0]
lea r8, [rbx + 0x3dc]
movzx eax, byte [rbx + 0x3db]
mov edx, 0x104
mov byte [rcx + 8], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x3da]
mov byte [rcx + 0x49f], al
mov rcx, qword [rbx + 0x5b0]
add rcx, 0x809
call fcn.14012209c
mov rcx, qword [rbx + 0x5b0]
lea r8, [rbx + 0x4e0]
add rcx, 0x90d
mov edx, 0x38
call fcn.14012209c
mov rcx, qword [rbx + 0x5b0]
lea r8, [rbx + 0x518]
add rcx, 0x945
mov edx, 0x38
call fcn.14012209c
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x550]
mov rsi, qword [rsp + 0x420]
mov byte [rcx + 0x360], al
mov rcx, qword [rbx + 0x5b0]
mov eax, dword [rbx + 0x554]
mov dword [rcx + 0x7fc], eax
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x2c4]
mov byte [rcx + 0x808], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x558]
mov byte [rcx + 0x804], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x559]
mov byte [rcx + 0x805], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x55a]
mov byte [rcx + 0x806], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x55b]
mov byte [rcx + 0x31c], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x55c]
mov byte [rcx + 0x31d], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x55d]
mov byte [rcx + 0x31f], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x55e]
mov byte [rcx + 0x320], al
cmp byte [rbx + 0x2d5], 0
mov rcx, qword [rbx + 0x218]
je 0x140056001
cmp byte [rcx + 0x38], 0
jne 0x140055f3a
movzx r8d, byte [rbx + 0x3db]
lea rdx, [rbx + 0x2d6]
call fcn.14003bce0
mov rax, qword [rbx + 0x218]
cmp byte [rax + 0x38], 0
jne 0x140055f91
mov r9d, 0x50030
mov byte [rax + 0x39], 0
lea r8, [0x1402bf310]
mov rcx, r12
lea rdx, [0x1402be4d0]
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x1400560f7
call fcn.14003bb20
mov rcx, qword [rbx + 0x218]
lea rdx, [rbx + 0x2d6]
add rcx, 0x11a
call fcn.140124c3c
test eax, eax
je 0x140055f84
mov rcx, qword [rbx + 0x218]
call fcn.14003c160
movzx r8d, byte [rbx + 0x3db]
lea rdx, [rbx + 0x2d6]
mov rcx, qword [rbx + 0x218]
call fcn.14003bce0
mov rax, qword [rbx + 0x218]
cmp byte [rax + 0x38], 0
je 0x140055f14
call qword [rax + 0x2c0]
test eax, eax
mov rax, qword [rbx + 0x218]
jns 0x140055fc8
mov r9d, 0x50030
mov byte [rax + 0x39], 0
lea r8, [0x1402bf310]
mov rcx, r12
lea rdx, [0x1402bf410]
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x1400560f7
cmp qword [rax + 0x2f8], 0
jne 0x140055fe0
cmp qword [rax + 0x300], 0
jne 0x140055fe0
mov al, 1
jmp 0x140055fe2
xor al, al
mov byte [rbx + 0x3da], al
mov rax, qword [rbx + 0x218]
mov byte [rax + 0x39], 1
mov rcx, qword [rbx + 0x218]
call fcn.14003bb20
jmp 0x140056017
cmp byte [rcx + 0x39], 0
je 0x140056017
call fcn.14003c160
mov rax, qword [rbx + 0x218]
mov byte [rax + 0x39], 0
mov ecx, dword [rbx + 8]
lea r8, [rbx + 0x13]
lea rdx, str._.15s__d.vnc
lea eax, [rcx - 0x170d]
lea r9d, [rcx - 0x170c]
cmp eax, 0x62
cmova r9d, ecx
lea rcx, [rbp + 0xc0]
call fcn.14002d8e0
xor r9d, r9d
lea rdx, [rbp - 0x50]
xor ecx, ecx
lea r8d, [r9 + 0x1a]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea r8, str.UltraVNC
mov edx, 0x104
lea rcx, [rbp - 0x50]
call fcn.1401220fc
lea rcx, [rbp - 0x50]
call fcn.14012e6b0
lea r8, [0x1401987b4]
mov edx, 0x104
lea rcx, [rbp - 0x50]
call fcn.1401220fc
lea r8, [rbp + 0xc0]
mov edx, 0x104
lea rcx, [rbp - 0x50]
call fcn.1401220fc
xor r8d, r8d
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1400566d0
mov r9d, 0x100
lea r8, [rbp + 0x1d0]
mov edx, 0x3e8
mov rcx, r12
call qword [sym.imp.USER32.dll_GetDlgItemTextA]
mov rcx, qword [rbx + 0x5b0]
lea r8, [rbx + 0x5c4]
add rcx, 0xa82
mov edx, 0xff
call fcn.14012209c
mov edx, 1
mov rcx, r12
call qword [sym.imp.USER32.dll_EndDialog]
mov al, 1
mov rcx, qword [rbp + 0x2d0]
xor rcx, rsp
call fcn.14011b0c0
add rsp, 0x3e0
pop r14
pop r12
pop rdi
pop rbx
pop rbp
ret