Function at 0x14008d090
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
sub rsp, 0x1c0
lea rbp, [rsp + 0x80]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x140328040]
xor rax, rsp
mov qword [rbp + 0x130], rax
cmp byte [0x14040c46a], 0
jne 0x14008d2f9
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rbp + 0x20]
movabs rax, 0x5f127415c7c164c0
movabs rsi, 0x6532265a9593219b
mov qword [rbp + 0x90], rax
movabs r14, 0x286b8e7f8676ee3c
mov rax, qword [rbp + 0x90]
mov qword [rbp + 0x20], rax
movabs rax, 0x473ceb12e704a81c
mov qword [rbp + 0x90], rax
mov rax, qword [rbp + 0x90]
mov qword [rbp + 0x28], rax
movabs rax, 0x1328cc6321b809f7
mov qword [rbp + 0x90], rax
mov rax, qword [rbp + 0x90]
mov qword [rbp + 0x30], rax
movabs rax, 0x80c6a428dea4d2e1
mov qword [rbp + 0x90], rax
mov rax, qword [rbp + 0x90]
mov qword [rbp + 0x38], rax
movabs rax, 0x6656767c41d8bb56
mov qword [rbp + 0x90], rax
mov rax, qword [rbp + 0x90]
mov qword [rbp + 0x40], rax
movabs rax, 0xcec12987ab67fcbf
mov qword [rbp + 0x90], rax
mov rax, qword [rbp + 0x90]
mov qword [rbp + 0x48], rax
movabs rax, 0x86584d43af9d5e77
mov qword [rbp + 0x90], rax
mov rax, qword [rbp + 0x90]
mov qword [rbp + 0x50], rax
movabs rax, 0x1c914b0cb1bdf0a7
mov qword [rbp + 0x90], rax
mov rax, qword [rbp + 0x90]
mov qword [rbp + 0x58], rax
mov qword [rbp + 0x90], rsi
mov rax, qword [rbp + 0x90]
mov qword [rbp + 0xc0], rax
mov qword [rbp + 0x90], r14
mov rax, qword [rbp + 0x90]
mov qword [rbp + 0xc8], rax
movabs rax, 0x7746a5341b826285
mov qword [rbp + 0x90], rax
mov rax, qword [rbp + 0x90]
mov qword [rbp + 0xd0], rax
movabs rax, 0xf4afca61e49ea58e
mov qword [rbp + 0x90], rax
mov rax, qword [rbp + 0x90]
mov qword [rbp + 0xd8], rax
movabs rax, 0x460b130628b4da3f
mov qword [rbp + 0x90], rax
mov rax, qword [rbp + 0x90]
mov qword [rbp + 0xe0], rax
movabs rax, 0xeeb848ebd9028af0
mov qword [rbp + 0x90], rax
mov rax, qword [rbp + 0x90]
mov qword [rbp + 0xe8], rax
movabs rax, 0xf22c28108fe93139
mov qword [rbp + 0x90], rax
mov rax, qword [rbp + 0x90]
mov qword [rbp + 0xf0], rax
movabs rax, 0x1c914b2dd5d880d2
mov qword [rbp + 0x90], rax
mov rax, qword [rbp + 0x90]
vmovdqu ymm0, ymmword [rbp + 0xc0]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqu ymm0, ymmword [rbp + 0x40]
vmovdqa ymmword [rbp + 0x20], ymm1
mov qword [rbp + 0xf8], rax
vpxor ymm1, ymm0, ymmword [rbp + 0xe0]
vmovdqa ymmword [rbp + 0x40], ymm1
vzeroupper
call fcn.140003c60
lea rdx, [0x140003ff0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x14008dce9
lea rax, [0x14008cc50]
mov dword [0x14040c510], 0x50
xor r15d, r15d
mov qword [0x14040c518], rax
xor ecx, ecx
mov qword [0x14040c520], r15
mov dword [0x14040c514], 3
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edx, 0x7f00
mov qword [0x14040c530], r15
xor ecx, ecx
mov qword [0x14040c528], rax
call qword [sym.imp.USER32.dll_LoadCursorW]
mov qword [0x14040c538], rax
xorps xmm0, xmm0
movdqu xmmword [0x14040c540], xmm0
movabs rsi, 0x6532265a9593219b
movabs rax, 0x6556263495fa21cc
movabs r14, 0x286b8e7f8676ee3c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
movabs rax, 0x286b8e7f8601ee53
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x120], rax
mov qword [rbp], r14
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x80]
mov qword [rbp + 0x128], rax
lea rax, [rbp + 0x80]
xorps xmm0, xmmword [rbp + 0x120]
mov qword [0x14040c550], rax
mov qword [0x14040c558], r15
mov rax, qword gs:[0x60]
movdqa xmmword [rbp + 0x80], xmm0
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14008d477
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14008d477
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xaef1c372
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14008d472
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x14008d450
cmp r8d, 0xdae4a125
je 0x14008d47c
test r9d, r9d
jne 0x14008d430
mov rax, qword [rax]
jmp 0x14008d400
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rcx, [0x14040c510]
add rax, r10
call rax
test ax, ax
jne 0x14008d755
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movabs rax, 0x5f127415c7c164c0
mov qword [rbp], rax
movabs r8, 0xebe6a2b221bea443
mov rax, qword [rbp]
movabs rdx, 0xf93ee197c9035a24
mov qword [rbp + 0x20], rax
movabs rax, 0x473ceb12e704a81c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0x1328cc6321b809f7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rax, 0x80c6a428dea4d2e1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0x7c31767c41d8bb56
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0x9cdd3c98b065efa2
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0xaf546d63fc885d7a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
movabs rax, 0x3cab3942a7aac5f2
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
mov qword [rbp], r8
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
movabs rax, 0x7746a5341b826285
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd0], rax
movabs rax, 0xf4afca61e49ea58e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd8], rax
movabs rax, 0x460b130628b4da3f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
movabs rax, 0xeeb848ebd9028af0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
movabs rax, 0xf22c28108fe93139
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf0], rax
movabs rax, 0x1c914b2dd5d880d2
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf8], rax
mov qword [rbp], r8
mov rax, qword [rbp]
mov qword [rbp + 0x100], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
vmovdqu ymm0, ymmword [rbp + 0xc0]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqu ymm0, ymmword [rbp + 0x40]
vmovdqa ymmword [rbp + 0x20], ymm1
mov qword [rbp + 0x108], rax
vmovdqa xmm2, xmmword [rbp + 0x60]
lea rdx, [rbp + 0x20]
vxorps xmm2, xmm2, xmmword [rbp + 0x100]
vpxor ymm1, ymm0, ymmword [rbp + 0xe0]
vmovdqa xmmword [rbp + 0x60], xmm2
vmovdqa ymmword [rbp + 0x40], ymm1
vzeroupper
call fcn.140003c60
mov rcx, qword gs:[0x60]
mov rsi, rax
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
mov r10, qword [rcx + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov edi, dword [rdx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14008d727
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14008d727
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x9b88a0f5
lea rax, [rbx + r9*4]
mov edx, dword [rax + r10]
add rdx, r10
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x14008d722
nop
movsx eax, al
lea rdx, [rdx + 1]
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rdx - 1]
test al, al
jne 0x14008d700
cmp r8d, 0x5a43ce7
je 0x14008d72c
test r9d, r9d
jne 0x14008d6e0
mov rcx, qword [rcx]
jmp 0x14008d6b0
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
call rax
mov edx, eax
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
jmp 0x14008d2e4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r9d, dword [0x14040c58c]
mov edx, dword [0x14040c588]
mov r8d, dword [0x14040c594]
mov ecx, dword [0x14040c590]
sub r8d, r9d
mov qword [rsp + 0x58], r15
sub ecx, edx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x38], r8d
mov r8, qword [0x14040c548]
mov dword [rsp + 0x30], ecx
mov ecx, 0x80000a8
mov dword [rsp + 0x28], r9d
mov r9d, 0x90000000
mov dword [rsp + 0x20], edx
mov rdx, qword [0x14040c550]
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov qword [0x14040c568], rax
mov rcx, rax
test rax, rax
jne 0x14008da10
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rbp + 0x20]
movabs rax, 0x5f127415c7c164c0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0x473ceb12e704a81c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0x1328cc6321b809f7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rax, 0x80c6a428dea4d2e1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0x7c31767c41d8bb56
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0x87ef2d9fb867f8b3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0xd2715055f8865557
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
movabs rax, 0x1cb1715fbaaaf297
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
movabs rax, 0x7746a5341b826285
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd0], rax
movabs rax, 0xf4afca61e49ea58e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd8], rax
movabs rax, 0x460b130628b4da3f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
movabs rax, 0xeeb848ebd9028af0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
movabs rax, 0xf22c28108fe93139
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf0], rax
movabs rax, 0x1c914b2dd5d880d2
mov qword [rbp], rax
mov rax, qword [rbp]
vmovdqu ymm0, ymmword [rbp + 0xc0]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqu ymm0, ymmword [rbp + 0x40]
vmovdqa ymmword [rbp + 0x20], ymm1
mov qword [rbp + 0xf8], rax
vpxor ymm1, ymm0, ymmword [rbp + 0xe0]
vmovdqa ymmword [rbp + 0x40], ymm1
vzeroupper
call fcn.140003c60
mov rcx, qword gs:[0x60]
mov rsi, rax
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rcx + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov edi, dword [rdx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14008da0b
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14008da0b
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x871863f2
lea rax, [rbx + r9*4]
mov edx, dword [rax + r10]
add rdx, r10
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x14008da06
nop
movsx eax, al
lea rdx, [rdx + 1]
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rdx - 1]
test al, al
jne 0x14008d9e0
cmp r8d, 0x3c4b9294
je 0x14008d72c
test r9d, r9d
jne 0x14008d9c0
mov rcx, qword [rcx]
jmp 0x14008d990
mov edx, dword [0x14040c588]
mov r8d, dword [0x14040c58c]
mov eax, dword [0x14040c590]
sub eax, edx
mov dword [rbp + 0x98], edx
mov dword [rbp + 0xa0], eax
lea rdx, [rbp + 0x98]
mov eax, dword [0x14040c594]
sub eax, r8d
mov dword [rbp + 0x9c], r8d
mov dword [rbp + 0xa4], eax
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14008dae7
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14008dae7
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x1bdfbc6b
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14008dae2
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x14008dac0
cmp r8d, 0x99327046
je 0x14008daec
test r9d, r9d
jne 0x14008daa0
mov rax, qword [rax]
jmp 0x14008da70
mov ecx, dword [rdi + 0x24]
mov r8b, 0xff
add rcx, r10
movzx edx, word [rcx + r9*2]
mov r9d, 2
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor edx, edx
mov rcx, qword [0x14040c568]
add rax, r10
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14008dba7
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14008dba7
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x8ae4e856
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14008dba2
nop dword [rax]
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x14008db80
cmp r8d, 0x94967da3
je 0x14008dbac
test r9d, r9d
jne 0x14008db60
mov rax, qword [rax]
jmp 0x14008db30
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov edx, 0xa
mov rcx, qword [0x14040c568]
add rax, r10
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14008dc67
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14008dc67
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x8be72880
lea rcx, [r10 + r9*4]
mov ecx, dword [rcx + rbx]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x14008dc62
nop dword [rax]
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x14008dc40
cmp r8d, 0x3f2fe5e1
je 0x14008dc6c
test r9d, r9d
jne 0x14008dc20
mov rax, qword [rax]
jmp 0x14008dbf0
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov rcx, qword [0x14040c568]
add rax, r10
call rax
mov byte [0x14040c46b], 1
call fcn.14008c7b0
cmp byte [0x14040c46c], r15b
je 0x14008dce9
mov rcx, qword [0x14040c580]
lea r9, [rbp + 0x90]
lea r8, [0x1403116b8]
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x48]
mov rcx, qword [0x14040c560]
lea r9, [0x14040c598]
mov rdx, qword [rbp + 0x90]
xor r8d, r8d
mov rax, qword [rcx]
call qword [rax + 0x48]
mov rcx, qword [rbp + 0x90]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x130]
xor rcx, rsp
call fcn.1400f9830
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret