Function at 0x140032f90
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x1400c1060]
xor rax, rsp
mov qword [rbp + 0x28], rax
mov edx, 9
mov qword [rsp + 0x140], rbx
lea rcx, [rbp + 8]
call fcn.140032d30
lea rax, [0x140036f00]
mov dword [rbp - 0x60], 0x50
xor ebx, ebx
mov qword [rbp - 0x58], rax
xor ecx, ecx
mov dword [rbp - 0x5c], 0x40
mov qword [rbp - 0x50], rbx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xorps xmm0, xmm0
mov dword [rbp - 0x80], 0xfde6ece9
movdqa xmmword [rbp - 0x40], xmm0
xorps xmm1, xmm1
movdqa xmm0, xmmword [0x1400b2f90]
mov ecx, ebx
movdqu xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x48], rax
movdqa xmmword [rbp - 0x30], xmm1
mov word [rbp - 0x7c], 0x100
nop word [rax + rax]
lea eax, [rcx + 0x77]
xor byte [rsp + rcx + 0x70], al
inc rcx
cmp rcx, 0x14
jb 0x140033020
lea rax, [rsp + 0x70]
mov qword [rbp - 0x18], rbx
lea rcx, [rbp - 0x60]
mov qword [rbp - 0x20], rax
call qword [sym.imp.USER32.dll_RegisterClassExA]
cmp byte [0x1401a7deb], bl
jne 0x1400331e2
mov qword [rsp + 0x148], rdi
mov edi, 1
mov rcx, qword [0x1401a7e08]
test rcx, rcx
je 0x1400331c3
lea rdx, [0x1401a7e10]
call qword [sym.imp.USER32.dll_GetClientRect]
mov rcx, qword [0x1401a7e08]
lea rdx, [rbp - 0x10]
mov qword [rbp - 0x10], rbx
call qword [sym.imp.USER32.dll_ClientToScreen]
mov eax, dword [rbp - 0x10]
lea r9, [rsp + 0x69]
mov dword [0x1401a7e10], eax
mov r8b, 0x34
mov eax, dword [rbp - 0xc]
movzx ecx, r8b
mov dword [0x1401a7e14], eax
movzx edx, r8b
mov eax, dword [0x1401a7e18]
xor cl, 5
mov dword [0x1401a7c08], eax
xor dl, 5
mov eax, dword [0x1401a7e1c]
xor r8b, 5
mov dword [0x1401a7e00], eax
mov al, 0x35
xor al, 5
mov byte [rsp + 0x6b], cl
mov ecx, Ordinal_41
mov byte [rsp + 0x6a], al
mov byte [rsp + 0x68], 5
mov byte [rsp + 0x69], r8b
mov byte [rsp + 0x6c], dl
mov byte [rsp + 0x6d], bl
call fcn.14002f080
mov r10, rax
cmp r8b, 0x30
jl 0x140033133
cmp r8b, 0x39
jg 0x140033133
mov ecx, 0xb11
call fcn.14002f080
imul eax, r10d
inc r9
movsx r10d, r8b
add r10d, 0xffffffd0
movzx r8d, byte [r9]
add r10d, eax
cmp r8b, 0x30
jge 0x140033107
cmp dword [0x1401a7c08], r10d
jle 0x1400331c3
mov al, Ordinal_30
mov byte [rsp + 0x60], Ordinal_41
movzx ecx, al
lea r9, [rsp + 0x61]
xor edx, edx
xor cl, 0x28
mov byte [rsp + 0x63], cl
xor al, 0x28
mov r8b, Ordinal_33
mov byte [rsp + 0x62], al
xor r8b, 0x28
mov byte [rsp + 0x64], dl
lea ecx, [rdx + 0x25]
mov byte [rsp + 0x61], r8b
call fcn.14002f080
mov r10, rax
cmp r8b, 0x30
jl 0x1400331ac
nop
cmp r8b, 0x39
jg 0x1400331ac
mov ecx, 0xb11
call fcn.14002f080
imul eax, r10d
inc r9
movsx r10d, r8b
add r10d, 0xffffffd0
movzx r8d, byte [r9]
add r10d, eax
cmp r8b, 0x30
jge 0x140033180
movzx eax, byte [0x1401a7deb]
cmp dword [0x1401a7e00], r10d
cmovg eax, edi
mov byte [0x1401a7deb], al
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x1401a7deb], bl
je 0x140033060
mov rdi, qword [rsp + 0x148]
movdqa xmm0, xmmword [0x1400b2f90]
mov rcx, rbx
movdqu xmmword [rbp - 0x78], xmm0
mov dword [rbp - 0x68], 0xfde6ece9
mov word [rbp - 0x64], 0x100
nop
lea eax, [rcx + 0x77]
xor byte [rbp + rcx - 0x78], al
inc rcx
cmp rcx, 0x14
jb 0x140033200
movdqa xmm0, xmmword [0x1400b2f90]
mov rcx, rbx
movdqu xmmword [rsp + 0x70], xmm0
mov byte [rbp - 0x63], bl
mov dword [rbp - 0x80], 0xfde6ece9
mov word [rbp - 0x7c], 0x100
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x77]
xor byte [rsp + rcx + 0x70], al
inc rcx
cmp rcx, 0x14
jb 0x140033240
mov eax, dword [0x1401a7e00]
lea r8, [rbp - 0x78]
mov qword [rsp + 0x58], rbx
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x50], rbx
mov r9d, 0x90000000
mov qword [rsp + 0x48], rbx
xor ecx, ecx
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x38], eax
mov eax, dword [0x1401a7c08]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
mov byte [rbp - 0x7b], bl
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov rbx, qword [rsp + 0x140]
mov qword [0x1401a7ea8], rax
test rax, rax
jne 0x1400332b8
lea ecx, [rax + 2]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
movdqa xmm0, xmmword [0x1400b1670]
lea rdx, [rbp - 8]
mov rcx, rax
movdqu xmmword [rbp - 8], xmm0
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov rcx, qword [0x1401a7ea8]
mov edx, 0xffffffec
mov r8d, 0x800a0
call qword [sym.imp.USER32.dll_SetWindowLongA]
mov rcx, qword [0x1401a7ea8]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1401a7ea8]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rdx, qword [rbp + 0x20]
cmp rdx, 0x10
jb 0x140033347
mov rcx, qword [rbp + 8]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140033342
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140033342
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400930d8
mov rcx, qword [rbp + 0x28]
xor rcx, rsp
call fcn.140092b30
add rsp, 0x130
pop rbp
ret