Function at 0x180003410
Capabilities:
Encode data using xor
Enumerate gui resources
Generate random numbers using a mersenne twister
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x1370]
mov eax, 0x1470
call fcn.1800400b0
sub rsp, rax
mov rdi, rcx
xor ecx, ecx
call fcn.1800473d4
mov dword [rbp + 0x1364], 0xffffffff
mov dword [rbp - 0x1c], eax
mov edx, 1
nop dword [rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul ecx, ecx, 0x6c078965
add ecx, edx
mov dword [rbp + rdx*4 - 0x1c], ecx
mov eax, ecx
inc rdx
cmp rdx, 0x270
jb 0x180003450
mov dword [rbp - 0x20], 0x270
xor esi, esi
cmp dword [0x1800abe90], 0x502ec3fe
jne 0x180003637
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ToUnicode]
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateIconIndirect]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnumWindows]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ShowScrollBar]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetClassNameW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DialogBoxParamW]
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadpoolWait]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpool]
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapePosition]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DrawEdge]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_OffsetRect]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PowerCreateRequest]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSysColorBrush]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetMenuStringW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateIconFromResource]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RemoveSecureMemoryCacheCallback]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateHardLinkW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_RegisterPointerInputTargetEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockShared]
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GrayStringW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetClientRect]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_InvalidateRgn]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FatalAppExitW]
call qword [sym.imp.USER32.dll_GetClipboardOwner]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
lea rcx, [rbp - 0x20]
call fcn.180012e40
mov ecx, eax
lea rbx, [rcx + rcx*2]
test ebx, ebx
jne 0x180003664
nop word [rax + rax]
lea rcx, [rbp - 0x20]
call fcn.180012e40
mov ecx, eax
lea rbx, [rcx + rcx*2]
cmp ebx, 1
jb 0x180003650
shr rbx, 0x20
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
add rax, 0x14b
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x14b
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x50]
call fcn.18000c110
mov qword [rbp - 0x30], rax
inc ebx
sub ebx, 1
je 0x180003744
sub ebx, 1
je 0x180003732
cmp ebx, 1
jne 0x180003842
mov dword [rbp + 0x1398], 4
mov dword [rbp + 0x13a0], 0x3000
mov qword [rbp + 0x13a8], 0x1de8
mov qword [rsp + 0x60], rsi
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
add rax, 0x1ba
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], 0x1ba
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
lea rax, [rbp + 0x1398]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x13a0]
lea r8, [rbp + 0x13a8]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x50]
call fcn.18000c1f0
mov qword [rdi], rax
jmp 0x180003842
mov ecx, 0x1de8
call fcn.18003fc54
mov qword [rdi], rax
jmp 0x180003842
mov qword [rbp + 0x13a0], 0x1de8
mov dword [rbp + 0x1398], 8
mov rax, qword [sym.imp.KERNEL32.dll_HeapAlloc]
add rax, 0x25a
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x25a
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0x6c], eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x68], rsi
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x58], rsi
mov ecx, 0x10
call fcn.18003f898
mov qword [rax + 8], rsi
mov qword [rbp - 0x78], rax
lea rcx, [rbp - 0x78]
mov qword [rax], rcx
mov word [rbp - 0x48], si
mov qword [rbp - 0x42], rsi
mov qword [rbp - 0x3a], rsi
xor eax, eax
mov word [rbp - 0x45], ax
mov byte [rbp - 0x43], al
mov word [rbp - 0x42], ax
mov byte [rbp - 0x40], al
mov word [rbp - 0x3f], ax
mov byte [rbp - 0x3d], al
mov word [rbp - 0x3c], ax
mov byte [rbp - 0x3a], al
mov word [rbp - 0x39], ax
mov byte [rbp - 0x37], al
mov word [rbp - 0x36], ax
mov byte [rbp - 0x34], al
mov dword [rbp - 0x7c], esi
mov dword [rbp - 0x4c], esi
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x50], xmm0
lea rax, [rbp + 0x13a0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x1398]
lea r8, [rbp - 0x30]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x70]
call fcn.18000fa00
mov rbx, qword [rsp + 0x78]
lea rcx, [rbp - 0x78]
call fcn.180010240
mov rcx, qword [rbp - 0x78]
mov qword [rbp - 0x78], rsi
mov edx, 0x10
call fcn.18003f7ac
mov qword [rdi], rbx
cmp dword [0x1800abe90], 0x1c44ba92
jne 0x180003a1b
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_PolyBezierTo]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
xor ecx, ecx
call qword [sym.imp.GDI32.dll_GetSystemPaletteUse]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReplaceFileW]
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingNumaW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenThread]
xor ecx, ecx
call qword [sym.imp.GDI32.dll_GetMetaFileW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_GetBrushOrgEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapQueryInformation]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_SetBitmapBits]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAddAtomW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
xor ecx, ecx
call qword [sym.imp.GDI32.dll_SetMetaRgn]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadSelectorEntry]
xor ecx, ecx
call qword [sym.imp.GDI32.dll_GetFontLanguageInfo]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_GetDIBColorTable]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleOriginalTitleW]
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_GetWinMetaFileBits]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpoolWork]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleAliasExesW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_Rectangle]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryMemoryResourceNotification]
mov rbx, qword [rsp + 0x1490]
add rsp, 0x1470
pop rdi
pop rsi
pop rbp
ret