Function at 0x180018a20
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Encode data using xor
Get graphical window text
Hash data using fnv
Inspect load icon resource
Resolve function by parsing pe exports
Set console window title

Disassembly:
mov byte [rsp + 8], cl
push rbp
push rbx
push r13
mov rbp, rsp
sub rsp, 0x50
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov r13, rax
test rax, rax
jne 0x180018a4c
call qword [sym.imp.KERNEL32.dll_AllocConsole]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov r13, rax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180018e90
lea rdx, [rbp + 0x28]
mov dword [rbp + 0x28], 0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
test eax, eax
je 0x180018e90
mov edx, dword [rbp + 0x28]
mov rcx, rbx
mov qword [rsp + 0x40], r12
or edx, 4
mov qword [rsp + 0x88], rsi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r15
mov dword [rbp + 0x28], edx
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_LoadIconA]
mov edx, 0x80
mov r8d, 1
mov r9, rax
mov rcx, r13
mov rbx, rax
call qword [sym.imp.USER32.dll_SendMessageA]
mov r9, rbx
xor r8d, r8d
mov edx, 0x80
mov rcx, r13
call qword [sym.imp.USER32.dll_SendMessageA]
mov ecx, 1
call fcn.1800cd894
mov r9, rax
mov word [rbp + 0x20], 0x7726
lea r8, [rbp + 0x21]
mov byte [rbp + 0x22], 0
lea rdx, [rbp - 0x2f]
mov dword [rbp - 0x30], 0x4e4f432c
lea rcx, [rbp + 0x30]
mov dword [rbp - 0x2c], 0x2454554f
mov byte [rbp - 0x28], 0
call fcn.1800e2358
mov ecx, 2
call fcn.1800cd894
mov r9, rax
mov word [rbp + 0x20], 0x7734
lea r8, [rbp + 0x21]
mov byte [rbp + 0x22], 0
lea rdx, [rbp - 0x2f]
mov dword [rbp - 0x30], 0x4e4f4351
lea rcx, [rbp + 0x30]
mov dword [rbp - 0x2c], 0x2454554f
mov byte [rbp - 0x28], 0
call fcn.1800e2358
lea rcx, [rbp + 0x21]
mov dword [rbp + 0x20], 0x333a7d
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov ecx, 0xfffffff5
mov ebx, reloc.WS2_32.dll_listen
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rbx, qword [0x180233060]
test rbx, rbx
jne 0x180018c69
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov r15, qword [rax]
mov r14, r15
nop word [rax + rax]
mov r11, qword [r14 + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov esi, dword [rax + r11 + 0x88]
add rsi, r11
cmp rsi, r11
je 0x180018c4a
mov r10d, dword [rsi + 0x18]
test r10d, r10d
je 0x180018c4a
mov edi, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r10d
mov r9d, 0x6de00ceb
lea rax, [rdi + r10*4]
mov r8d, dword [rax + r11]
add r8, r11
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x180018c45
nop
movsx eax, dl
lea r8, [r8 + 1]
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [r8 - 1]
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
test dl, dl
jne 0x180018c10
cmp r9d, 0x6e480216
je 0x180018e99
test r10d, r10d
jne 0x180018bf0
mov rax, qword [r14]
mov r14, rax
cmp rax, r15
je 0x180018c60
cmp qword [rax + 0x30], 0
jne 0x180018bc0
xor ebx, ebx
mov qword [0x180233060], rbx
mov edx, 0xffffffec
mov rcx, r13
call qword [sym.imp.USER32.dll_GetWindowLongPtrA]
mov edx, 0xffffffec
mov rcx, r13
bts rax, 0x13
mov r8, rax
call rbx
mov rax, qword [0x180232f98]
test rax, rax
jne 0x180018d57
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov r15, qword [rax]
mov r14, r15
mov r11, qword [r14 + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov esi, dword [rax + r11 + 0x88]
add rsi, r11
cmp rsi, r11
je 0x180018d38
mov r10d, dword [rsi + 0x18]
test r10d, r10d
je 0x180018d38
mov edi, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r10d
mov r9d, 0xb13c98d4
lea rax, [rdi + r10*4]
mov r8d, dword [rax + r11]
add r8, r11
movzx eax, byte [r8]
inc r8
test al, al
je 0x180018d33
nop
movsx ecx, al
lea r8, [r8 + 1]
sub al, 0x41
mov edx, ecx
or edx, 0x20
cmp al, 0x19
movzx eax, byte [r8 - 1]
cmova edx, ecx
xor edx, r9d
imul r9d, edx, 0x1000193
test al, al
jne 0x180018d00
cmp r9d, 0xfe68ac8d
je 0x180018eb5
test r10d, r10d
jne 0x180018ce0
mov rax, qword [r14]
mov r14, rax
cmp rax, r15
je 0x180018d4e
cmp qword [rax + 0x30], 0
jne 0x180018cb0
xor eax, eax
mov qword [0x180232f98], rax
mov r9d, 2
mov r8b, 0xeb
xor edx, edx
mov rcx, r13
call rax
mov edx, 0xfffffff0
mov rcx, r13
call qword [sym.imp.USER32.dll_GetWindowLongPtrA]
mov r12, rax
mov rax, qword [0x180232f60]
btr r12, 0x13
test rax, rax
jne 0x180018e59
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov r15, qword [rax]
mov r14, r15
nop dword [rax]
nop dword [rax + rax]
mov r11, qword [r14 + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov esi, dword [rax + r11 + 0x88]
add rsi, r11
cmp rsi, r11
je 0x180018e3a
mov r10d, dword [rsi + 0x18]
test r10d, r10d
je 0x180018e3a
mov edi, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r10d
mov r9d, 0x2c7087ce
lea rax, [rdi + r10*4]
mov r8d, dword [rax + r11]
add r8, r11
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x180018e35
nop
movsx eax, dl
lea r8, [r8 + 1]
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [r8 - 1]
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
test dl, dl
jne 0x180018e00
cmp r9d, 0x899fda6d
je 0x180018ed1
test r10d, r10d
jne 0x180018de0
mov rax, qword [r14]
mov r14, rax
cmp rax, r15
je 0x180018e50
cmp qword [rax + 0x30], 0
jne 0x180018db0
xor eax, eax
mov qword [0x180232f60], rax
mov r8, r12
mov edx, 0xfffffff0
mov rcx, r13
call rax
mov edx, 1
mov rcx, r13
call qword [sym.imp.USER32.dll_EnableWindow]
mov r15, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
mov r12, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x88]
add rsp, 0x50
pop r13
pop rbx
pop rbp
ret
mov ecx, dword [rsi + 0x24]
add rcx, r11
movzx edx, word [rcx + r10*2]
mov ecx, dword [rsi + 0x1c]
add rcx, r11
mov ebx, dword [rcx + rdx*4]
add rbx, r11
jmp 0x180018c62
mov ecx, dword [rsi + 0x24]
add rcx, r11
movzx edx, word [rcx + r10*2]
mov ecx, dword [rsi + 0x1c]
add rcx, r11
mov eax, dword [rcx + rdx*4]
add rax, r11
jmp 0x180018d50
mov ecx, dword [rsi + 0x24]
add rcx, r11
movzx edx, word [rcx + r10*2]
mov ecx, dword [rsi + 0x1c]
add rcx, r11
mov eax, dword [rcx + rdx*4]
add rax, r11
jmp 0x180018e52