Function at 0x180056030
Capabilities:
Encode data using xor
Enumerate gui resources

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xe00]
sub rsp, 0xf00
mov rax, qword [0x180189e48]
xor rax, rsp
mov qword [rbp + 0xdf0], rax
mov r12, r8
mov r15d, edx
mov dword [rbp - 0x7c], edx
mov r14d, ecx
mov dword [rbp - 0x80], ecx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], rax
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x50], xmm1
xor ebx, ebx
mov qword [rbp - 0x40], rbx
lea ecx, [rax + 0x18]
call fcn.1800f2588
mov rsi, rax
mov qword [rax], rbx
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
xor edx, edx
mov r8d, 0xe10
lea rcx, [rbp - 0x20]
call fcn.1800f4bb0
mov rdx, rsi
lea rcx, [0x180055150]
call qword [sym.imp.USER32.dll_EnumWindows]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ebx, eax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, eax
mov eax, ebx
cdq
idiv r14d
mov r13d, eax
mov dword [rbp - 0x78], eax
mov eax, ecx
cdq
idiv r15d
mov dword [rbp - 0x74], eax
mov ecx, 0xaa
lea eax, [rcx - 0x14]
lea edx, [rcx + 0xe]
lea r8d, [rcx + 0x43]
test r12, r12
jne 0x1800561fc
mov r9, qword [rsi]
mov r10, qword [rsi + 8]
cmp r9, r10
je 0x1800561fc
xor r11d, r11d
cmp edi, dword [r9 + 0x48]
jne 0x18005635c
mov dword [rsp + 0x40], ntohs
mov dword [rsp + 0x44], 0x9600aa
mov dword [rsp + 0x48], 0x9900b8
mov dword [rsp + 0x4c], 0x96009f
mov dword [rsp + 0x50], 0x83009c
mov dword [rsp + 0x54], 0x9a00b6
mov dword [rsp + 0x58], 0x8b0096
mov dword [rsp + 0x5c], 0xfa008a
mov edx, r11d
nop dword [rax]
mov eax, edx
lea rcx, [rsp + 0x44]
lea rcx, [rcx + rax*2]
lea eax, [r8 + rdx]
xor word [rcx], ax
inc edx
mov eax, dword [rsp + 0x40]
cmp edx, eax
jb 0x180056170
mov word [rsp + rax*2 + 0x44], r11w
lea rcx, [rsp + 0x44]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], r11w
jne 0x1800561a0
mov rdx, qword [r9 + 0x10]
mov r8, r9
cmp qword [r9 + 0x18], 8
jb 0x1800561bb
mov r8, qword [r9]
cmp rdx, rax
jne 0x18005634c
lea rcx, [rsp + 0x44]
test rdx, rdx
je 0x1800561f8
lea rax, [rsp + 0x44]
sub r8, rax
nop word [rax + rax]
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x18005634c
add rcx, 2
sub rdx, 1
jne 0x1800561e0
mov r12, qword [r9 + 0x40]
mov rdi, qword [rsi + 8]
mov rbx, qword [rsi]
cmp rbx, rdi
je 0x180056394
xor r13d, r13d
nop
cmp r12, qword [rbx + 0x40]
je 0x18005637b
mov dword [rsp + 0x60], ntohs
mov dword [rsp + 0x64], 0x9600aa
mov dword [rsp + 0x68], 0x9900b8
mov dword [rsp + 0x6c], 0x96009f
mov dword [rsp + 0x70], 0x83009c
mov dword [rsp + 0x74], 0x9a00b6
mov dword [rsp + 0x78], 0x8b0096
mov dword [rsp + 0x7c], 0xfa008a
mov edx, r13d
mov r8d, 0xed
nop dword [rax]
nop word [rax + rax]
mov eax, edx
lea rcx, [rsp + 0x64]
lea rcx, [rcx + rax*2]
lea eax, [r8 + rdx]
xor word [rcx], ax
inc edx
mov eax, dword [rsp + 0x60]
cmp edx, eax
jb 0x180056270
mov word [rsp + rax*2 + 0x64], r13w
lea rcx, [rsp + 0x64]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], r13w
jne 0x1800562a0
mov rdx, qword [rbx + 0x10]
mov r8, rbx
cmp qword [rbx + 0x18], 8
jb 0x1800562bb
mov r8, qword [rbx]
cmp rdx, rax
jne 0x18005637b
lea rcx, [rsp + 0x64]
test rdx, rdx
je 0x1800562f8
lea rax, [rsp + 0x64]
sub r8, rax
nop word [rax + rax]
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x18005637b
add rcx, 2
sub rdx, 1
jne 0x1800562e0
lea rdx, [rbp - 0x38]
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x18005637b
mov rax, qword [rbx + 0x40]
mov qword [rbp - 0x60], rax
mov eax, dword [rbp - 0x30]
mov dword [rbp - 0x64], eax
mov eax, dword [rbp - 0x2c]
mov dword [rbp - 0x68], eax
mov eax, dword [rbp - 0x38]
mov dword [rbp - 0x58], eax
mov eax, dword [rbp - 0x34]
mov dword [rbp - 0x54], eax
mov rdx, qword [rbp - 0x48]
cmp rdx, qword [rbp - 0x40]
je 0x18005636e
movups xmm0, xmmword [rbp - 0x68]
movups xmmword [rdx], xmm0
movsd xmm1, qword [rbp - 0x58]
movsd qword [rdx + 0x10], xmm1
add qword [rbp - 0x48], 0x18
jmp 0x18005637b
mov r8d, 0xed
lea edx, [r8 - 0x35]
lea ecx, [rdx - 0xe]
lea eax, [rdx - 0x22]
add r9, 0x50
cmp r9, r10
je 0x1800561fc
jmp 0x180056120
lea r8, [rbp - 0x68]
lea rcx, [rbp - 0x50]
call fcn.18005e300
add rbx, 0x50
cmp rbx, rdi
jne 0x180056210
mov r14d, dword [rbp - 0x80]
mov r15d, dword [rbp - 0x7c]
mov r13d, dword [rbp - 0x78]
mov rcx, rsi
call fcn.1800470b0
mov edx, 0x18
mov rcx, rsi
call fcn.1800f2580
mov r8, qword [rbp - 0x50]
mov r9, qword [rbp - 0x48]
cmp r8, r9
je 0x1800563ec
add r8, 0x14
nop word [rax + rax]
mov eax, dword [r8 - 4]
cdq
idiv r14d
movsxd rcx, eax
mov eax, dword [r8]
cdq
idiv r15d
imul rdx, rcx, 0x1e
cdqe
add rdx, rax
inc dword [rbp + rdx*4 - 0x20]
lea r8, [r8 + 0x18]
lea rax, [r8 - 0x14]
cmp rax, r9
jne 0x1800563c0
xor eax, eax
mov r11d, eax
mov r8d, eax
movsxd r9, r13d
movsxd rsi, dword [rbp - 0x74]
test rsi, rsi
jle 0x18005649d
lea r10, [rbp - 0x20]
nop dword [rax + rax]
mov edx, eax
mov rcx, rax
test r13d, r13d
jle 0x180056435
mov rax, r10
nop dword [rax]
cmp dword [rax], 0
je 0x18005648d
inc edx
inc rcx
add rax, 0x78
cmp rcx, r9
jl 0x180056420
xor eax, eax
inc r11d
inc r8
add r10, 4
cmp r8, rsi
jl 0x180056410
mov edx, eax
mov r11d, eax
mov ebx, eax
mov r10d, eax
lea rdi, [rbp - 0x20]
mov ecx, eax
test r13d, r13d
jle 0x18005647e
mov rax, rdi
mov r8, r9
nop
test edx, edx
je 0x180056468
cmp dword [rax], edx
jge 0x180056470
mov edx, dword [rax]
mov r11d, ecx
mov ebx, r10d
inc ecx
add rax, 0x78
sub r8, 1
jne 0x180056460
xor eax, eax
inc r10d
add rdi, 4
sub rsi, 1
jne 0x180056452
jmp 0x18005649f
mov r9d, r15d
imul r9d, r11d
mov r8d, r14d
imul r8d, edx
jmp 0x1800564ad
mov ebx, eax
mov r9d, r15d
imul r9d, ebx
mov r8d, r14d
imul r8d, r11d
mov dword [rsp + 0x30], 0x40
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r14d
xor edx, edx
mov rcx, r12
call qword [sym.imp.USER32.dll_SetWindowPos]
nop
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x18005652a
mov rax, qword [rbp - 0x40]
sub rax, rcx
sar rax, 3
movabs rdx, 0xaaaaaaaaaaaaaaab
imul rax, rdx
lea rdx, [rax + rax*2]
shl rdx, 3
mov rax, rcx
cmp rdx, 0x1000
jb 0x180056516
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180056556
call fcn.1800f2580
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x50], xmm0
xor r11d, r11d
mov qword [rbp - 0x40], r11
mov al, 1
mov rcx, qword [rbp + 0xdf0]
xor rcx, rsp
call fcn.1800f21e0
mov rbx, qword [rsp + 0xf58]
add rsp, 0xf00
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1800f9714
int3