Function at 0x140001dc0
Capabilities:
Encode data using xor
Hide graphical window
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x178]
sub rsp, 0x240
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
movaps xmmword [rax - 0x68], xmm8
movaps xmmword [rax - 0x78], xmm9
movaps xmmword [rax - 0x88], xmm10
mov dword [rbp + 0x180], 0xfdebfef9
mov word [rbp + 0x184], 0xa3a3
xor eax, eax
mov byte [rbp + 0x186], al
xor r12d, r12d
mov ecx, r12d
mov edx, r12d
nop
lea eax, [rcx - 0x74]
xor byte [rbp + rdx + 0x180], al
inc ecx
movsxd rdx, ecx
cmp rdx, 6
jb 0x140001e20
mov byte [rbp + 0x186], r12b
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
lea rax, [rbp + 0x180]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x140001e65
lea rdx, [rbp + 0x180]
lea rcx, [rsp + 0x60]
call fcn.1400028a0
nop
mov dword [rbp + 0x180], 0xe3e2e9a2
xor eax, eax
mov byte [rbp + 0x184], al
mov ecx, r12d
mov rdx, r12
nop dword [rax]
lea eax, [rcx - 0x74]
xor byte [rbp + rdx + 0x180], al
inc ecx
movsxd rdx, ecx
cmp rdx, 4
jb 0x140001ea0
mov byte [rbp + 0x184], 0
lea rax, [rbp + 0x180]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140001ec3
mov r8, rbx
lea rdx, [rbp + 0x180]
lea rcx, [rsp + 0x60]
call fcn.140002a10
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [rsp + 0x50], 0xc8e2f9de
mov dword [rsp + 0x54], 0xf6c4e5f5
mov dword [rsp + 0x58], 0xf8ffe6e6
mov word [rsp + 0x5c], 0xf6
mov ecx, r12d
mov rdx, r12
nop dword [rax]
lea eax, [rcx - 0x74]
xor byte [rsp + rdx + 0x50], al
inc ecx
movsxd rdx, ecx
cmp rdx, 0xd
jb 0x140001f20
mov byte [rsp + 0x5d], 0
mov dword [rbp + 0x180], 0xe3eaf9e2
mov word [rbp + 0x184], 0xfc
mov ecx, r12d
mov rdx, r12
lea eax, [rcx - 0x74]
xor byte [rbp + rdx + 0x180], al
inc ecx
movsxd rdx, ecx
cmp rdx, 5
jb 0x140001f50
mov byte [rbp + 0x185], 0
lea rcx, [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140002068
mov dword [rbp - 0x30], 0x11c
lea rcx, [rbp - 0x30]
call rax
mov eax, dword [rbp - 0x24]
cmp eax, 0x147f
ja 0x140002000
je 0x140001fd8
cmp eax, 0xa07
ja 0x140001fe8
je 0x14000205b
sub eax, 0x7d0
je 0x140002030
sub eax, 0x10b
je 0x14000205b
sub eax, 0xfe
je 0x14000205b
cmp eax, 3
jne 0x14000204e
mov eax, 0x13cc
mov dword [0x1400b0a94], eax
jmp 0x14000206e
sub eax, 0xa3d
je 0x140001fd8
sub eax, 1
je 0x140001fd8
sub eax, 1
je 0x140001fd8
cmp eax, 0xa22
jmp 0x14000204c
cmp eax, 0x585f
ja 0x14000203d
je 0x140001fd8
sub eax, 0x4f7c
je 0x140001fd8
sub eax, 0x674
je 0x140002030
sub eax, 0x26d
je 0x140001fd8
cmp eax, 1
je 0x140001fd8
mov eax, 0x13c0
mov dword [0x1400b0a94], eax
jmp 0x14000206e
mov eax, 0x13cb
mov dword [0x1400b0a94], eax
jmp 0x14000206e
sub eax, 0x6281
je 0x14000205b
sub eax, 0x1e
je 0x140001fd8
cmp eax, 0x14
je 0x14000205b
mov eax, 0x13c0
mov dword [0x1400b0a94], eax
jmp 0x14000206e
mov eax, 0x13cd
mov dword [0x1400b0a94], eax
jmp 0x14000206e
mov eax, dword [0x1400b0a94]
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x40], r12d
lea rcx, [rbp - 0x50]
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], r12d
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x9302
call fcn.14004d0e0
cmp qword [rbp - 0x48], 0x53a
jne 0x1400027a1
mov rdi, qword [0x1400d2b00]
test rdi, rdi
jne 0x140002145
lea ecx, [rdi + 0x40]
call fcn.14004d134
mov rdi, rax
mov qword [rbp + 0x180], rax
mov qword [rax + 0x20], r12
mov qword [rax], r12
mov qword [rax + 8], r12
movdqa xmm0, xmmword [0x14005c660]
movups xmmword [rax + 0x10], xmm0
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
movd xmm6, eax
cvtdq2ps xmm6, xmm6
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
mov byte [rdi + 0x28], 0
subss xmm6, dword [0x14005c518]
movss dword [rdi + 0x20], xmm6
subss xmm0, dword [0x14005c520]
movss dword [rdi + 0x24], xmm0
movss dword [0x1400b0ab8], xmm6
movss dword [0x1400b0abc], xmm0
mov qword [0x1400d2b00], rdi
mov r14, qword [0x1400d2ad0]
test r14, r14
jne 0x140002180
lea ecx, [r14 + 0x28]
call fcn.14004d134
mov r14, rax
mov qword [rbp + 0x180], rax
mov qword [rax + 8], r12
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], r12
mov qword [rax + 0x20], r12
mov word [rax], 0
mov qword [0x1400d2ad0], rax
cmp qword [0x1400d2b60], 0
jne 0x1400021a2
mov ecx, 1
call fcn.14004d134
mov qword [rbp + 0x180], rax
mov qword [0x1400d2b60], rax
mov r15, qword [0x1400d2ba8]
test r15, r15
jne 0x1400021cb
lea ecx, [r15 + 1]
call fcn.14004d134
mov r15, rax
mov qword [rbp + 0x180], rax
mov byte [rax], 0
mov qword [0x1400d2ba8], rax
mov rsi, qword [0x1400d2b88]
test rsi, rsi
jne 0x140002235
lea ecx, [rsi + 0x38]
call fcn.14004d134
mov rsi, rax
mov qword [rbp + 0x180], rax
mov byte [rax], 0
mov dword [rax + 4], 0x43
mov byte [rax + 8], 1
mov qword [rax + 0xc], 0x42700000
mov byte [rax + 0x14], 1
mov dword [rax + 0x18], 0x41200000
mov byte [rax + 0x1c], 0
mov qword [rax + 0x20], 0x437a0000
mov dword [rax + 0x28], pe_nt_image_headers64
mov byte [rax + 0x2c], 0
mov dword [rax + 0x30], 0x437a0000
mov word [rax + 0x34], 0
mov qword [0x1400d2b88], rax
mov rcx, rdi
call fcn.14003c030
mov rdx, qword [rdi]
mov rcx, r14
call fcn.140001520
test al, al
jne 0x1400022cb
mov rcx, r14
call fcn.1400019e0
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x140002292
inc rdx
mov rcx, qword [rsp + 0x60]
mov r8, rcx
cmp rdx, 0x1000
jb 0x14000228d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub r8, rcx
add r8, 0xfffffffffffffff8
cmp r8, 0x1f
ja 0x14000278e
call fcn.14004d170
mov eax, 1
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x50]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140046560
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
lea r13, [0x14005b158]
movss xmm6, dword [0x14005c548]
movss xmm8, dword [0x14005c560]
movss xmm9, dword [0x14005c540]
movss xmm10, dword [0x14005c54c]
movss xmm7, dword [0x14005c558]
nop dword [rax]
nop word [rax + rax]
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x80]
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x140002357
lea rcx, [rbp - 0x80]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp - 0x80]
call qword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x140002750
movzx eax, byte [rdi + 0x28]
cmp byte [rsi + 0x35], 0
je 0x1400023c6
test al, al
jne 0x14000242d
mov edx, 0xffffffec
lea r8d, [rdx + 0x34]
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_SetWindowLongA]
mov byte [rdi + 0x28], 1
xor edx, edx
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_ShowWindow]
mov edx, 0xffffffec
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_GetWindowLongA]
bts eax, 7
mov r8d, eax
mov edx, 0xffffffec
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_SetWindowLongA]
mov edx, 5
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_UpdateWindow]
jmp 0x14000242d
test al, al
je 0x14000242d
mov edx, 0xffffffec
mov r8d, 0x80020
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_SetWindowLongA]
mov byte [rdi + 0x28], 0
xor edx, edx
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_ShowWindow]
mov edx, 0xffffffec
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_GetWindowLongA]
bts eax, 7
mov r8d, eax
mov edx, 0xffffffec
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_SetWindowLongA]
mov edx, 5
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14000242d
call qword [sym.imp.USER32.dll_SetForegroundWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
lea rdx, [rbp + 0x180]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [rbp + 0x180]
cmp dword [0x1400b0a98], eax
je 0x14000245b
cmp byte [rsi + 0x35], 0
je 0x1400026e3
cmp byte [r14], 0
jne 0x140002618
mov rcx, qword [0x1400d2ae8]
test rcx, rcx
jne 0x140002492
mov r8d, 0xfdd
lea rdx, str.C:UsersemeyDesktopximguiimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rcx, qword [0x1400d2ae8]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r12
movaps xmm3, xmm6
mov r8d, 0x4ba44
lea rdx, [0x140065050]
mov rcx, qword [rcx + 0x58]
call fcn.14002b320
mov rcx, qword [0x1400d2ae8]
test rcx, rcx
jne 0x1400024e2
mov r8d, 0xfdd
lea rdx, str.C:UsersemeyDesktopximguiimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rcx, qword [0x1400d2ae8]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r12
movaps xmm3, xmm8
mov r8d, 0x1eed4
lea rdx, [0x1400b0ac0]
mov rcx, qword [rcx + 0x58]
call fcn.14002b320
mov qword [0x1400d2ab8], rax
mov rcx, qword [0x1400d2ae8]
test rcx, rcx
jne 0x14000253a
mov r8d, 0xfdd
lea rdx, str.C:UsersemeyDesktopximguiimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rcx, qword [0x1400d2ae8]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r12
movaps xmm3, xmm9
mov r8d, 0x4ba44
lea rdx, [0x140065050]
mov rcx, qword [rcx + 0x58]
call fcn.14002b320
mov qword [0x1400d2ab0], rax
mov rcx, qword [0x1400d2ae8]
test rcx, rcx
jne 0x140002592
mov r8d, 0xfdd
lea rdx, str.C:UsersemeyDesktopximguiimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rcx, qword [0x1400d2ae8]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r12
movaps xmm3, xmm10
mov r8d, 0xd84
lea rdx, [0x1400cf9a0]
mov rcx, qword [rcx + 0x58]
call fcn.14002b320
mov qword [0x1400d2ac8], rax
mov rcx, qword [0x1400d2ae8]
test rcx, rcx
jne 0x1400025ea
mov r8d, 0xfdd
lea rdx, str.C:UsersemeyDesktopximguiimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rcx, qword [0x1400d2ae8]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r12
movaps xmm3, xmm7
mov r8d, 0xd84
lea rdx, [0x1400cf9a0]
mov rcx, qword [rcx + 0x58]
call fcn.14002b320
mov qword [0x1400d2ac0], rax
mov byte [r14], 1
mov rbx, qword [0x1400d2ae8]
test rbx, rbx
je 0x140002632
mov rbx, qword [rbx + 0xa0]
test rbx, rbx
jne 0x14000264f
jmp 0x140002635
mov rbx, r12
mov r8d, 0x250
lea rdx, str.C:UsersemeyDesktopximguiimgui_impl_dx11.cpp
lea rcx, str.bd___nullptr___Did_you_call_ImGui_ImplDX11_Init____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
cmp qword [rbx + 0x48], 0
jne 0x14000265b
call fcn.140030860
call fcn.140031a00
call fcn.140009490
call fcn.140046720
cmp byte [rsi + 0x35], 0
je 0x140002678
mov rcx, r15
call fcn.14004ac90
call fcn.14000b910
mov rcx, qword [r14 + 0x10]
mov rax, qword [rcx]
xor r9d, r9d
lea r8, [r14 + 0x20]
lea edx, [r9 + 1]
call qword [rax + 0x108]
mov rcx, qword [r14 + 0x10]
mov rax, qword [rcx]
lea r8, [0x14004fad8]
mov rdx, qword [r14 + 0x20]
call qword [rax + 0x190]
mov rax, qword [0x1400d2ae8]
mov rax, qword [rax + 0x4878]
mov rcx, qword [rax]
add rcx, 0x48
mov rax, r12
cmp byte [rcx], r12b
cmovne rax, rcx
mov rcx, rax
call fcn.14002fe20
mov rcx, qword [r14 + 0x18]
mov rax, qword [rcx]
xor r8d, r8d
xor edx, edx
call qword [rax + 0x40]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
lea rdx, [rbp + 0x188]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [rbp + 0x188]
cmp dword [0x1400b0a98], eax
jne 0x140002750
cmp qword [rdi + 8], 0
jne 0x140002718
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rdi + 8], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
mov edx, 3
call qword [sym.imp.USER32.dll_GetWindow]
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_SetWindowPos]
cmp dword [rbp - 0x78], 0x12
jne 0x140002320
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x14000279a
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002795
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002795
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004d170
xor eax, eax
jmp 0x140002297
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3