Function at 0x14004a4d0
Capabilities:
Encode data using xor
Enumerate gui resources

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
push rbp
lea rbp, [r11 - 0x78]
sub rsp, 0x170
mov rax, qword [0x14006b060]
xor rax, rsp
mov qword [rbp + 0x10], rax
mov rcx, qword [0x1401a3ec8]
mov esi, 4
test rcx, rcx
jne 0x14004a6b2
vmovaps xmmword [r11 - 0x18], xmm6
lea ebx, [rsi + 0x1b]
vmovaps xmmword [r11 - 0x28], xmm7
vmovaps xmmword [r11 - 0x38], xmm8
vmovaps xmmword [r11 - 0x48], xmm9
vmovaps xmmword [r11 - 0x58], xmm10
nop
cmp byte [0x140061abd], 0
mov eax, dword [0x140061ab8]
vmovsd xmm0, qword [0x140061ab0]
mov dword [rsp + 0x68], eax
movzx eax, word [0x140061abc]
mov word [rsp + 0x6c], ax
vmovsd qword [rsp + 0x60], xmm0
je 0x14004a656
vmovdqu xmm5, xmmword [0x140061ed0]
vmovdqu xmm8, xmmword [0x140062020]
vpunpckldq xmm0, xmm5, xmm5
vpmuldq xmm3, xmm0, xmm8
vpunpckhdq xmm1, xmm5, xmm5
vpmuldq xmm2, xmm1, xmm8
vshufps xmm0, xmm3, xmm2, 0xdd
vmovd xmm7, esi
vpsrad xmm4, xmm0, xmm7
vmovd xmm6, ebx
vpsrld xmm1, xmm4, xmm6
vpaddd xmm0, xmm1, xmm4
vpmulld xmm2, xmm0, xmmword [0x140061f20]
vmovd xmm1, dword [0x140061ab0]
vpsubd xmm3, xmm5, xmm2
vpshufb xmm0, xmm3, xmmword [0x140061e90]
vpaddb xmm2, xmm0, xmmword [0x140061fe0]
vmovdqu xmm5, xmmword [0x140061ee0]
vpxor xmm0, xmm2, xmm1
vmovd dword [rsp + 0x60], xmm0
vpunpckldq xmm0, xmm5, xmm5
vpmuldq xmm3, xmm0, xmm8
vpunpckhdq xmm1, xmm5, xmm5
vpmuldq xmm2, xmm1, xmm8
vshufps xmm0, xmm3, xmm2, 0xdd
vpsrad xmm4, xmm0, xmm7
vpsrld xmm1, xmm4, xmm6
vpaddd xmm0, xmm1, xmm4
vpmulld xmm2, xmm0, xmmword [0x140061f20]
vmovd xmm1, dword [rsp + 0x64]
vpsubd xmm3, xmm5, xmm2
vpshufb xmm0, xmm3, xmmword [0x140061e90]
vpaddb xmm2, xmm0, xmmword [0x140061fe0]
vpxor xmm0, xmm2, xmm1
vmovd dword [rsp + 0x64], xmm0
mov ecx, 8
lea r8, [rsp + 0x68]
nop
mov eax, 0x5397829d
lea r8, [r8 + 1]
mul ecx
shr edx, 4
movsx eax, dl
imul edx, eax, 0x31
movzx eax, cl
inc ecx
sub al, dl
add al, 0x30
xor byte [r8 - 1], al
cmp ecx, 0xe
jl 0x14004a630
xor edx, edx
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_FindWindowA]
mov ecx, 0x64
mov qword [0x1401a3ec8], rax
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x1401a3ec8]
test rcx, rcx
je 0x14004a530
vmovaps xmm10, xmmword [rsp + 0x120]
vmovaps xmm9, xmmword [rsp + 0x130]
vmovaps xmm8, xmmword [rsp + 0x140]
vmovaps xmm7, xmmword [rsp + 0x150]
vmovaps xmm6, xmmword [rsp + 0x160]
cmp dword [0x14006bcb4], 0x2bc
jge 0x14004a707
nop
lea rdx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rsp + 0x78]
mov ecx, 0x64
sub eax, dword [rsp + 0x70]
mov dword [0x14006bcb4], eax
mov eax, dword [rsp + 0x7c]
sub eax, dword [rsp + 0x74]
mov dword [0x14006bcb0], eax
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x14006bcb4], 0x2bc
jge 0x14004a707
mov rcx, qword [0x1401a3ec8]
jmp 0x14004a6c0
xor edi, edi
mov dword [rbp - 0x40], 0x50
lea rax, [0x140041f20]
mov qword [rbp - 0x30], rdi
xor ecx, ecx
mov qword [rbp - 0x20], rdi
mov qword [rbp - 8], rdi
mov qword [rbp + 8], rdi
mov qword [rbp - 0x38], rax
mov dword [rbp - 0x3c], 3
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edx, 0x7f00
xor ecx, ecx
mov qword [rbp - 0x28], rax
call qword [sym.imp.USER32.dll_LoadCursorA]
lea rcx, [rbp - 0x40]
mov qword [rbp - 0x10], rdi
mov qword [rbp - 0x18], rax
lea rax, str.Chrome_WidgetWin_1
mov qword [rbp], rax
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov rax, qword [rbp - 0x28]
lea r8, str.Chrome
mov rdx, qword [rbp]
mov r9d, 0x80000000
mov qword [rsp + 0x58], rdi
mov ecx, 0x80020
mov qword [rsp + 0x50], rax
mov eax, dword [0x14006bcb0]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x38], eax
mov eax, dword [0x14006bcb4]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExW]
lea r9d, [rdi + 1]
xor r8d, r8d
mov rcx, rax
mov qword [0x1401a3eb8], rax
xor edx, edx
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
mov rcx, qword [0x1401a3eb8]
lea r9d, [rdi + 2]
mov r8b, 0xff
xor edx, edx
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
mov rcx, qword [0x1401a3eb8]
lea edx, [rdi + 5]
call qword [sym.imp.USER32.dll_ShowWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
lea rcx, [0x14004e960]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rbx, qword [0x1401a3eb8]
lea ecx, [rdi + 0x20]
call qword [sym.imp.d3d9.dll_Direct3DCreate9]
mov ecx, dword [0x14006bcb4]
mov r10, rax
mov dword [rbp - 0x80], ecx
mov ecx, dword [0x14006bcb0]
mov dword [rbp - 0x7c], ecx
lea rcx, [0x1401a3e98]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp - 0x80]
mov qword [0x1401a3ea0], rax
mov qword [rbp - 0x74], rdi
mov dword [rbp - 0x6c], edi
mov qword [rbp - 0x68], 1
mov qword [rbp - 0x4c], rdi
mov dword [rbp - 0x44], edi
mov dword [rbp - 0x58], 1
mov qword [rbp - 0x60], rbx
mov dword [rbp - 0x78], 0x15
mov dword [rbp - 0x54], 1
mov dword [rbp - 0x50], 0x50
mov rax, qword [rax]
mov qword [rsp + 0x28], rcx
mov r9, rbx
mov dword [rsp + 0x20], 0x20
xor edx, edx
lea r8d, [rdi + 1]
mov rcx, r10
call qword [rax + 0x80]
mov rcx, qword [0x1401a3e98]
lea rax, [0x1401a3eb0]
mov qword [rsp + 0x58], rax
lea edx, [rdi + 0xf]
lea rax, [0x140060b70]
mov r9d, 0x190
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov dword [rsp + 0x48], edi
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 1
call qword [sym.imp.d3dx9_43.dll_D3DXCreateFontA]
mov rcx, qword [0x1401a3e98]
lea rdx, [0x1401a3ea8]
call qword [sym.imp.d3dx9_43.dll_D3DXCreateLine]
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.14000ee10
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret