Function at 0x140097930
Capabilities:
Access peb ldr_data
Encode data using xor
Enumerate gui resources
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x1401210c0]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rsi, rdx
mov rbp, rcx
mov qword [rsp + 0x20], rdx
mov ecx, dword [0x140128630]
call fcn.14008e920
test al, al
jne 0x1400979a6
mov ecx, dword [0x140128634]
call fcn.14008e920
test al, al
jne 0x1400979a6
mov ecx, dword [0x140128638]
call fcn.14008e920
test al, al
jne 0x1400979a6
mov ecx, dword [0x14012863c]
call fcn.14008e920
test al, al
jne 0x1400979a6
xor edx, edx
lea rcx, [0x14008b390]
call qword [sym.imp.USER32.dll_EnumWindows]
jmp 0x140097a56
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140097a36
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140097a36
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
mov r8d, 0x344938bb
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140097a31
nop
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x140097a10
cmp r8d, 0xa44a68b
je 0x140097a3b
test r9d, r9d
jne 0x1400979f0
mov rax, qword [rax]
jmp 0x1400979c0
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rbx + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
xor ecx, ecx
call rdx
lea rdx, str.numUsers
mov rcx, rsi
call fcn.14007b160
xor ebx, ebx
cmp byte [rax], 3
jne 0x140097a72
mov r8, qword [rax + 8]
jmp 0x140097a75
mov r8, rbx
mov rdx, r8
cmp qword [r8 + 0x18], 0xf
jbe 0x140097a82
mov rdx, qword [r8]
lea rcx, [rbp + 0xa0]
mov r8, qword [r8 + 0x10]
call fcn.1400777c0
lea rdx, str.numOnlineUsers
mov rcx, rsi
call fcn.14007b160
cmp byte [rax], 3
jne 0x140097aac
mov r8, qword [rax + 8]
jmp 0x140097aaf
mov r8, rbx
mov rdx, r8
cmp qword [r8 + 0x18], 0xf
jbe 0x140097abc
mov rdx, qword [r8]
lea rcx, [rbp + 0xc0]
mov r8, qword [r8 + 0x10]
call fcn.1400777c0
lea rdx, str.numKeys
mov rcx, rsi
call fcn.14007b160
cmp byte [rax], 3
jne 0x140097ae6
mov r8, qword [rax + 8]
jmp 0x140097ae9
mov r8, rbx
mov rdx, r8
cmp qword [r8 + 0x18], 0xf
jbe 0x140097af6
mov rdx, qword [r8]
lea rcx, [rbp + 0xe0]
mov r8, qword [r8 + 0x10]
call fcn.1400777c0
lea rdx, str.version
mov rcx, rsi
call fcn.14007b160
cmp byte [rax], 3
jne 0x140097b20
mov r8, qword [rax + 8]
jmp 0x140097b23
mov r8, rbx
mov rdx, r8
cmp qword [r8 + 0x18], 0xf
jbe 0x140097b30
mov rdx, qword [r8]
lea rcx, [rbp + 0x100]
mov r8, qword [r8 + 0x10]
call fcn.1400777c0
lea rdx, str.customerPanelLink
mov rcx, rsi
call fcn.14007b160
cmp byte [rax], 3
jne 0x140097b58
mov rbx, qword [rax + 8]
mov rdx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x140097b65
mov rdx, qword [rbx]
lea rcx, [rbp + 0x120]
mov r8, qword [rbx + 0x10]
call fcn.1400777c0
nop
lea rcx, [rsi + 8]
movzx edx, byte [rsi]
call fcn.140076e90
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400eaeb0
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret