Function at 0x180057380
Capabilities:
Access peb ldr_data
Encode data using xor
Enumerate gui resources
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x170
lea rbp, [rsp + 0x40]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x180102040]
xor rax, rsp
mov qword [rbp + 0x120], rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x180057447
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x180057447
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rbx + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x180057442
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x180057420
cmp r8d, 0xe463da3c
je 0x18005744c
test r9d, r9d
jne 0x180057400
mov rax, qword [rax]
jmp 0x1800573d0
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rcx, str.cod.exe
add rax, r10
call rax
mov qword [0x1801fedf0], rax
call fcn.180052ba0
call fcn.180056ac0
mov rcx, qword [0x1801fedd8]
test rcx, rcx
jne 0x1800574a5
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
lea rcx, [0x180056f70]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rcx, qword [0x1801fedd8]
cmp byte [0x1801feda3], 0
mov qword [0x1801fede0], rcx
je 0x1800574c0
mov edx, 0x11
call qword [sym.imp.USER32.dll_SetWindowDisplayAffinity]
movabs rax, 0xa373ae915f2d7719
lea r8, [rbp]
mov qword [rbp], rax
lea rcx, [rbp + 0x60]
movabs rdi, 0x1b9695bb6efa8924
movabs rsi, 0xa373aea26d0d315f
mov qword [rbp + 8], rdi
movdqa xmm0, xmmword [rbp]
mov qword [rbp + 0x60], rsi
mov qword [rbp + 0x68], rdi
xorps xmm0, xmmword [rbp + 0x60]
movdqa xmmword [rbp], xmm0
call fcn.180056fe0
movabs r15, 0x90378928aa309ad1
mov qword [rbp + 0xc0], rsi
movabs r14, 0xc59bbe3117990046
mov qword [rbp + 0xc8], rdi
mov qword [rbp + 0xd0], r15
lea r8, [rbp]
mov rcx, qword [rax]
movabs r13, 0xcd2470eefdb75593
movabs rax, 0x9c539182522d091a
mov qword [rbp + 0xd8], r14
vmovdqu ymm0, ymmword [rbp + 0xc0]
mov qword [rbp], rax
movabs r12, 0xbee8bff72d5524b8
movabs rax, 0x2aaeb5835adab604
mov qword [rbp + 0xe0], r13
mov qword [rbp + 8], rax
movabs rbx, 0x96d9cbedc01152fa
movabs rax, 0xb008a9178a03d9f1
mov qword [rbp + 0xe8], r12
mov qword [rbp + 0x10], rax
movabs rax, 0xfdbb860537a62079
mov qword [rbp + 0x18], rax
movabs rax, 0xed1540ceb8f275a0
vpxor ymm1, ymm0, ymmword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0x9ed79fc215756288
mov qword [rbp + 0x28], rax
movabs rax, 0xfef0196bba5e77da
mov qword [rbp + 0x30], rax
movabs rax, 0xa4f9ffdae0536ada
mov qword [rbp + 0x38], rax
movabs rax, 0x55a69aaee933b953
mov qword [rbp + 0x40], rax
movabs rax, 0xd2396913b5fb150e
mov qword [rbp + 0x48], rax
movabs rax, 0x5819c2a0e4461b26
mov qword [rbp + 0x50], rax
movabs rax, 0x1e0e3d7391be99
mov qword [rbp + 0x58], rax
movabs rax, 0xc6c439549a6157e5
mov qword [rbp + 0xf0], rax
movabs rax, 0x6d86a29ac90c9967
mov qword [rbp + 0x100], rax
movabs rax, 0xf20d5b33f6ce354c
mov qword [rbp + 0x108], rax
movabs rax, 0x785dfa80dc723b19
vmovdqa ymmword [rbp], ymm1
mov qword [rbp + 0x110], rax
movabs rax, 0x1e0e0941b1fdae
mov qword [rbp + 0xf8], rbx
vmovdqu ymm0, ymmword [rbp + 0xe0]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x20], ymm1
mov qword [rbp + 0x118], rax
vmovdqu ymm0, ymmword [rbp + 0x100]
vpxor ymm1, ymm0, ymmword [rbp + 0x40]
mov qword [0x1801feef0], rcx
lea rcx, [rbp + 0x60]
vmovdqa ymmword [rbp + 0x40], ymm1
vzeroupper
call fcn.180056fe0
mov rdx, rax
mov rcx, qword [rax]
xor eax, eax
test rcx, rcx
jne 0x1800576ca
mov ecx, eax
jmp 0x1800576d5
movsxd rax, dword [rcx + 1]
add rcx, 5
add rcx, rax
mov qword [rdx], rcx
movabs rax, 0x92458e925a2d0968
mov qword [rbp + 0x60], rax
movabs rax, 0x2cb6a18c4ec8be04
mov qword [rbp + 0x68], rax
movabs rax, 0xb00ebf089e06bae8
mov qword [rbp + 0x70], rax
movabs rax, 0xf4ad9e0321b93371
mov qword [rbp + 0x78], rax
movabs rax, 0xfb0444d8ddf263b3
mov qword [rbp + 0x80], rax
movabs rax, 0x9edc88d71b630489
mov qword [rbp + 0x88], rax
movabs rax, 0xf4f31966ad4162d3
mov qword [rbp + 0x90], rax
movabs rax, 0xa0f9fedae05764da
mov qword [rbp + 0x98], rax
movabs rax, 0x4dc792bafd3ab922
mov qword [rbp + 0xa0], rax
movabs rax, 0xf2327b0cd6f11573
mov qword [rbp + 0xa8], rax
movabs rax, 0x6d86a29ac90c9967
movdqa xmm2, xmmword [rbp + 0xa0]
mov qword [0x1801feee8], rcx
movabs rcx, 0xc6c439549a6157e5
mov qword [rbp + 0x40], rax
movabs rax, 0xf20d5b33f6ce354c
mov qword [rbp + 0x30], rcx
mov ecx, 1
mov qword [rbp], rsi
mov qword [rbp + 8], rdi
mov qword [rbp + 0x10], r15
mov qword [rbp + 0x18], r14
vmovdqu ymm0, ymmword [rbp]
vpxor ymm1, ymm0, ymmword [rbp + 0x60]
vmovdqa ymmword [rbp + 0x60], ymm1
mov qword [rbp + 0x20], r13
mov qword [rbp + 0x28], r12
mov qword [rbp + 0x38], rbx
vmovdqu ymm0, ymmword [rbp + 0x20]
vpxor ymm1, ymm0, ymmword [rbp + 0x80]
mov qword [rbp + 0x48], rax
vxorps xmm2, xmm2, xmmword [rbp + 0x40]
vmovdqa xmmword [rbp + 0xa0], xmm2
vmovdqa ymmword [rbp + 0x80], ymm1
vzeroupper
call fcn.180046650
mov ecx, 2
lea rbx, [rax + 0x500000]
call fcn.180046650
lea r8, [rbp + 0x60]
mov rcx, rbx
lea rdx, [rax - 0x500000]
add rdx, rbx
call fcn.180046760
movabs rdx, 0x7ffffffeefff
lea rcx, [rax - 0x1000]
cmp rcx, rdx
ja 0x18005784a
mov cl, 1
jmp 0x18005784c
xor cl, cl
test cl, cl
mov qword [rbp + 0x60], rsi
mov ecx, 0
mov qword [rbp + 0x68], rdi
cmove rax, rcx
mov qword [rbp + 0x70], r15
mov qword [0x1801fedc8], rax
movabs rcx, 0xf20d5b33f6ce354c
movabs rax, 0xc60acfce3d527d1c
mov qword [rbp + 0x78], r14
vmovdqu ymm0, ymmword [rbp + 0x60]
mov qword [rbp], rax
movabs rax, 0x7ec5cada1a9bcd56
mov qword [rbp + 8], rax
movabs rax, 0xf756dd46cb5cd9a5
mov qword [rbp + 0x10], rax
movabs rax, 0x9c539182522d091a
mov qword [rbp + 0xc0], rax
movabs rax, 0x59aeb5835adab604
mov qword [rbp + 0xc8], rax
movabs rax, 0xaf17bd1a8a73aff1
mov qword [rbp + 0xd0], rax
movabs rax, 0xf1bbfc0937a13466
mov qword [rbp + 0xd8], rax
movabs rax, 0xf9044fcec98575d0
mov qword [rbp + 0xe0], rax
movabs rax, 0x9eabfcd71e660480
mov qword [rbp + 0xe8], rax
movabs rax, 0xf9e40674a5416fa0
mov qword [rbp + 0xf0], rax
movabs rax, 0xd4e1ebd5f4316dda
mov qword [rbp + 0xf8], rax
movabs rax, 0x6d8696a8e938db47
mov qword [rbp + 0x100], rax
movabs rax, 0xc6c439549a6157e5
mov qword [rbp + 0x90], rax
movabs rax, 0x96d9cbedc01152fa
mov qword [rbp + 0x108], rcx
vmovdqa xmm2, xmmword [rbp + 0x100]
mov qword [rbp + 0x18], r14
vpxor ymm1, ymm0, ymmword [rbp]
vmovdqa ymmword [rbp], ymm1
mov qword [rbp + 0x98], rax
movabs rax, 0x6d86a29ac90c9967
mov qword [rbp + 0xa8], rcx
mov ecx, 1
mov qword [rbp + 0x60], rsi
mov qword [rbp + 0x68], rdi
mov qword [rbp + 0x70], r15
mov qword [rbp + 0x78], r14
vmovdqu ymm0, ymmword [rbp + 0x60]
vpxor ymm1, ymm0, ymmword [rbp + 0xc0]
vmovdqa ymmword [rbp + 0xc0], ymm1
mov qword [rbp + 0x80], r13
mov qword [rbp + 0x88], r12
vmovdqu ymm0, ymmword [rbp + 0x80]
vpxor ymm1, ymm0, ymmword [rbp + 0xe0]
mov qword [rbp + 0xa0], rax
vxorps xmm2, xmm2, xmmword [rbp + 0xa0]
vmovdqa xmmword [rbp + 0x100], xmm2
vmovdqa ymmword [rbp + 0xe0], ymm1
vzeroupper
call fcn.180046650
mov ecx, 2
lea rbx, [rax + 0x500000]
call fcn.180046650
lea r8, [rbp + 0xc0]
mov rcx, rbx
lea rdx, [rax - 0x500000]
add rdx, rbx
call fcn.180046760
movabs rax, 0x9b438e92582d7719
mov qword [rbp + 0x60], rax
movabs rax, 0x2bb6a5f84eceb104
mov qword [rbp + 0x68], rax
movabs rax, 0xaf17b6089e08ba97
mov qword [rbp + 0x70], rax
movabs rax, 0xe5ae861128b93f66
mov qword [rbp + 0x78], rax
movabs rax, 0xf91c50a8cd9713d5
mov qword [rbp + 0x80], rax
mov qword [rbp + 0x88], r12
mov ecx, 1
mov qword [rbp], rsi
mov qword [rbp + 8], rdi
mov qword [rbp + 0x10], r15
mov qword [rbp + 0x18], r14
vmovdqu ymm0, ymmword [rbp]
vpxor ymm1, ymm0, ymmword [rbp + 0x60]
mov qword [rbp + 0x20], r13
mov qword [rbp + 0x28], r12
vmovdqa xmm2, xmmword [rbp + 0x20]
vxorps xmm2, xmm2, xmmword [rbp + 0x80]
vmovdqa ymmword [rbp + 0x60], ymm1
vmovdqa xmmword [rbp + 0x80], xmm2
vzeroupper
call fcn.180046650
mov ecx, 2
lea rbx, [rax + 0x500000]
call fcn.180046650
lea r8, [rbp + 0x60]
mov rcx, rbx
lea rdx, [rax - 0x500000]
add rdx, rbx
call fcn.180046760
movabs rax, 0x96428ee6552d096b
mov qword [rbp + 0x60], rsi
mov qword [rbp], rax
movabs rcx, 0xc6c439549a6157e5
movabs rax, 0x24b6aa9b51dab604
mov qword [rbp + 0x90], rcx
mov qword [rbp + 8], rax
mov ecx, 1
movabs rax, 0xa517b0108a08aef1
mov qword [rbp + 0x68], rdi
mov qword [rbp + 0x10], rax
movabs rax, 0xfdbb811123ab2072
mov qword [rbp + 0x18], rax
movabs rax, 0xed1033cecef375d1
mov qword [rbp + 0x20], rax
movabs rax, 0xfdda9fb56b75158e
mov qword [rbp + 0x28], rax
movabs rax, 0xc6c439549a5114c5
mov qword [rbp + 0x30], rax
movabs rax, 0x96d9cbedc01152fa
mov qword [rbp + 0x38], rax
mov qword [rbp + 0x70], r15
mov qword [rbp + 0x78], r14
vmovdqu ymm0, ymmword [rbp + 0x60]
vpxor ymm1, ymm0, ymmword [rbp]
vmovdqa ymmword [rbp], ymm1
mov qword [rbp + 0x98], rax
mov qword [rbp + 0x80], r13
mov qword [rbp + 0x88], r12
vmovdqu ymm0, ymmword [rbp + 0x80]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x20], ymm1
vzeroupper
call fcn.180046650
mov ecx, 2
lea rbx, [rax + 0x500000]
call fcn.180046650
lea r8, [rbp]
mov rcx, rbx
lea rdx, [rax - 0x500000]
add rdx, rbx
call fcn.180046760
mov rcx, qword [rbp + 0x120]
xor rcx, rsp
call fcn.18005a430
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret