Function at 0x140022ca0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov eax, 0xb201
mov edx, 0xb207
mov word [rsp + 0x50], ax
mov ecx, 0xb209
mov eax, 0xb22c
xor ebx, ebx
mov word [rsp + 0x52], ax
mov r8d, ebx
mov eax, 0xb269
mov r9d, reloc.WS2_32.dll_ntohs
mov word [rsp + 0x54], ax
movabs r10, 0x750ee07212fdb25c
mov eax, 0xb205
mov r11d, 0x4da4
mov word [rsp + 0x56], ax
mov eax, 0xb23a
mov word [rsp + 0x58], ax
mov eax, 0xb20e
mov word [rsp + 0x5a], dx
mov word [rsp + 0x5c], ax
mov eax, 0xb206
mov word [rsp + 0x5e], ax
mov eax, 0xb215
mov word [rsp + 0x60], cx
mov word [rsp + 0x62], ax
mov eax, 0xb22f
mov word [rsp + 0x64], ax
mov eax, 0xb20a
mov word [rsp + 0x66], ax
mov eax, 0xb26f
mov word [rsp + 0x68], cx
mov word [rsp + 0x6a], dx
mov word [rsp + 0x6c], ax
movzx eax, word [rsp + 0x50]
movzx eax, word [rsp + r8*2 + 0x50]
mov rcx, r8
and ecx, r9d
mov rdx, r10
cmp rcx, r9
cmovae rcx, r9
shl cl, 2
shr rdx, cl
and dx, r9w
xor dx, ax
movzx eax, r8w
sub ax, r11w
xor dx, ax
mov word [rsp + r8*2 + 0x50], dx
inc r8
cmp r8, r9
jb 0x140022d70
mov eax, 0xeb50
mov edx, 0xeb7f
mov word [rsp + 0x30], ax
mov ecx, 0xeb7d
mov word [rsp + 0x32], dx
mov eax, 0xeb6a
mov word [rsp + 0x34], ax
mov r8, rbx
mov eax, 0xeb62
movabs r10, 0xfc2bfe9b6258eb0c
mov word [rsp + 0x36], ax
mov r11d, 0x14f4
mov word [rsp + 0x38], cx
mov eax, 0xeb67
mov word [rsp + 0x3a], ax
mov eax, 0xeb63
mov word [rsp + 0x3c], ax
mov eax, 0xeb5d
mov word [rsp + 0x3e], ax
mov eax, 0xeb7e
mov word [rsp + 0x40], ax
mov eax, 0xeb73
mov word [rsp + 0x42], dx
mov word [rsp + 0x44], ax
mov eax, 0xeb61
mov word [rsp + 0x46], cx
mov word [rsp + 0x48], ax
mov eax, 0xeb1b
mov word [rsp + 0x4a], ax
movzx eax, word [rsp + 0x30]
nop word [rax + rax]
movzx eax, word [rsp + r8*2 + 0x30]
mov rcx, r8
and ecx, r9d
mov rdx, r10
cmp rcx, r9
cmovae rcx, r9
shl cl, 2
shr rdx, cl
and dx, r9w
xor dx, ax
movzx eax, r8w
sub ax, r11w
xor dx, ax
mov word [rsp + r8*2 + 0x30], dx
inc r8
cmp r8, 0xe
jb 0x140022e50
mov ecx, 0x3105
mov edx, 0x311d
mov word [rsp + 0x70], dx
mov eax, 0x3139
mov word [rsp + 0x72], ax
mov r12d, 0x3136
mov word [rsp + 0x74], r12w
mov eax, 0x3132
mov word [rsp + 0x76], ax
mov r15d, 0x3137
mov word [rsp + 0x78], r15w
mov eax, 0x3107
mov word [rsp + 0x7a], cx
mov r13d, 0x3104
mov word [rsp + 0x7c], r13w
mov r14d, 0x3101
mov word [rsp + 0x7e], ax
mov r8, rbx
mov eax, 0x3108
movabs r10, 0x640c8b1308d0315c
mov word [rbp - 0x80], ax
mov r11d, 0x315c
mov eax, 0x3113
mov word [rbp - 0x7e], ax
mov eax, 0x312e
mov word [rbp - 0x7c], ax
mov eax, 0x3103
mov word [rbp - 0x7a], ax
mov eax, 0x311a
mov word [rbp - 0x78], cx
mov word [rbp - 0x76], ax
mov eax, 0x3123
mov word [rbp - 0x74], dx
mov word [rbp - 0x72], ax
mov eax, 0x310a
mov word [rbp - 0x70], r14w
mov word [rbp - 0x6e], cx
mov word [rbp - 0x6c], ax
mov eax, 0x316c
mov word [rbp - 0x6a], ax
movzx eax, word [rsp + 0x70]
nop word [rax + rax]
movzx eax, word [rsp + r8*2 + 0x70]
mov rcx, r8
and ecx, r9d
mov rdx, r10
cmp rcx, r9
cmovae rcx, r9
shl cl, 2
shr rdx, cl
and dx, r9w
xor dx, ax
lea eax, [r11 + r8]
xor dx, ax
mov word [rsp + r8*2 + 0x70], dx
inc r8
cmp r8, 0x14
jb 0x140022f60
mov eax, 0xf8d4
mov r8, rbx
mov word [rsp + 0x20], ax
movabs rdi, 0xaa975a865644f8b4
mov eax, 0xf8d7
mov esi, 0x74c
mov word [rsp + 0x22], ax
mov eax, 0xf8cd
mov word [rsp + 0x24], ax
mov eax, 0xf8db
mov word [rsp + 0x26], ax
mov eax, 0xf8d3
mov word [rsp + 0x28], ax
mov eax, 0xf8cf
mov word [rsp + 0x2a], ax
mov eax, 0xf8d8
mov word [rsp + 0x2c], ax
mov eax, 0xf8be
mov word [rsp + 0x2e], ax
movzx eax, word [rsp + 0x20]
movzx eax, word [rsp + r8*2 + 0x20]
mov rcx, r8
and ecx, r9d
mov rdx, rdi
cmp rcx, r9
cmovae rcx, r9
shl cl, 2
shr rdx, cl
and dx, r9w
xor dx, ax
movzx eax, r8w
sub ax, si
xor dx, ax
mov word [rsp + r8*2 + 0x20], dx
inc r8
cmp r8, 8
jb 0x140023000
mov edx, 0xf0a8
mov r8d, 0xf0a2
mov ecx, 0xf0af
mov eax, 0xf0e7
mov word [rbp - 0x40], ax
movabs rdi, 0x565040993e7f0bc
mov eax, 0xf0df
mov esi, 0xf44
mov word [rbp - 0x3e], ax
mov eax, 0xf0d0
mov word [rbp - 0x3c], ax
mov eax, 0xf0d4
mov word [rbp - 0x3a], ax
mov eax, 0xf0b8
mov word [rbp - 0x38], dx
mov word [rbp - 0x36], ax
mov eax, 0xf0b2
mov word [rbp - 0x34], ax
mov eax, 0xf08c
mov word [rbp - 0x32], ax
mov eax, 0xf0b7
mov word [rbp - 0x30], r8w
mov word [rbp - 0x2e], ax
mov eax, 0xf0b4
mov word [rbp - 0x2c], cx
mov word [rbp - 0x2a], ax
mov eax, 0xf0fc
mov word [rbp - 0x28], ax
mov eax, 0xf0ff
mov word [rbp - 0x26], ax
mov eax, 0xf0e1
mov word [rbp - 0x24], ax
mov eax, 0xf09c
mov word [rbp - 0x22], ax
mov eax, 0xf0a9
mov word [rbp - 0x20], ax
mov eax, 0xf0aa
mov word [rbp - 0x1e], dx
mov edx, 0xf0e9
mov word [rbp - 0x1c], ax
mov eax, 0xf0a0
mov word [rbp - 0x1a], cx
mov ecx, 0xf0f1
mov word [rbp - 0x18], ax
mov eax, 0xf0f4
mov word [rbp - 0x16], cx
mov word [rbp - 0x14], dx
mov word [rbp - 0x12], ax
mov eax, 0xf0bc
mov word [rbp - 0x10], ax
mov eax, 0xf0a5
mov word [rbp - 0xe], ax
mov eax, 0xf0f9
mov word [rbp - 0xc], r8w
mov r8, rbx
mov word [rbp - 0xa], ax
mov eax, 0xf0ed
mov word [rbp - 8], ax
mov eax, 0xf0ec
mov word [rbp - 6], cx
mov word [rbp - 4], ax
mov eax, 0xf0e8
mov word [rbp - 2], ax
mov eax, 0xf0b3
mov word [rbp], ax
mov eax, 0xf0e6
mov word [rbp + 2], ax
mov eax, 0xf0ba
mov word [rbp + 4], ax
mov eax, 0xf083
mov word [rbp + 6], dx
mov word [rbp + 8], ax
mov eax, 0xf0ef
mov word [rbp + 0xa], ax
movzx eax, word [rbp - 0x40]
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rbp + r8*2 - 0x40]
mov rcx, r8
and ecx, r9d
mov rdx, rdi
cmp rcx, r9
cmovae rcx, r9
shl cl, 2
shr rdx, cl
and dx, r9w
xor dx, ax
movzx eax, r8w
sub ax, si
xor dx, ax
mov word [rbp + r8*2 - 0x40], dx
inc r8
cmp r8, 0x26
jb 0x1400231a0
mov word [rbp - 0x68], r14w
mov eax, 0x312c
mov word [rbp - 0x66], ax
mov r8, rbx
mov eax, 0x316a
mov word [rbp - 0x64], ax
mov eax, 0x316d
mov word [rbp - 0x62], ax
mov eax, 0x3155
mov word [rbp - 0x60], ax
mov eax, 0x315f
mov word [rbp - 0x5e], ax
mov eax, 0x313b
mov word [rbp - 0x5c], ax
mov eax, 0x3133
mov word [rbp - 0x5a], r15w
mov word [rbp - 0x58], r12w
mov word [rbp - 0x56], ax
mov eax, 0x3100
mov word [rbp - 0x54], r13w
mov word [rbp - 0x52], r14w
mov word [rbp - 0x50], ax
mov eax, 0x3106
mov word [rbp - 0x4e], ax
mov eax, 0x3119
mov word [rbp - 0x4c], ax
mov eax, 0x3124
mov word [rbp - 0x4a], ax
mov eax, 0x3103
mov word [rbp - 0x48], ax
mov eax, 0x3107
mov word [rbp - 0x46], ax
mov eax, 0x316c
mov word [rbp - 0x44], r14w
mov word [rbp - 0x42], ax
movzx eax, word [rbp - 0x68]
nop
movzx eax, word [rbp + r8*2 - 0x68]
mov rcx, r8
and ecx, r9d
mov rdx, r10
cmp rcx, r9
cmovae rcx, r9
shl cl, 2
shr rdx, cl
and dx, r9w
xor dx, ax
lea eax, [r11 + r8]
xor dx, ax
mov word [rbp + r8*2 - 0x68], dx
inc r8
cmp r8, 0x14
jb 0x140023280
xor edx, edx
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
lea rcx, [rsp + 0x30]
setne bl
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
mov edi, 1
lea rcx, [rsp + 0x70]
test rax, rax
cmovne ebx, edi
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
lea rcx, [rsp + 0x20]
cmovne ebx, edi
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
lea rcx, [rbp - 0x40]
cmovne ebx, edi
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
lea rcx, [rbp - 0x68]
cmovne ebx, edi
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
lea rcx, str.Window
cmovne ebx, edi
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x14002334a
test ebx, ebx
je 0x1400233f7
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400233d7
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400233d7
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rbx + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1400233d2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x1400233b0
cmp r8d, 0xcded1a85
je 0x1400233dc
test r9d, r9d
jne 0x140023390
mov rax, qword [rax]
jmp 0x140023360
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r10
call rax
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret