Function at 0x1000dd80
Capabilities:
Access peb ldr_data
Check for protected handle exception
Encode data using xor
Enumerate gui resources
Enumerate processes
Get number of processors
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100999c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x268
cmp word [ebp + 0xc], 0
mov eax, ecx
push ebx
push esi
push edi
mov dword [ebp - 0x24], eax
mov byte [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
je 0x1000de5b
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
nop
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x10], esi
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx + esi + 0x78]
mov ecx, dword [ecx + esi + 0x7c]
mov dword [ebp - 0x28], ecx
lea ecx, [edx + esi]
mov dword [ebp - 0x14], ecx
cmp ecx, esi
je 0x1000de39
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x1000de39
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, esi
nop dword [eax]
mov edx, dword [ebx - 4]
lea ebx, [ebx - 4]
add edx, esi
dec edi
mov esi, 0x811c9dc5
mov cl, byte [edx]
inc edx
test cl, cl
je 0x1000de32
movsx ecx, cl
lea edx, [edx + 1]
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [edx - 1]
test cl, cl
jne 0x1000de15
cmp esi, 0x711be0a4
je 0x1000de3d
mov esi, dword [eax + 0x18]
test edi, edi
jne 0x1000de00
mov eax, dword [eax]
jmp 0x1000ddd0
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
push dword [ebp + 0xc]
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
add ecx, edx
add eax, edx
movzx eax, word [eax + edi*2]
mov eax, dword [ecx + eax*4]
add eax, edx
call eax
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0
push eax
push 0x1000c690
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [ebp + 0xc]
mov dword [0x100bd194], eax
push 0
push 2
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
xor ebx, ebx
mov dword [ebp + 0xc], eax
cmp eax, 0xffffffff
je 0x1000df0b
lea ecx, [ebp - 0x270]
mov dword [ebp - 0x270], 0x22c
push ecx
push eax
xor edi, edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
nop
lea edx, [ebp - 0x24c]
mov esi, 0x811c9dc5
nop dword [eax + eax]
movzx ecx, word [edx]
lea edx, [edx + 2]
mov eax, ecx
xor eax, esi
imul esi, eax, 0x1000193
test cx, cx
jne 0x1000dec0
cmp esi, 0xacf657a1
jne 0x1000deef
mov eax, dword [ebp - 0x25c]
cmp eax, edi
jbe 0x1000deef
mov ebx, dword [ebp - 0x268]
mov edi, eax
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x270]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1000deb0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x24]
push ebx
push 1
mov dword [ebp - 4], 0xffffffff
push 0x438
mov dword [esi + 4], ebx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 2
push 2
push eax
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov edx, 0x100bd18c
mov ecx, 0x1000d470
call fcn.1000cf40
test al, al
je 0x1000e125
nop dword [eax + eax]
call fcn.1007308e
mov esi, eax
mov ebx, edx
mov dword [ebp - 0x14], esi
mov dword [ebp + 0xc], ebx
call fcn.10073077
push ebx
push esi
push edx
push eax
call fcn.10095cf0
push 0
push 0x3b9aca00
push ebx
push ecx
mov edi, eax
mov esi, edx
call fcn.10095450
push dword [ebp + 0xc]
push dword [ebp - 0x14]
push edx
push eax
call fcn.100956d0
mov dword [ebp + 0xc], eax
mov ebx, edx
mov ecx, 0x3b9aca00
mov eax, esi
mul ecx
mov edx, 0x3b9aca00
mov ecx, eax
mov eax, edi
mul edx
add ecx, edx
mov edx, dword [ebp + 0xc]
add edx, eax
adc ebx, ecx
cmp edx, 0xfa0a1eff
jne 0x1000dfbe
cmp ebx, 0x7fffffff
je 0x1000dfe1
cmp ebx, 0x7fffffff
jg 0x1000dfe1
jl 0x1000dfd0
cmp edx, 0xfa0a1eff
jae 0x1000dfe1
add edx, 0x5f5e100
mov dword [ebp + 0xc], edx
adc ebx, 0
mov dword [ebp - 0x1c], ebx
jmp 0x1000dff0
or eax, 0xffffffff
mov dword [ebp - 0x1c], 0x7fffffff
mov dword [ebp + 0xc], eax
nop
call fcn.1007308e
mov esi, eax
mov ebx, edx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], ebx
call fcn.10073077
push ebx
push esi
push edx
push eax
call fcn.10095cf0
push 0
push 0x3b9aca00
push ebx
push ecx
mov edi, eax
mov esi, edx
call fcn.10095450
push dword [ebp - 0x14]
push dword [ebp - 0x10]
push edx
push eax
call fcn.100956d0
mov ebx, eax
mov dword [ebp - 0x20], edx
mov ecx, 0x3b9aca00
mov eax, esi
mul ecx
mov edx, 0x3b9aca00
mov ecx, eax
mov eax, edi
mov edi, dword [ebp + 0xc]
mul edx
add ecx, edx
add ebx, eax
mov eax, dword [ebp - 0x20]
adc eax, ecx
mov dword [ebp - 0x10], ebx
cmp edi, ebx
mov dword [ebp - 0x20], eax
mov ebx, dword [ebp - 0x1c]
jne 0x1000e066
cmp ebx, eax
je 0x1000e0fd
cmp ebx, eax
jl 0x1000e0fd
jg 0x1000e079
cmp edi, dword [ebp - 0x10]
jb 0x1000e0fd
call fcn.10073106
push 0
push 0x64
push edx
push eax
call fcn.10095450
sub edi, dword [ebp - 0x10]
mov esi, eax
mov dword [ebp - 0x14], edx
mov ecx, edi
sbb ebx, dword [ebp - 0x20]
mov edx, ebx
mov dword [ebp - 0x28], esi
call fcn.10096160
comisd xmm0, xmmword [0x100aff98]
mov ecx, dword [ebp - 0x14]
mov eax, ecx
jbe 0x1000e0bf
mov edi, 0xad160000
mov ebx, 0x311cd
add esi, edi
adc eax, ebx
jmp 0x1000e0c3
add esi, edi
adc eax, ebx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x28]
add eax, edi
push 0
push 0x3b9aca00
adc ecx, ebx
push ecx
push eax
call fcn.100956d0
mov dword [ebp - 0x40], eax
imul eax, eax, 0x3b9aca00
mov dword [ebp - 0x3c], edx
sub esi, eax
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x38], esi
call fcn.10073172
add esp, 4
jmp 0x1000dff0
call fcn.1000d0e0
test al, al
je 0x1000df50
call fcn.1000d130
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8