Function at 0x180056120
Capabilities:
Encode data using xor
Enumerate gui resources

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xe00]
sub rsp, 0xf00
mov rax, qword [0x180189e48]
xor rax, rsp
mov qword [rbp + 0xdf0], rax
mov r12, r8
mov r15d, edx
mov dword [rbp - 0x7c], edx
mov r14d, ecx
mov dword [rbp - 0x80], ecx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], rax
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x50], xmm1
xor ebx, ebx
mov qword [rbp - 0x40], rbx
lea ecx, [rax + 0x18]
call fcn.1800f2748
mov rsi, rax
mov qword [rax], rbx
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
xor edx, edx
mov r8d, 0xe10
lea rcx, [rbp - 0x20]
call fcn.1800f4d70
mov rdx, rsi
lea rcx, [0x180055240]
call qword [sym.imp.USER32.dll_EnumWindows]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ebx, eax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, eax
mov eax, ebx
cdq
idiv r14d
mov r13d, eax
mov dword [rbp - 0x78], eax
mov eax, ecx
cdq
idiv r15d
mov dword [rbp - 0x74], eax
mov edx, 0xe9
lea eax, [rdx - 0x12]
lea ecx, [rdx - 0xe]
lea r8d, [rdx - 0x3b]
test r12, r12
jne 0x1800562ec
mov r9, qword [rsi]
mov r10, qword [rsi + 8]
cmp r9, r10
je 0x1800562ec
xor r11d, r11d
cmp edi, dword [r9 + 0x48]
jne 0x18005644c
mov dword [rsp + 0x40], ntohs
mov dword [rsp + 0x44], 0xd700e9
mov dword [rsp + 0x48], 0xd800e7
mov dword [rsp + 0x4c], 0xd700dc
mov dword [rsp + 0x50], 0xc200db
mov dword [rsp + 0x54], 0xdb00f5
mov dword [rsp + 0x58], 0xca00d9
mov dword [rsp + 0x5c], 0xbb00c9
mov edx, r11d
nop dword [rax]
mov eax, edx
lea rcx, [rsp + 0x44]
lea rcx, [rcx + rax*2]
lea eax, [r8 + rdx]
xor word [rcx], ax
inc edx
mov eax, dword [rsp + 0x40]
cmp edx, eax
jb 0x180056260
mov word [rsp + rax*2 + 0x44], r11w
lea rcx, [rsp + 0x44]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], r11w
jne 0x180056290
mov rdx, qword [r9 + 0x10]
mov r8, r9
cmp qword [r9 + 0x18], 8
jb 0x1800562ab
mov r8, qword [r9]
cmp rdx, rax
jne 0x18005643c
lea rcx, [rsp + 0x44]
test rdx, rdx
je 0x1800562e8
lea rax, [rsp + 0x44]
sub r8, rax
nop word [rax + rax]
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x18005643c
add rcx, 2
sub rdx, 1
jne 0x1800562d0
mov r12, qword [r9 + 0x40]
mov rdi, qword [rsi + 8]
mov rbx, qword [rsi]
cmp rbx, rdi
je 0x180056484
xor r13d, r13d
nop
cmp r12, qword [rbx + 0x40]
je 0x18005646b
mov dword [rsp + 0x60], ntohs
mov dword [rsp + 0x64], 0xd700e9
mov dword [rsp + 0x68], 0xd800e7
mov dword [rsp + 0x6c], 0xd700dc
mov dword [rsp + 0x70], 0xc200db
mov dword [rsp + 0x74], 0xdb00f5
mov dword [rsp + 0x78], 0xca00d9
mov dword [rsp + 0x7c], 0xbb00c9
mov edx, r13d
mov r8d, 0xae
nop dword [rax]
nop word [rax + rax]
mov eax, edx
lea rcx, [rsp + 0x64]
lea rcx, [rcx + rax*2]
lea eax, [r8 + rdx]
xor word [rcx], ax
inc edx
mov eax, dword [rsp + 0x60]
cmp edx, eax
jb 0x180056360
mov word [rsp + rax*2 + 0x64], r13w
lea rcx, [rsp + 0x64]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], r13w
jne 0x180056390
mov rdx, qword [rbx + 0x10]
mov r8, rbx
cmp qword [rbx + 0x18], 8
jb 0x1800563ab
mov r8, qword [rbx]
cmp rdx, rax
jne 0x18005646b
lea rcx, [rsp + 0x64]
test rdx, rdx
je 0x1800563e8
lea rax, [rsp + 0x64]
sub r8, rax
nop word [rax + rax]
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x18005646b
add rcx, 2
sub rdx, 1
jne 0x1800563d0
lea rdx, [rbp - 0x38]
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x18005646b
mov rax, qword [rbx + 0x40]
mov qword [rbp - 0x60], rax
mov eax, dword [rbp - 0x30]
mov dword [rbp - 0x64], eax
mov eax, dword [rbp - 0x2c]
mov dword [rbp - 0x68], eax
mov eax, dword [rbp - 0x38]
mov dword [rbp - 0x58], eax
mov eax, dword [rbp - 0x34]
mov dword [rbp - 0x54], eax
mov rdx, qword [rbp - 0x48]
cmp rdx, qword [rbp - 0x40]
je 0x18005645e
movups xmm0, xmmword [rbp - 0x68]
movups xmmword [rdx], xmm0
movsd xmm1, qword [rbp - 0x58]
movsd qword [rdx + 0x10], xmm1
add qword [rbp - 0x48], 0x18
jmp 0x18005646b
mov r8d, 0xae
lea edx, [r8 + 0x3b]
lea ecx, [rdx - 0xe]
lea eax, [rdx - 0x12]
add r9, 0x50
cmp r9, r10
je 0x1800562ec
jmp 0x180056210
lea r8, [rbp - 0x68]
lea rcx, [rbp - 0x50]
call fcn.18005e3f0
add rbx, 0x50
cmp rbx, rdi
jne 0x180056300
mov r14d, dword [rbp - 0x80]
mov r15d, dword [rbp - 0x7c]
mov r13d, dword [rbp - 0x78]
mov rcx, rsi
call fcn.1800471a0
mov edx, 0x18
mov rcx, rsi
call fcn.1800f2740
mov r8, qword [rbp - 0x50]
mov r9, qword [rbp - 0x48]
cmp r8, r9
je 0x1800564dc
add r8, 0x14
nop word [rax + rax]
mov eax, dword [r8 - 4]
cdq
idiv r14d
movsxd rcx, eax
mov eax, dword [r8]
cdq
idiv r15d
imul rdx, rcx, 0x1e
cdqe
add rdx, rax
inc dword [rbp + rdx*4 - 0x20]
lea r8, [r8 + 0x18]
lea rax, [r8 - 0x14]
cmp rax, r9
jne 0x1800564b0
xor eax, eax
mov r11d, eax
mov r8d, eax
movsxd r9, r13d
movsxd rsi, dword [rbp - 0x74]
test rsi, rsi
jle 0x18005658d
lea r10, [rbp - 0x20]
nop dword [rax + rax]
mov edx, eax
mov rcx, rax
test r13d, r13d
jle 0x180056525
mov rax, r10
nop dword [rax]
cmp dword [rax], 0
je 0x18005657d
inc edx
inc rcx
add rax, 0x78
cmp rcx, r9
jl 0x180056510
xor eax, eax
inc r11d
inc r8
add r10, 4
cmp r8, rsi
jl 0x180056500
mov edx, eax
mov r11d, eax
mov ebx, eax
mov r10d, eax
lea rdi, [rbp - 0x20]
mov ecx, eax
test r13d, r13d
jle 0x18005656e
mov rax, rdi
mov r8, r9
nop
test edx, edx
je 0x180056558
cmp dword [rax], edx
jge 0x180056560
mov edx, dword [rax]
mov r11d, ecx
mov ebx, r10d
inc ecx
add rax, 0x78
sub r8, 1
jne 0x180056550
xor eax, eax
inc r10d
add rdi, 4
sub rsi, 1
jne 0x180056542
jmp 0x18005658f
mov r9d, r15d
imul r9d, r11d
mov r8d, r14d
imul r8d, edx
jmp 0x18005659d
mov ebx, eax
mov r9d, r15d
imul r9d, ebx
mov r8d, r14d
imul r8d, r11d
mov dword [rsp + 0x30], 0x40
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r14d
xor edx, edx
mov rcx, r12
call qword [sym.imp.USER32.dll_SetWindowPos]
nop
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x18005661a
mov rax, qword [rbp - 0x40]
sub rax, rcx
sar rax, 3
movabs rdx, 0xaaaaaaaaaaaaaaab
imul rax, rdx
lea rdx, [rax + rax*2]
shl rdx, 3
mov rax, rcx
cmp rdx, 0x1000
jb 0x180056606
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180056646
call fcn.1800f2740
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x50], xmm0
xor r11d, r11d
mov qword [rbp - 0x40], r11
mov al, 1
mov rcx, qword [rbp + 0xdf0]
xor rcx, rsp
call fcn.1800f23a0
mov rbx, qword [rsp + 0xf58]
add rsp, 0xf00
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1800f98d4
int3