Function at 0x1400437b0
Capabilities:
Access peb ldr_data
Encode data using xor
Get kernel32 base address
Get process filename
Hash data using fnv
Resolve function by fnv-1a hash
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xe0
mov rax, qword [0x1400f20c0]
xor rax, rsp
mov qword [rsp + 0xd0], rax
xorps xmm0, xmm0
movups xmmword [r11 - 0x50], xmm0
lea rcx, [rsp + 0x108]
movabs rdx, 0xff0f0ff0f0ff00f
mov qword [r11 - 0x48], rdx
mov qword [r11 - 0x40], rcx
mov rax, qword [rcx]
xor rax, rdx
mov qword [r11 - 0x50], rax
mov qword [rcx], 0
lea rcx, str.user32.dll
call fcn.140043530
mov rbx, rax
mov qword [rsp + 0x20], rax
lea rcx, str.dwmapi.dll
call fcn.140043530
mov rdi, rax
mov qword [rsp + 0x60], rax
lea rcx, str.Kernel32.dll
call fcn.140043530
mov qword [rsp + 0x68], rax
test rbx, rbx
je 0x140043f9a
test rdi, rdi
je 0x140043f9a
test rax, rax
je 0x140043f9a
lea rdx, str.SetWindowLongA
mov rcx, rbx
call fcn.140043670
mov qword [rsp + 0x28], rax
lea rdx, str.CreateWindowExA
mov rcx, rbx
call fcn.140043670
mov qword [rsp + 0x30], rax
lea rdx, [0x1400ddb98]
mov rcx, rbx
call fcn.140043670
mov qword [rsp + 0x38], rax
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop word [rax + rax]
mov r10, qword [rcx + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov edi, dword [rdx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140043936
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140043936
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rax, [rbx + r9*4]
mov edx, dword [rax + r10]
add rdx, r10
mov r8d, 0x811c9dc5
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x140043931
nop
movsx eax, al
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
test al, al
jne 0x140043910
cmp r8d, 0xf8f45725
je 0x14004393b
test r9d, r9d
jne 0x1400438f0
mov rcx, qword [rcx]
jmp 0x1400438c0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov r8d, dword [rcx + rax*4]
add r8, r10
lea rdx, str.CreateWindowExW
mov rbx, qword [rsp + 0x20]
mov rcx, rbx
call r8
mov rsi, rax
lea rdx, str.GetDesktopWindow
mov rcx, rbx
call fcn.140043670
mov rbp, rax
lea rdx, str.RegisterClassExA
mov rcx, rbx
call fcn.140043670
mov r14, rax
lea rdx, str.DefWindowProcW
mov rcx, rbx
call fcn.140043670
mov r15, rax
lea rdx, str.GetWindowRect
mov rcx, rbx
call fcn.140043670
mov r12, rax
lea rdx, str.SetTimer
mov rcx, rbx
call fcn.140043670
mov r13, rax
lea rdx, str.MoveWindow
mov rcx, rbx
call fcn.140043670
mov qword [rsp + 0xa8], rax
lea rdx, [0x1400ddc28]
mov rcx, rbx
call fcn.140043670
mov qword [rsp + 0xa0], rax
lea rdx, str.SetMenu
mov rcx, rbx
call fcn.140043670
mov qword [rsp + 0x90], rax
lea rdx, str.GetWindowLongA
mov rcx, rbx
call fcn.140043670
mov qword [rsp + 0x78], rax
lea rdx, [0x1400ddc50]
mov rdi, qword [rsp + 0x68]
mov rcx, rdi
call fcn.140043670
mov qword [rsp + 0x98], rax
lea rdx, str.DwmExtendFrameIntoClientArea
mov rcx, qword [rsp + 0x60]
call fcn.140043670
mov qword [rsp + 0x70], rax
lea rdx, str.SetLayeredWindowAttributes
mov rcx, rbx
call fcn.140043670
mov qword [rsp + 0x48], rax
lea rdx, str.SetWindowPos
mov rcx, rbx
call fcn.140043670
mov qword [rsp + 0x80], rax
lea rdx, [0x1400ddcb0]
mov rcx, rbx
call fcn.140043670
mov qword [rsp + 0x88], rax
lea rdx, [0x1400ddcc0]
mov rcx, rdi
call fcn.140043670
mov qword [rsp + 0x58], rax
lea rdx, [0x1400ddcd0]
mov rcx, rdi
call fcn.140043670
mov qword [rsp + 0x40], rax
lea rdx, str.UpdateWindow
mov rcx, rbx
call fcn.140043670
mov qword [rsp + 0xb0], rax
lea rdx, str.GetAsyncKeyState
mov rcx, rbx
call fcn.140043670
mov qword [rsp + 0x50], rax
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rcx + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov edi, dword [rdx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140043b76
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140043b76
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rax, [rbx + r9*4]
mov edx, dword [rax + r10]
add rdx, r10
mov r8d, 0x811c9dc5
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x140043b71
nop
movsx eax, al
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
test al, al
jne 0x140043b50
cmp r8d, 0xf8f45725
je 0x140043b7b
test r9d, r9d
jne 0x140043b30
mov rcx, qword [rcx]
jmp 0x140043b00
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov r8d, dword [rcx + rax*4]
add r8, r10
lea rdx, [0x1400ddd10]
mov rcx, qword [rsp + 0x20]
call r8
cmp qword [rsp + 0x48], 0
je 0x140043f9a
test rsi, rsi
je 0x140043f9a
mov r11, qword [rsp + 0x70]
test r11, r11
je 0x140043f9a
cmp qword [rsp + 0x28], 0
je 0x140043f9a
mov r9, qword [rsp + 0x78]
test r9, r9
je 0x140043f9a
cmp qword [rsp + 0x38], 0
je 0x140043f9a
cmp qword [rsp + 0x50], 0
je 0x140043f9a
mov rbx, qword [rsp + 0x80]
test rbx, rbx
je 0x140043f9a
mov rdi, qword [rsp + 0x88]
test rdi, rdi
je 0x140043f9a
mov r8, qword [rsp + 0x90]
test r8, r8
je 0x140043f9a
cmp qword [rsp + 0x58], 0
je 0x140043f9a
cmp qword [rsp + 0x40], 0
je 0x140043f9a
mov r10, qword [rsp + 0x98]
test r10, r10
je 0x140043f9a
mov rdx, qword [rsp + 0xa0]
test rdx, rdx
je 0x140043f9a
mov rcx, qword [rsp + 0xa8]
test rcx, rcx
je 0x140043f9a
cmp qword [rsp + 0x30], 0
je 0x140043f9a
test r13, r13
je 0x140043f9a
test r12, r12
je 0x140043f9a
test r14, r14
je 0x140043f9a
test rbp, rbp
je 0x140043f9a
test r15, r15
je 0x140043f9a
test rax, rax
je 0x140043f9a
mov qword [0x14010f1a0], rsi
mov rsi, qword [rsp + 0x28]
mov qword [0x14010f1f0], rsi
mov qword [0x14010f180], r15
mov rsi, qword [rsp + 0x30]
mov qword [0x14010f150], rsi
mov qword [0x14010f220], r14
mov rsi, qword [rsp + 0x38]
mov qword [0x14010f2d0], rsi
mov qword [0x14010f148], r12
mov qword [0x14010f258], rbp
mov qword [0x14010f2e0], r8
mov r8, qword [rsp + 0x40]
mov qword [0x14010f208], r8
mov qword [0x14010f178], r9
mov qword [0x14010f268], r11
mov r8, qword [rsp + 0x48]
mov qword [0x14010f2c8], r8
mov qword [0x14010f260], rbx
mov qword [0x14010f200], rcx
mov qword [0x14010f2d8], r13
mov qword [0x14010f210], rdi
mov qword [0x14010f160], r10
mov qword [0x14010f138], rdx
mov rcx, qword [rsp + 0xb0]
mov qword [0x14010f140], rcx
mov rcx, qword [rsp + 0x50]
mov qword [0x14010f158], rcx
mov rcx, qword [rsp + 0x58]
mov qword [0x14010f198], rcx
mov qword [0x14010f188], rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140043e16
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140043e16
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140043e11
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140043df0
cmp r8d, 0xab45c5ee
je 0x140043e1b
test r9d, r9d
jne 0x140043dd0
mov rax, qword [rax]
jmp 0x140043da0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov rcx, qword [rsp + 0x20]
call rdx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140043ec6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140043ec6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140043ec1
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140043ea0
cmp r8d, 0xab45c5ee
je 0x140043ecb
test r9d, r9d
jne 0x140043e80
mov rax, qword [rax]
jmp 0x140043e50
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov rcx, qword [rsp + 0x60]
call rdx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140043f76
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140043f76
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov ecx, dword [rcx + rbx]
add rcx, r10
mov r8d, 0x811c9dc5
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140043f71
nop dword [rax]
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x140043f50
cmp r8d, 0xab45c5ee
je 0x140043f7b
test r9d, r9d
jne 0x140043f30
mov rax, qword [rax]
jmp 0x140043f00
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov rcx, qword [rsp + 0x68]
call rdx
nop
mov rax, qword [rsp + 0xb8]
movabs rcx, 0xff0f0ff0f0ff00f
xor rax, rcx
lea rcx, [rsp + 0x108]
mov qword [rcx], rax
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1400c2370
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret