Function at 0x14004cba0
Capabilities:
Check for foreground window switch
Create thread
Encode data using xor
Terminate process

Disassembly:
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
xor edi, edi
mov dword [rbp - 9], 0xc7b1c7b7
mov ecx, edi
mov dword [rbp - 5], 0xa9bcacc6
mov word [rbp - 1], 0xaf
mov byte [rbp + 1], 1
nop
lea eax, [rcx - 0xd]
xor byte [rbp + rcx - 9], al
inc rcx
cmp rcx, 9
jb 0x14004cbd0
lea rdx, [rbp - 9]
mov byte [rbp + 1], dil
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
xorps xmm0, xmm0
mov qword [rbp + 7], 0x50
mov qword [0x1401b6d38], rax
lea rcx, [rbp + 7]
mov rax, qword [0x1401b6d60]
xorps xmm1, xmm1
mov qword [rbp + 0x47], rax
lea rax, [0x140049780]
mov qword [rbp + 0xf], rax
movdqa xmmword [rbp + 0x17], xmm0
movdqa xmmword [rbp + 0x27], xmm1
movdqa xmmword [rbp + 0x37], xmm0
mov qword [rbp + 0x4f], rdi
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov rcx, qword [0x1401b6d38]
test rcx, rcx
je 0x14004ce18
lea rdx, [0x1401b6d28]
mov qword [rsp + 0xd8], rbx
call qword [sym.imp.USER32.dll_GetClientRect]
mov rcx, qword [0x1401b6d38]
lea rdx, [rbp + 0x67]
call qword [sym.imp.USER32.dll_ClientToScreen]
mov eax, dword [rbp + 0x67]
mov r9d, 0x90000000
movd xmm1, dword [0x1401b6d34]
movd xmm2, dword [0x1401b6d30]
mov rdx, qword [0x1401b6d60]
mov qword [rsp + 0x58], rdi
mov r8, rdx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
cvtdq2ps xmm1, xmm1
mov dword [0x1401b6d28], eax
mov eax, dword [rbp + 0x6b]
mov dword [0x1401b6d2c], eax
cvtdq2ps xmm2, xmm2
movss dword [0x1401b6cf0], xmm1
subss xmm1, dword [0x1400cbb50]
movss dword [0x1401b6c08], xmm2
subss xmm2, dword [0x1400cbb50]
cvttss2si ecx, xmm1
cvttss2si eax, xmm2
mov dword [rsp + 0x38], ecx
xor ecx, ecx
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 2
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov rcx, rax
mov qword [0x1401b7150], rax
lea rdx, [0x1400ca9d0]
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov rcx, qword [0x1401b7150]
mov edx, 0xffffffec
mov r8d, 0x800a0
call qword [sym.imp.USER32.dll_SetWindowLongW]
mov rcx, qword [0x1401b7150]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1401b7150]
call qword [sym.imp.USER32.dll_UpdateWindow]
call fcn.1400493e0
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rdx, str.D3D11TEST
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.USER32.dll_FindWindowA]
cmp rbx, rax
je 0x14004cd9a
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rdx, str.D3D11TEST
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.USER32.dll_FindWindowA]
cmp rbx, rax
jne case.default.0x14004ce11
mov qword [rsp + 0x28], rdi
lea r8, [0x1400498e0]
xor r9d, r9d
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.14004c780
mov rcx, qword [0x1401b6bf8]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x1401b7158]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x1401b6c90]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x1401b7150]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rcx, qword [0x1401b6d60]
xor edx, edx
mov rbx, qword [rsp + 0xd8]
mov rdi, qword [rsp + 0xe0]
add rsp, 0xc0
pop rbp
jmp qword [sym.imp.USER32.dll_UnregisterClassW]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
or bh, al
xlatb
test dword [rbx - 0x85b08fa], 0xfb24fb49
imul ecx, dword [rcx + 0x39fb8a1f], 0x28fb13fb
mov bh, bl
cmp ebx, edi
adc edi, ebx
sub bl, bh
mov bh, bl
cmp ebx, edi
adc edi, ebx
sub bl, bh
push rax
push rsp
neg dword [rdi]
sti
xchg esp, eax
sbb bh, dh
invalid
inc byte [rax]
cld
invalid
invalid
insb byte [rdi], dx
clc
insd dword [rdi], dx
sti
retf
retf
sbb eax, 0xa6f776f7
mul dword [rsi + 0x78f71bf7]
not dword [rsi - 0x10008e1]
xchg esi, eax
invalid
idiv edi
invalid
jle 0x14013294e
xchg esi, eax
invalid
cli
jle 0x140132943
not dword [rsi + 0x78fb1af7]
sti
neg dword [rdx]
sti
js 0x14013293e
cmpsb byte [rsi], byte [rdi]
sti
cmpsb byte [rsi], byte [rdi]
sti
sbb bh, bl
jbe 0x140132946
xchg esi, eax
invalid
sti
sahf
loope str.__ejK
clc
adc al, 6
invalid
test esi, 0x60f78ef8
sti
fcom st(0)
sti
add al, 0xab
mov word [rcx + rbx - 5], es
xor bl, byte [rcx + 0x1b203d29]
sub dword [0x18b7d448e], edi
invalid
sub dword [0x18b7d448e], edi
xchg esp, eax
xchg esi, eax
outsd dx, dword [rsi]
invalid