Function at 0x1400046bc
Capabilities:
Create process on windows
Enumerate gui resources

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov r14d, 5
lea rsi, [rcx + 0x20]
mov rdi, rcx
xor r12d, r12d
lea r15d, [r14 - 4]
mov rcx, qword [rdi + 0x48]
sub r14d, r15d
test rcx, rcx
je 0x14000471c
xor r9d, r9d
mov edx, 0x112
mov r8d, 0xf060
call qword [sym.imp.USER32.dll_SendMessageA]
test rax, rax
jne 0x14000471c
mov qword [rdi + 0x48], r12
mov qword [rdi + 0x50], r12
cmp qword [rdi + 0xd0], r12
je 0x14000477e
cmp qword [rsi + 0x18], 0xf
mov rax, rsi
mov rcx, qword [rsi + 0x10]
jbe 0x14000473a
mov rax, qword [rsi]
mov qword [rbp - 0x11], rcx
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 9]
mov qword [rbp - 0x19], rax
call fcn.14000adc4
mov rcx, qword [rdi + 0xd0]
test rcx, rcx
je 0x140004adb
mov rax, qword [rcx]
lea rdx, [rbp - 9]
call qword [rax + 0x10]
lea rcx, [rbp - 9]
mov bl, al
call fcn.140007b48
test bl, bl
je 0x140004aa5
jmp 0x1400047b9
mov al, byte [rdi + 0x40]
mov r8, rsi
neg al
sbb ecx, ecx
and ecx, 5
cmp qword [rsi + 0x18], 0xf
jbe 0x140004795
mov r8, qword [rsi]
mov dword [rsp + 0x28], ecx
lea rdx, [0x140013ef8]
xor ecx, ecx
mov qword [rsp + 0x20], r12
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jle 0x140004aa5
mov qword [rbp - 0x29], rdi
mov qword [rbp - 0x21], r12
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov r15, rax
cmp qword [rdi + 0x48], r12
jne 0x1400047f7
lea rdx, [rbp - 0x29]
lea rcx, [0x140004ae4]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x1400048ed
mov qword [rdi + 0x48], rcx
jmp 0x1400048ed
xorps xmm0, xmm0
mov qword [rbp + 7], r12
mov r8d, 0x10
mov qword [rbp + 0xf], r12
lea rdx, str.SHELLDLL_DefView
lea rcx, [rbp - 9]
movups xmmword [rbp - 9], xmm0
call fcn.1400090d8
mov rbx, qword [rdi + 0x48]
lea rdx, [rbp - 9]
lea rcx, [rbp + 0x17]
call fcn.140008050
lea r8, [rbp + 0x17]
mov qword [rbp + 0x37], r12
lea rdx, [0x1400042e8]
mov rcx, rbx
call qword [sym.imp.USER32.dll_EnumChildWindows]
mov rdx, qword [rbp + 0x2f]
mov rbx, qword [rbp + 0x37]
cmp rdx, 0xf
jbe 0x140004884
mov rcx, qword [rbp + 0x17]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000487f
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004ad5
call fcn.14000bfec
mov rdx, qword [rbp + 0xf]
mov qword [rbp + 0x27], r12
mov qword [rbp + 0x2f], 0xf
mov byte [rbp + 0x17], r12b
cmp rdx, 0xf
jbe 0x1400048cf
mov rcx, qword [rbp - 9]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400048ca
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004ad5
call fcn.14000bfec
test rbx, rbx
je 0x1400048ed
xor r9d, r9d
lea r8, str.DirectUIHWND
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_FindWindowExA]
mov qword [rdi + 0x50], rax
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [rdi + 0x50], r12
jne 0x140004913
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub rax, r15
cmp rax, 0x2710
jb 0x1400047ca
mov rbx, qword [rdi + 0x50]
test rbx, rbx
je 0x140004a9f
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r15d, 1
mov r9d, 0x28000a
mov r8d, r15d
mov edx, 0x201
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [r15 + 9]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r9d, 0x28000a
mov r8d, r15d
mov edx, 0x202
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [r15 + 9]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r9d, 0x28000a
mov r8d, r15d
mov edx, 0x201
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [r15 + 9]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r9d, 0x28000a
mov r8d, r15d
mov edx, 0x202
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [r15 + 9]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [r15 + 0x31]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r9d, 0x280028
mov r8d, r15d
mov edx, 0x201
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [r15 + 0x31]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r9d, 0x280028
mov r8d, r15d
mov edx, 0x202
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [r15 + 0x31]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r9d, 0x280028
mov r8d, r15d
mov edx, 0x201
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [r15 + 0x31]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r9d, 0x280028
mov r8d, r15d
mov edx, 0x202
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageA]
mov rcx, qword [rdi + 0x90]
mov bl, r15b
test rcx, rcx
je 0x140004a5b
mov rax, qword [rcx]
call qword [rax + 0x10]
mov bl, al
mov rcx, qword [rdi + 0x48]
test rcx, rcx
je 0x140004a81
xor r9d, r9d
mov edx, 0x112
mov r8d, 0xf060
call qword [sym.imp.USER32.dll_SendMessageA]
test rax, rax
jne 0x140004a81
mov qword [rdi + 0x48], r12
mov qword [rdi + 0x50], r12
cmp qword [rdi + 0x90], r12
je 0x140004ad1
test bl, bl
jne 0x140004ad1
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140004aa5
mov r15d, 1
test r14d, r14d
jne 0x1400046f3
xor al, al
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov al, bl
jmp 0x140004ab0
call fcn.14000ce90
int3
call fcn.14000bbb4
int3