Function at 0x14000ddc0
Capabilities:
Create thread
Encode data using xor
Enumerate process modules
Set console window title

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x5a8]
sub rsp, 0x6a0
movaps xmmword [rax - 0x18], xmm6
mov rax, qword [0x14009f120]
xor rax, rsp
mov qword [rbp + 0x580], rax
lea rcx, [0x14008ec8c]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
mov dword [rbp + 0x470], 0xedf1ff
mov byte [rbp + 0x474], 1
xor r14d, r14d
mov ecx, r14d
nop dword [rax + rax]
lea eax, [rcx - 0x44]
xor byte [rbp + rcx + 0x470], al
inc rcx
cmp rcx, 3
jb 0x14000de20
mov byte [rbp + 0x474], r14b
lea rcx, [rbp + 0x470]
call fcn.1400575e4
mov dword [rsp + 0x68], 0xe8ddcfdb
mov dword [rsp + 0x6c], 0xaca6afa9
mov word [rsp + 0x70], 0xb3
mov byte [rsp + 0x72], 1
mov rax, r14
nop word [rax + rax]
lea ecx, [rax - 0x44]
xor byte [rsp + rax + 0x68], cl
inc rax
cmp rax, 9
jb 0x14000de70
mov byte [rsp + 0x72], r14b
xor edx, edx
lea rcx, [rsp + 0x68]
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x1400a24f0], rax
mov ebx, 4
mov rax, qword gs:[0x58]
add rbx, qword [rax]
mov eax, dword [rbx]
cmp dword [0x1400a2aa0], eax
jle 0x14000dee6
lea rcx, [0x1400a2aa0]
call fcn.14004e0a4
cmp dword [0x1400a2aa0], 0xffffffff
jne 0x14000dee6
mov ecx, 1
call fcn.14004e1b4
mov qword [0x1400a2df8], rax
lea rcx, [0x1400a2aa0]
call fcn.14004e044
mov rcx, qword [0x1400a24f0]
lea rdx, [rbp + 0x470]
test rcx, rcx
je 0x14000e3d1
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [rbp + 0x470]
mov dword [0x1400a2474], eax
lea rdx, [0x1400a2474]
mov rcx, qword [0x1400a24f0]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
lea rdx, str.RedLine_B2189vr_____y_n__n
lea rcx, [0x14009f010]
call fcn.140012420
lea rdx, [rsp + 0x60]
call fcn.140012830
movzx eax, byte [rsp + 0x60]
sub al, 0x59
test al, 0xdf
sete byte [0x1400a246b]
mov r8d, dword [0x1400a2474]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x1400a2560], rax
mov eax, dword [rbx]
cmp dword [0x1400a2aa0], eax
jle 0x14000dfa7
lea rcx, [0x1400a2aa0]
call fcn.14004e0a4
cmp dword [0x1400a2aa0], 0xffffffff
jne 0x14000dfa7
mov ecx, 1
call fcn.14004e1b4
mov qword [0x1400a2df8], rax
lea rcx, [0x1400a2aa0]
call fcn.14004e044
mov rcx, r14
mov edx, 0x4a44
cmp byte [0x1400a246b], 0
je 0x14000e03e
mov dword [rbp - 0x20], 0xb5d4b5fa
mov dword [rbp - 0x1c], 0xb5dab5c8
mov dword [rbp - 0x18], 0xb59eb58d
mov dword [rbp - 0x14], 0xb5f1b5a0
mov dword [rbp - 0x10], 0xb5fdb5f5
mov dword [rbp - 0xc], 0xb598b5ff
mov dword [rbp - 8], 0xb59db58f
mov dword [rbp - 4], 0xb59bb58b
mov dword [rbp], 0xb5a2b5be
mov dword [rbp + 4], 0xb5aab5ad
mov dword [rbp + 8], 0xb5a2b5a3
mov dword [rbp + 0xc], 0xb5b6b5fc
mov dword [rbp + 0x10], 0xb5b0b5ac
mov word [rbp + 0x14], r14w
mov byte [rbp + 0x16], 1
movzx eax, cx
sub ax, dx
xor word [rbp + rcx*2 - 0x20], ax
inc rcx
cmp rcx, 0x1a
jb 0x14000e020
mov byte [rbp + 0x16], 0
lea rdi, [rbp - 0x20]
jmp 0x14000e0ad
mov dword [rsp + 0x78], 0xb5d4b5fa
mov dword [rsp + 0x7c], 0xb5dab5c8
mov dword [rbp - 0x80], 0xb59eb58d
mov dword [rbp - 0x7c], 0xb597b585
mov dword [rbp - 0x78], 0xb595b585
mov dword [rbp - 0x74], 0xb5a8b5b4
mov dword [rbp - 0x70], 0xb5acb5ab
mov dword [rbp - 0x6c], 0xb5b8b5b9
mov dword [rbp - 0x68], 0xb5a8b5e2
mov dword [rbp - 0x64], 0xb5aab5b6
mov word [rbp - 0x60], r14w
mov byte [rbp - 0x5e], 1
nop
movzx eax, cx
sub ax, dx
xor word [rsp + rcx*2 + 0x78], ax
inc rcx
cmp rcx, 0x14
jb 0x14000e090
mov byte [rbp - 0x5e], 0
lea rdi, [rsp + 0x78]
mov edx, dword [0x1400a2474]
mov rsi, r14
mov qword [rbp - 0x58], r14
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x48], r14
mov ecx, 0x18
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14000e10c
mov r8, rdi
lea rdx, str.Failed_to_get__s__invalid_handle_value
lea rcx, [rbp + 0x480]
call fcn.140012210
xor r9d, r9d
lea r8, str.ERROR
lea rdx, [rbp + 0x480]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
movsd xmm6, qword [rbp - 0x48]
jmp 0x14000e17b
mov dword [rbp + 0x30], 0x438
lea rdx, [rbp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x14000e16d
mov rdx, rdi
lea rcx, [rbp + 0x60]
call fcn.140054b38
test eax, eax
je 0x14000e143
lea rdx, [rbp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32NextW]
jmp 0x14000e120
mov rax, qword [rbp + 0x48]
mov qword [rbp - 0x40], rax
mov rax, qword [rbp + 0x58]
mov qword [rbp - 0x38], rax
mov eax, dword [rbp + 0x50]
mov qword [rbp - 0x30], rax
movups xmm0, xmmword [rbp - 0x40]
movups xmmword [rbp - 0x58], xmm0
movsd xmm6, qword [rbp - 0x30]
mov rsi, qword [rbp - 0x58]
jmp 0x14000e172
movsd xmm6, qword [rbp - 0x48]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movups xmm0, xmmword [rbp - 0x58]
movups xmmword [0x1400a24d8], xmm0
movsd qword [0x1400a24e8], xmm6
mov rdx, rsi
call fcn.14000f000
mov rcx, rax
call fcn.140012950
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8, [0x14000dc40]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp - 0x20], 0x50
lea rdi, [0x14000daa0]
mov qword [rbp - 0x18], rdi
mov qword [rbp - 0x10], r14
mov qword [rbp - 8], r14
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadIconW]
mov qword [rbp], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov qword [rbp + 8], rax
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x10], xmm0
lea rbx, [0x14008dfd8]
mov qword [rbp + 0x20], rbx
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadIconW]
mov qword [rbp + 0x28], rax
lea rcx, [rbp - 0x20]
call qword [sym.imp.USER32.dll_RegisterClassExW]
test ax, ax
je 0x14000e3bb
mov rcx, qword [0x1400a24f0]
test rcx, rcx
je 0x14000e3c6
lea rdx, [0x1400a24f8]
call qword [sym.imp.USER32.dll_GetClientRect]
lea rdx, [rbp + 0x470]
mov rcx, qword [0x1400a24f0]
call qword [sym.imp.USER32.dll_ClientToScreen]
mov rax, qword [rbp + 0x470]
mov dword [0x1400a24f8], eax
mov r8d, dword [rbp + 0x474]
mov dword [0x1400a24fc], r8d
mov edx, dword [0x1400a2500]
mov dword [0x1400a259c], edx
mov ecx, dword [0x1400a2504]
mov dword [0x1400a2598], ecx
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x28], r8d
mov dword [rsp + 0x20], eax
mov r9d, 0x90000000
mov r8, rbx
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov qword [0x1400a24a8], rax
lea rdx, [0x14008ed80]
mov rcx, rax
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov edx, 0xffffffec
mov r8d, 0x800a0
mov rcx, qword [0x1400a24a8]
call qword [sym.imp.USER32.dll_SetWindowLongW]
mov edx, 5
mov rcx, qword [0x1400a24a8]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1400a24a8]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rcx, qword [0x1400a24a8]
call fcn.140002850
call fcn.14000d720
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8, [0x14000dc40]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp - 0x20], 0x50
mov qword [rbp - 0x18], rdi
mov qword [rbp - 0x10], r14
mov qword [rbp - 8], r14
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadIconW]
mov qword [rbp], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov qword [rbp + 8], rax
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], rbx
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadIconW]
mov qword [rbp + 0x28], rax
lea rcx, [rbp - 0x20]
call qword [sym.imp.USER32.dll_RegisterClassExW]
test ax, ax
jne 0x14000e230
mov ecx, 1
call fcn.140054844
int3
mov ecx, 2
call fcn.140054844
int3
mov dword [rbp + 0x470], 3
lea rcx, [rsp + 0x68]
call fcn.1400126a0
mov rcx, rax
call fcn.1400126b0
xor ecx, ecx
call fcn.140054844
int3