Function at 0x14000e220
Capabilities:
Create process on windows
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x120]
sub rsp, 0x220
mov rax, qword [0x141117088]
xor rax, rsp
mov qword [rbp + 0x110], rax
xor r13d, r13d
mov dword [rsp + 0x60], r13d
lea rax, [0x141117590]
cmp qword [0x1411175a8], 0x10
cmovae rax, qword [0x141117590]
mov qword [rsp + 0x60], rax
mov rax, qword [0x1411175a0]
mov qword [rsp + 0x68], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0xd0]
call fcn.14000a170
nop
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0xf0]
call fcn.14000d700
nop
lea rcx, [rbp + 0xd0]
call fcn.14000d630
lea r15, [rbp + 0xf0]
cmp qword [rbp + 0x108], 8
cmovae r15, qword [rbp + 0xf0]
mov r14, qword [rbp + 0x100]
call fcn.1400129a4
mov r12d, eax
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], r13
mov qword [rbp + 0x28], 0xf
mov byte [rbp + 0x10], r13b
mov dword [rsp + 0x60], 0x11
test r14, r14
je 0x14000e3e2
cmp r14, 0x7fffffff
ja 0x14000ebc4
mov dword [rsp + 0x20], r13d
xor r9d, r9d
mov r8d, r14d
mov rdx, r15
mov ecx, eax
call fcn.140012a14
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x14000ebcf
movsxd rcx, ebx
mov rdx, qword [rbp + 0x20]
cmp rcx, rdx
ja 0x14000e360
lea rax, [rbp + 0x10]
cmp qword [rbp + 0x28], 0x10
cmovae rax, qword [rbp + 0x10]
mov qword [rbp + 0x20], rcx
mov byte [rax + rcx], r13b
jmp 0x14000e3b6
mov rsi, rcx
sub rsi, rdx
mov r8, qword [rbp + 0x28]
mov rax, r8
sub rax, rdx
cmp rsi, rax
ja 0x14000e39c
mov qword [rbp + 0x20], rcx
lea rdi, [rbp + 0x10]
cmp r8, 0x10
cmovae rdi, qword [rbp + 0x10]
add rdi, rdx
mov r8, rsi
xor edx, edx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memset
mov byte [rdi + rsi], 0
jmp 0x14000e3b6
mov byte [rsp + 0x20], 0
mov r9, rsi
movzx r8d, byte [rsp + 0x50]
mov rdx, rsi
lea rcx, [rbp + 0x10]
call fcn.14000a4d0
lea r9, [rbp + 0x10]
cmp qword [rbp + 0x28], 0x10
cmovae r9, qword [rbp + 0x10]
mov dword [rsp + 0x20], ebx
mov r8d, r14d
mov rdx, r15
mov ecx, r12d
call fcn.140012a14
shr rax, 0x20
test eax, eax
jne 0x14000ebd7
lea r15, [0x1411175d0]
cmp qword [0x1411175e8], 8
cmovae r15, qword [0x1411175d0]
mov r14, qword [0x1411175e0]
call fcn.1400129a4
mov r12d, eax
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
mov rcx, r13
mov qword [rbp], rcx
mov edx, 0xf
mov qword [rbp + 8], rdx
mov byte [rbp - 0x10], cl
mov dword [rsp + 0x60], 0x10f
test r14, r14
je 0x14000e512
cmp r14, 0x7fffffff
ja 0x14000ebdf
mov dword [rsp + 0x20], r13d
xor r9d, r9d
mov r8d, r14d
mov rdx, r15
mov ecx, eax
call fcn.140012a14
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x14000ebea
movsxd rcx, ebx
mov rdx, qword [rbp]
cmp rcx, rdx
ja 0x14000e488
lea rax, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rax, qword [rbp - 0x10]
mov qword [rbp], rcx
mov byte [rax + rcx], 0
jmp 0x14000e4de
mov rsi, rcx
sub rsi, rdx
mov r8, qword [rbp + 8]
mov rax, r8
sub rax, rdx
cmp rsi, rax
ja 0x14000e4c4
mov qword [rbp], rcx
lea rdi, [rbp - 0x10]
cmp r8, 0x10
cmovae rdi, qword [rbp - 0x10]
add rdi, rdx
mov r8, rsi
xor edx, edx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memset
mov byte [rdi + rsi], 0
jmp 0x14000e4de
mov byte [rsp + 0x20], 0
mov r9, rsi
movzx r8d, byte [rsp + 0x50]
mov rdx, rsi
lea rcx, [rbp - 0x10]
call fcn.14000a4d0
lea r9, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae r9, qword [rbp - 0x10]
mov dword [rsp + 0x20], ebx
mov r8d, r14d
mov rdx, r15
mov ecx, r12d
call fcn.140012a14
shr rax, 0x20
test eax, eax
jne 0x14000ebbc
mov rdx, qword [rbp + 8]
mov rcx, qword [rbp]
mov rax, rdx
sub rax, rcx
lea rdi, [0x140017e54]
cmp rax, 1
jb 0x14000e59f
lea r8, [rcx + 1]
mov qword [rbp], r8
lea rbx, [rbp - 0x10]
cmp rdx, 0x10
cmovae rbx, qword [rbp - 0x10]
lea rax, [0x140017e55]
cmp rax, rbx
jbe 0x14000e561
lea rax, [rbx + rcx]
cmp rdi, rax
ja 0x14000e561
cmp rbx, rdi
ja 0x14000e559
mov rsi, r13
jmp 0x14000e566
mov rsi, rbx
sub rsi, rdi
jmp 0x14000e566
mov esi, 1
lea rcx, [rbx + 1]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov r8d, 1
sub r8, rsi
lea rdx, [rdi + 1]
add rdx, rsi
lea rcx, [rbx + rsi]
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp - 0x10]
jmp 0x14000e5c3
mov qword [rsp + 0x28], 1
mov qword [rsp + 0x20], rdi
xor r9d, r9d
movzx r8d, byte [rsp + 0x50]
lea edx, [r9 + 1]
lea rcx, [rbp - 0x10]
call fcn.14000a900
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x60], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rcx, qword [rbp + 0x60]
mov rdx, qword [rbp + 0x68]
mov rax, rdx
sub rax, rcx
cmp rax, 2
jb 0x14000e62d
lea rax, [rcx + 2]
mov qword [rbp + 0x60], rax
lea rax, [rbp + 0x50]
cmp rdx, 0x10
cmovae rax, qword [rbp + 0x50]
mov edx, 0x5c5c
mov word [rax + rcx], dx
mov byte [rax + rcx + 2], 0
lea rax, [rbp + 0x50]
jmp 0x14000e651
mov qword [rsp + 0x20], 2
lea r9, [0x140017e5c]
movzx r8d, byte [rsp + 0x50]
mov edx, 2
lea rcx, [rbp + 0x50]
call fcn.14000a340
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xc0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xb0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xc0], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [0x141117570]
cmp qword [0x141117588], 0x10
cmovae rdx, qword [0x141117570]
mov r8, qword [0x141117580]
lea rcx, [rbp + 0xb0]
call fcn.14000d930
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x40], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rcx, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x48]
mov rax, rdx
sub rax, rcx
cmp rax, 3
jb 0x14000e72c
lea rax, [rcx + 3]
mov qword [rbp + 0x40], rax
lea rbx, [rbp + 0x30]
cmp rdx, 0x10
cmovae rbx, qword [rbp + 0x30]
add rbx, rcx
mov r8d, 3
lea rdx, [0x140017e58]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 3], 0
lea rax, [rbp + 0x30]
jmp 0x14000e750
mov qword [rsp + 0x20], 3
lea r9, [0x140017e58]
movzx r8d, byte [rsp + 0x50]
mov edx, 3
lea rcx, [rbp + 0x30]
call fcn.14000a340
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xd0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xe0], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea r9, [rbp + 0x10]
lea r8, [rbp + 0xd0]
movzx edx, byte [rsp + 0x50]
lea rcx, [rbp + 0x70]
call fcn.14000af60
nop
mov rcx, qword [rbp + 0x80]
mov rdx, qword [rbp + 0x88]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x14000e7cc
lea rax, [rcx + 1]
mov qword [rbp + 0x80], rax
lea rax, [rbp + 0x70]
cmp rdx, 0x10
cmovae rax, qword [rbp + 0x70]
mov word [rax + rcx], 0x22
lea rax, [rbp + 0x70]
jmp 0x14000e7ec
mov qword [rsp + 0x20], 1
mov r9, rdi
movzx r8d, byte [rsp + 0x50]
mov edx, 1
lea rcx, [rbp + 0x70]
call fcn.14000a340
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xa0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x90], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xa0], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 0x10
cmovae rdx, qword [rbp + 0x90]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x7c], xmm0
movups xmmword [rbp - 0x6c], xmm0
movups xmmword [rbp - 0x5c], xmm0
movups xmmword [rbp - 0x4c], xmm0
movups xmmword [rbp - 0x3c], xmm0
movups xmmword [rbp - 0x2c], xmm0
mov dword [rbp - 0x1c], eax
mov dword [rbp - 0x80], 0x68
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
call sub.MSVCP140.dll__Query_perf_frequency
mov rbx, rax
call sub.MSVCP140.dll__Query_perf_counter
cmp rbx, 0x989680
jne 0x14000e8c9
imul rax, rax, 0x64
jmp 0x14000e8e4
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
mov qword [0x141117568], rax
nop dword [rax + rax]
mov edx, dword [rsp + 0x70]
lea rcx, [0x14000c480]
call qword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
jne 0x14000e8f0
mov rdx, qword [rbp + 0xa8]
cmp rdx, 0x10
jb 0x14000e949
inc rdx
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e944
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000e944
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140011cc8
movdqa xmm0, xmmword [0x140018010]
movdqu xmmword [rbp + 0xa0], xmm0
mov byte [rbp + 0x90], 0
mov rdx, qword [rbp + 0x88]
cmp rdx, 0x10
jb 0x14000e9a1
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e99c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000e99c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140011cc8
movdqa xmm0, xmmword [0x140018010]
movdqu xmmword [rbp + 0x80], xmm0
mov byte [rbp + 0x70], 0
mov rdx, qword [rbp + 0xe8]
cmp rdx, 0x10
jb 0x14000e9fa
inc rdx
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e9f4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000e9f4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140011cc8
nop
mov rdx, qword [rbp + 0x48]
cmp rdx, 0x10
jb 0x14000ea38
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ea33
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000ea33
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140011cc8
movdqa xmm0, xmmword [0x140018010]
movdqu xmmword [rbp + 0x40], xmm0
mov byte [rbp + 0x30], 0
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0x10
jb 0x14000ea8d
inc rdx
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ea88
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000ea88
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140011cc8
movdqa xmm0, xmmword [0x140018010]
movdqu xmmword [rbp + 0xc0], xmm0
mov byte [rbp + 0xb0], 0
mov rdx, qword [rbp + 0x68]
cmp rdx, 0x10
jb 0x14000eae2
inc rdx
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000eadd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000eadd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140011cc8
movdqa xmm0, xmmword [0x140018010]
movdqu xmmword [rbp + 0x60], xmm0
mov byte [rbp + 0x50], 0
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x14000eb31
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000eb2c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000eb2c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140011cc8
mov qword [rbp], r13
mov qword [rbp + 8], 0xf
mov byte [rbp - 0x10], 0
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x14000eb80
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000eb7a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000eb7a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140011cc8
nop
lea rcx, [rbp + 0xf0]
call fcn.14000d630
mov rcx, qword [rbp + 0x110]
xor rcx, rsp
call fcn.140011970
lea r11, [rsp + 0x220]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, eax
call fcn.14000d5f0
nop
mov ecx, 0x16
call fcn.14000d5b0
int3
mov ecx, eax
call fcn.14000d5f0
int3
mov ecx, eax
call fcn.14000d5f0
nop
mov ecx, 0x16
call fcn.14000d5b0
int3
mov ecx, eax
call fcn.14000d5f0
int3