Function at 0x14002cf40
Capabilities:
Create process on windows
Enumerate gui resources

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov rax, qword [0x140300040]
xor rax, rsp
mov qword [rbp + 0x60], rax
mov r12, rdx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x70], rdx
xor edi, edi
mov dword [rsp + 0x38], edi
call fcn.14002ce80
mov qword [rbp], rdi
call fcn.140019590
mov rcx, rax
test rax, rax
je 0x14002d5cc
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038ca6.0]
add rax, 0x18
mov qword [rbp], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r9, rbx
mov r8d, eax
lea rdx, str._u__I64u_sample
lea rcx, [rbp]
call fcn.14001c4c0
lea rcx, [rsp + 0x58]
call fcn.140022fd0
mov r15, rax
mov qword [rsp + 0x40], rdi
mov rcx, qword [rax]
mov rcx, qword [rcx - 0x18]
test rcx, rcx
je 0x14002d004
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x20]
call qword [case.0x140038ca6.0]
mov rcx, rax
test rax, rax
jne 0x14002d028
call fcn.140019590
mov rdx, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x20]
mov rcx, rdx
call qword [case.0x140038ca6.0]
mov rcx, rax
test rax, rax
je 0x14002d5b6
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x140038ca6.0]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x38], 1
mov rdi, qword [rbp]
movsxd r13, dword [rdi - 0x10]
mov r15, qword [r15]
movsxd r14, dword [r15 - 0x10]
lea esi, [r14 + r13]
test esi, esi
js 0x14002d5c1
mov ecx, 1
sub ecx, dword [rax + 0x10]
mov eax, dword [rax + 0xc]
sub eax, esi
or eax, ecx
jge 0x14002d083
mov edx, esi
lea rcx, [rsp + 0x40]
call fcn.140018ea0
mov rbx, qword [rsp + 0x40]
add r14, r14
je 0x14002d0b9
test rbx, rbx
je 0x14002d0a9
mov r8, r14
mov rcx, rbx
test r15, r15
je 0x14002d0a2
mov rdx, r15
call fcn.14022e460
jmp 0x14002d0b9
xor edx, edx
call fcn.14022eb00
call fcn.1401fed34
mov dword [rax], 0x16
call fcn.1401feb94
mov r8, r13
add r8, r8
lea rcx, [r14 + rbx]
je 0x14002d0e4
test rcx, rcx
jne 0x14002d0dc
call fcn.1401fed34
mov dword [rax], 0x16
call fcn.1401feb94
jmp 0x14002d0e4
mov rdx, rdi
call fcn.14022e460
cmp esi, dword [rbx - 0xc]
jg 0x14002d5c1
mov dword [rbx - 0x10], esi
movsxd rax, esi
xor r13d, r13d
mov word [rbx + rax*2], r13w
mov r8, r12
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.140029150
nop
mov rdx, rax
mov r15, qword [rsp + 0x30]
mov rcx, r15
call fcn.140017b80
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov rbx, 0xffffffffffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002d14b
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
mov eax, 1
and eax, 0xfffffffe
mov dword [rsp + 0x38], eax
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002d17d
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002d1a2
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm0
lea rax, vtable.XWriteStream.0
mov qword [rbp + 0x10], rax
lea rax, vtable.XFileWriteStream.0
mov qword [rbp + 0x10], rax
mov dword [rbp + 0x48], r13d
mov qword [rbp + 0x18], rbx
mov qword [rbp + 0x28], r13
mov qword [rbp + 0x30], r13
mov dword [rbp + 0x38], r13d
mov qword [rbp + 0x40], r13
mov r14d, 0x2000
mov ecx, r14d
call fcn.140207158
mov qword [rbp + 0x20], rax
mov rdx, qword [r15]
lea rcx, [rbp + 0x10]
call fcn.14004b230
mov rsi, qword [rbp + 0x18]
cmp rsi, 0xffffffffffffffff
je 0x14002d294
mov rdi, qword [rbp + 0x28]
sub r14, rdi
cmp r14d, 3
mov r14, qword [rbp + 0x20]
jb 0x14002d241
mov eax, dword [0x140295340]
mov word [r14 + rdi], ax
movzx eax, byte [0x140295342]
mov byte [r14 + rdi + 2], al
add rdi, 3
mov qword [rbp + 0x28], rdi
jmp 0x14002d278
test rdi, rdi
je 0x14002d258
mov r8, rdi
mov rdx, r14
mov rcx, rsi
call fcn.14004b570
test eax, eax
je 0x14002d27d
mov rdi, r13
mov qword [rbp + 0x28], r13
mov r8d, 3
lea rdx, [0x140295340]
mov rcx, rsi
call fcn.14004b570
test eax, eax
je 0x14002d27d
add qword [rbp + 0x30], 3
test rdi, rdi
je 0x14002d294
mov r8, rdi
mov rdx, r14
mov rcx, rsi
call fcn.14004b570
test eax, eax
je 0x14002d298
mov qword [rbp + 0x28], r13
cmp dword [rbp + 0x38], 0
je 0x14002d2ad
cmp rsi, 0xffffffffffffffff
je 0x14002d2ad
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x18], rbx
mov qword [rbp + 0x28], r13
mov qword [rbp + 0x30], r13
mov dword [rbp + 0x38], r13d
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x14002d2cb
call fcn.140207144
mov qword [rbp + 0x40], r13
lea rax, [rsp + 0x30]
mov qword [rsp + 0x60], rax
mov rcx, qword [r15]
sub rcx, 0x18
call fcn.140019180
add rax, 0x18
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x68], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
mov dword [rbp - 0x70], 0x70
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x58], rax
mov dword [rbp - 0x40], 5
mov dword [rbp - 0x6c], InitCommonControls
lea rax, str.properties
mov qword [rbp - 0x60], rax
lea rcx, [rbp - 0x70]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov edi, eax
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov ecx, ebx
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x14002d371
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
test edi, edi
jne 0x14002d421
lea rax, vtable.XFileWriteStream.0
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x28], r13
mov qword [rbp + 0x18], rbx
mov qword [rbp + 0x28], r13
mov qword [rbp + 0x30], r13
mov dword [rbp + 0x38], r13d
mov qword [rbp + 0x40], r13
mov rcx, qword [rbp + 0x20]
call fcn.140207144
nop
lea rax, vtable.XWriteStream.0
mov qword [rbp + 0x10], rax
mov rdx, qword [rbp]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002d3d6
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
mov rdx, qword [r12]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x14002d3f8
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
xor al, al
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.1401f74b0
mov rbx, qword [rsp + 0x1c0]
add rsp, 0x170
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rax, [rsp + 0x48]
mov qword [rsp + 0x68], rax
mov rcx, qword [rbp]
add rcx, 0xffffffffffffffe8
call fcn.140019180
add rax, 0x18
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x60], rax
mov qword [rbp - 0x80], r13
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x78], rax
mov edi, 0x3e8
nop
lea rdx, [rsp + 0x78]
lea rcx, [0x14002d5e0]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rcx, qword [rbp - 0x80]
test rcx, rcx
jne 0x14002d498
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
sub edi, 0xa
test edi, edi
jg 0x14002d460
mov rcx, qword [rbp - 0x80]
test rcx, rcx
jne 0x14002d498
jmp 0x14002d50a
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x50], xmm0
lea rdx, [rbp + 0x50]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [rbp + 0x50]
mov dword [rbp + 0x58], edx
mov r8d, dword [rbp + 0x54]
mov dword [rbp + 0x5c], r8d
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], r13d
xor r9d, r9d
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.USER32.dll_MoveWindow]
xor edx, edx
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.USER32.dll_ShowWindow]
xor r9d, r9d
mov edx, VarUI4FromDisp
mov r8d, 0x3363
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.USER32.dll_PostMessageW]
xor edx, edx
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rax, qword [rbp - 0x80]
mov qword [r15 + 8], rax
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002d530
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
lea rax, vtable.XFileWriteStream.0
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x28], r13
mov qword [rbp + 0x18], rbx
mov qword [rbp + 0x28], r13
mov qword [rbp + 0x30], r13
mov dword [rbp + 0x38], r13d
mov qword [rbp + 0x40], r13
mov rcx, qword [rbp + 0x20]
call fcn.140207144
nop
lea rax, vtable.XWriteStream.0
mov qword [rbp + 0x10], rax
mov rdx, qword [rbp]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002d58d
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
mov rdx, qword [r12]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x14002d5af
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
mov al, 1
jmp 0x14002d3fa
mov ecx, 0x80004005
call fcn.140019300
int3
mov ecx, 0x80070057
call fcn.140019300
nop
mov ecx, 0x80004005
call fcn.140019300
int3