Function at 0x140012510
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x328]
sub rsp, 0x428
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x310], rax
mov eax, dword [rbp + 0x390]
mov r13, r9
mov r12d, r8d
mov dword [rsp + 0x78], eax
mov eax, dword [rbp + 0x398]
mov dword [rsp + 0x60], r8d
mov rsi, rdx
mov rbx, rcx
mov dword [rsp + 0x7c], eax
call fcn.140056ec0
or rdi, 0xffffffffffffffff
mov ecx, eax
mov dword [rsp + 0x64], eax
mov r14, rdi
inc r14
cmp byte [rsi + r14], 0
jne 0x140012574
imul r14d, r12d
sub r14d, eax
mov rax, rdi
nop dword [rax + rax]
inc rax
cmp byte [rbx + rax], 0
jne 0x140012590
add r14d, eax
mov r15, rdi
nop
inc r15
cmp byte [rsi + r15], 0
jne 0x1400125a0
mov rax, rdi
nop dword [rax]
inc rax
cmp byte [rbx + rax], 0
jne 0x1400125b0
imul r15d, eax
lea r8, [0x1400ed3f4]
mov edx, r14d
sub r15d, dword [rsp + 0x78]
add r15d, ecx
lea rcx, [0x1400ed4d4]
mov r9d, r15d
call fcn.1400302c0
mov dword [rsp + 0x6c], eax
cmp dword [rsp + 0x78], eax
jle 0x140012612
mov rcx, rdi
nop dword [rax + rax]
inc rcx
cmp byte [rbx + rcx], 0
jne 0x1400125f0
mov edx, eax
mov eax, r12d
imul edx, r14d
sub eax, edx
add ecx, eax
call fcn.14005e7b0
xor ecx, ecx
call fcn.140054350
lea rdx, str.c1a0
lea rcx, str.observatory
call fcn.140049bb0
lea rcx, [rbp + 0xf0]
mov edx, 0x104
mov dword [rsp + 0x68], eax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov r12, rax
mov qword [rbp - 0x60], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, [0x1400ed3f4]
mov rdx, r12
xor ecx, ecx
mov r9d, eax
mov dword [rsp + 0x74], eax
call fcn.14001d6b0
mov rcx, rdi
mov qword [rbp - 0x68], rax
inc rcx
cmp byte [rsi + rcx], 0
jne 0x140012667
imul ecx, dword [rsp + 0x60]
mov edx, dword [rsp + 0x6c]
mov eax, r12d
imul eax, dword [rsp + 0x74]
imul eax, dword [rsp + 0x68]
add eax, eax
sub edx, eax
add edx, edx
sub edx, ecx
mov rcx, rdi
sub edx, dword [rsp + 0x64]
inc rcx
cmp byte [rbx + rcx], 0
jne 0x140012695
mov eax, dword [rsp + 0x78]
add eax, 9
add eax, edx
add eax, ecx
mov rcx, r13
mov dword [rbp - 0x80], eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rdi
mov rdx, rax
mov qword [rbp - 0x70], rax
nop word [rax + rax]
inc rcx
cmp byte [rsi + rcx], 0
jne 0x1400126d0
mov rax, rdi
nop dword [rax]
inc rax
cmp byte [rbx + rax], 0
jne 0x1400126e0
imul ecx, eax
mov eax, dword [rsp + 0x74]
mov r8d, 0x40
lea eax, [rcx + rax*2]
mov ecx, dword [rsp + 0x64]
sub eax, dword [rsp + 0x7c]
add ecx, 5
sub eax, r12d
mov r12d, dword [rsp + 0x60]
sub eax, dword [rsp + 0x6c]
add eax, r12d
add eax, dword [rsp + 0x68]
add eax, r15d
add eax, r14d
add eax, ecx
mov ecx, dword [rbp - 0x80]
mov r9d, eax
mov dword [rsp + 0x70], eax
call fcn.14001e330
xor ecx, ecx
mov edx, 0x36d
lea r8d, [rcx + 0x1a]
mov qword [rbp + 8], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, rdi
mov r8, rax
mov qword [rbp], rax
nop dword [rax]
inc rcx
cmp byte [rsi + rcx], 0
jne 0x140012750
mov edx, dword [rbp - 0x70]
imul ecx, r12d
mov rax, rdi
imul edx, dword [rbp - 0x80]
sub edx, ecx
sub edx, dword [rsp + 0x70]
sub edx, dword [rsp + 0x68]
sub edx, dword [rsp + 0x6c]
inc rax
cmp byte [r13 + rax], 0
jne 0x140012775
add edx, r15d
mov r12, rdi
inc r12
cmp byte [rbx + r12], 0
jne 0x140012786
add edx, eax
lea rax, str.roundabout
lea rcx, [rbp + 0x10]
add r12d, edx
mov qword [rsp + 0x28], rax
lea rdx, [0x1400ed4d4]
add r12d, r14d
xor r9d, r9d
add r12d, dword [rsp + 0x64]
mov dword [rsp + 0x20], r12d
call fcn.140047160
xor ecx, ecx
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xc0], xmm0
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rbp + 0xd0], xmm1
movups xmmword [rbp + 0xe0], xmm0
cmp r15d, dword [rsp + 0x68]
ja 0x14001297b
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
mov edx, 0x305
lea r8d, [rcx + 0x11]
mov qword [rbp + 0x98], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rbp + 0x90], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [rbp - 0x78], rax
lea rax, str.prompt
mov qword [rbp - 0x50], rax
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
movzx ecx, ax
mov rax, qword [rbp - 0x70]
mov qword [rbp - 0x40], rax
mov dword [rbp - 0x48], ecx
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [rbp - 0x38], rax
lea rax, str.c1a0
xor r8d, r8d
mov qword [rbp - 0x28], rax
mov dword [rbp - 0x30], r8d
mov rdx, rdi
nop dword [rax + rax]
inc rdx
cmp byte [rsi + rdx], r8b
jne 0x140012860
mov rax, rdi
nop dword [rax]
inc rax
cmp byte [rbx + rax], r8b
jne 0x140012870
imul edx, eax
mov eax, r15d
mov qword [rsp + 0x28], r8
imul eax, r14d
mov dword [rsp + 0x20], r8d
lea r8, [0x140001b00]
lea ecx, [rax*2 - 8]
mov eax, dword [rsp + 0x7c]
movsxd r9, r12d
imul eax, dword [rsp + 0x60]
sub ecx, eax
lea rax, str.c5a2
add edx, ecx
xor ecx, ecx
mov qword [rbp - 0x18], rax
sub edx, r12d
sub edx, dword [rsp + 0x70]
sub edx, dword [rbp - 0x80]
add edx, dword [rsp + 0x74]
add edx, dword [rsp + 0x68]
add edx, dword [rsp + 0x6c]
mov dword [rbp - 0x20], edx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rdi
mov qword [rbp - 0x10], rax
movaps xmm0, xmmword [rbp - 0x50]
movaps xmm1, xmmword [rbp - 0x40]
movaps xmmword [rbp + 0x10], xmm0
movaps xmm0, xmmword [rbp - 0x30]
movaps xmmword [rbp + 0x20], xmm1
movaps xmm1, xmmword [rbp - 0x20]
movaps xmmword [rbp + 0x30], xmm0
movsd xmm0, qword [rbp - 0x10]
movsd qword [rbp + 0x50], xmm0
movaps xmmword [rbp + 0x40], xmm1
nop word [rax + rax]
inc rcx
cmp byte [rbx + rcx], 0
jne 0x140012910
imul ecx, dword [rsp + 0x60]
mov eax, dword [rbp - 0x70]
imul ecx, dword [rsp + 0x64]
imul eax, r12d
add eax, 3
lea edx, [rcx + rax*2]
mov rcx, qword [rbp - 0x68]
mov rax, rdi
sub edx, dword [rbp + 0xe0]
sub edx, dword [rbp - 0x60]
sub edx, r14d
inc rax
cmp byte [rcx + rax], 0
jne 0x140012943
mov r9, qword [rbp - 0x78]
mov rcx, qword [rbp + 0x98]
add edx, eax
mov dword [rsp + 0x28], edx
mov rdx, qword [rbp + 0x90]
lea rax, [rbp + 0x10]
lea r8, str.c7a4
mov qword [rsp + 0x20], rax
call fcn.14002f5b0
xor ecx, ecx
movsxd rax, dword [rsp + 0x6c]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rcx
mov ecx, dword [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x38], ecx
mov r9d, ecx
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], eax
lea r8, [0x1400ed4d4]
mov rdx, rsi
mov ecx, r15d
mov dword [rsp + 0x20], r15d
call qword [sym.imp.USER32.dll_CreateWindowExA]
xor ecx, ecx
mov edx, 0x334
mov qword [rbp - 0x78], rax
mov rax, qword [rbp - 0x60]
lea r8d, [rcx + 0x1d]
mov qword [rbp + 0xa0], rax
lea rax, str.vixen
mov qword [rbp + 0xa8], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r8, qword [rbp - 0x78]
movups xmm0, xmmword [rbp + 0xa0]
mov qword [rbp + 0xb0], rax
lea rax, str.c1a2
lea r9, [rbp + 0x60]
movaps xmmword [rbp + 0x60], xmm0
movsd xmm1, qword [rbp + 0xb0]
movsd qword [rbp + 0x70], xmm1
mov qword [rsp + 0x30], rax
lea rax, [0x1400ed4d4]
lea rcx, [rbp - 0x50]
mov qword [rsp + 0x28], rax
lea rax, str.ottoman
xor edx, edx
mov qword [rsp + 0x20], rax
call fcn.140040d50
mov r11, qword [rbp - 0x70]
mov r9, rdi
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x10], xmm0
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rbp + 0x20], xmm1
mov qword [rbp - 0x50], r11
movups xmmword [rbp + 0x30], xmm0
nop word [rax + rax]
inc r9
cmp byte [r13 + r9], 0
jne 0x140012a70
mov rax, rdi
nop
inc rax
cmp byte [rsi + rax], 0
jne 0x140012a80
add r9d, dword [rbp - 0x60]
mov r8, rdi
cmp byte [rbx + r8 + 1], 0
lea r8, [r8 + 1]
jne 0x140012a90
mov edx, dword [rbp + 0x38]
mov r10d, dword [rsp + 0x60]
add r9d, eax
mov rax, qword [rbp]
mov ecx, r15d
mov qword [rbp - 0x40], r11
imul edx, dword [rbp + 0xb0]
imul ecx, dword [rsp + 0x64]
lea eax, [rax + rax*4]
mov dword [rbp - 0x38], 8
add edx, eax
mov eax, r11d
shl eax, 6
add edx, eax
mov eax, dword [rsp + 0x7c]
add edx, edx
sub ecx, edx
mov rdx, qword [rbp - 0x78]
imul eax, dword [rsp + 0x78]
add ecx, eax
lea eax, [r9 + r8]
mov qword [rbp - 0x28], rdx
sub ecx, edx
mov rdx, rdi
add ecx, 0xfffffff3
add ecx, r10d
add eax, ecx
mov dword [rbp - 0x48], eax
lea rax, str.november
mov qword [rbp - 0x30], rax
lea rax, str.clasp
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x68]
inc rdx
cmp byte [rax + rdx], 0
jne 0x140012b17
imul edx, dword [rsp + 0x74]
mov eax, dword [rsp + 0x70]
mov r8, rdi
lea eax, [rax*8]
sub edx, eax
lea eax, [r12 + r12*4]
shl edx, 3
shl eax, 2
sub edx, eax
sub edx, r10d
sub edx, r15d
sub edx, r14d
nop word [rax + rax]
inc r8
cmp byte [r13 + r8], 0
jne 0x140012b50
movsxd r14, dword [rsp + 0x7c]
add edx, 9
mov rax, rdi
inc rax
cmp byte [rbx + rax], 0
jne 0x140012b66
add edx, r14d
xor ecx, ecx
add edx, r8d
lea r8d, [rcx + 0x1c]
add eax, edx
mov edx, 0xa7
mov dword [rbp - 0x18], eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, str.observatory
mov qword [rbp - 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
lea rcx, [rbp + 0x200]
mov edx, 0x104
mov qword [rbp + 0x60], rax
mov rax, qword [rbp - 0x78]
mov dword [rbp + 0x70], 0x40
mov qword [rbp + 0x68], rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov r13d, dword [rbp - 0x80]
xor r8d, r8d
mov qword [rbp + 0x78], rax
mov eax, dword [rsp + 0x64]
mov qword [rsp + 0x58], r8
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x60]
mov r9d, r14d
mov r14, qword [rbp + 8]
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], eax
lea rdx, [0x1400ed4d4]
mov ecx, r12d
mov r8, r14
mov dword [rsp + 0x20], r13d
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov rcx, rdi
mov qword [rbp + 0x80], rax
mov rax, qword [rbp - 0x68]
nop dword [rax]
inc rcx
cmp byte [rax + rcx], 0
jne 0x140012c30
imul ecx, dword [rbp - 0x70]
mov eax, dword [rsp + 0x68]
imul eax, r15d
imul ecx, r13d
add ecx, eax
mov rax, rdi
nop
inc rax
cmp byte [r14 + rax], 0
jne 0x140012c50
imul eax, dword [rsp + 0x70]
mov rdx, rdi
sub ecx, eax
inc rdx
cmp byte [rsi + rdx], 0
jne 0x140012c64
add ecx, dword [rbp + 0x10]
mov r8d, dword [rsp + 0x78]
imul edx, r8d
lea eax, [rdx*2 - 0x3b]
add eax, ecx
add eax, dword [rbp + 0xe8]
nop dword [rax + rax]
inc rdi
cmp byte [rbx + rdi], 0
jne 0x140012c90
add eax, dword [rbp]
mov r9d, dword [rsp + 0x74]
xor ecx, ecx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rcx
add eax, edi
lea rdx, [0x1400ed3f4]
mov ecx, r15d
mov dword [rbp + 0x88], eax
movsxd rax, r12d
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x6c]
mov dword [rsp + 0x38], 0x40
mov dword [rsp + 0x30], r8d
lea r8, [0x1400ed3f4]
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea rdx, [rbp + 0xc0]
movups xmm0, xmmword [rbp + 0x60]
movups xmm1, xmmword [rbp + 0x70]
lea rcx, [rbp + 0x10]
mov r8, rax
movaps xmmword [rbp + 0xc0], xmm0
movaps xmmword [rbp + 0xd0], xmm1
movaps xmm1, xmmword [rbp - 0x40]
movups xmm0, xmmword [rbp + 0x80]
movaps xmmword [rbp + 0x20], xmm1
movaps xmm1, xmmword [rbp - 0x20]
movaps xmmword [rbp + 0xe0], xmm0
movaps xmm0, xmmword [rbp - 0x50]
movaps xmmword [rbp + 0x40], xmm1
movaps xmmword [rbp + 0x10], xmm0
movaps xmm0, xmmword [rbp - 0x30]
movaps xmmword [rbp + 0x30], xmm0
movsd xmm0, qword [rbp - 0x10]
movsd qword [rbp + 0x50], xmm0
call fcn.14003d1b0
lea rax, str.c7a0
mov rcx, qword [rbp + 0x310]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x428
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret