Function at 0x1400a6890
Capabilities:
Copy file
Create thread

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x248
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov eax, dword [rsp + 0x2b0]
mov r15, qword [rsp + 0x2b8]
mov r12, qword [rsp + 0x2c0]
mov dword [rsp + 0x68], eax
mov qword [rsp + 0xa8], r15
mov r14, r9
mov qword [rsp + 0x98], r9
mov ebp, r8d
mov dword [rsp + 0x64], r8d
mov rsi, rdx
mov rbx, rcx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0x80], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
or rdi, 0xffffffffffffffff
mov qword [rsp + 0x70], rax
mov rcx, rdi
inc rcx
cmp byte [rsi + rcx], 0
jne 0x1400a6912
mov r13d, ebp
mov rax, rdi
sub r13d, r14d
sub r13d, ecx
nop word [rax + rax]
inc rax
cmp byte [r12 + rax], 0
jne 0x1400a6930
sub r13d, eax
mov rax, rdi
inc rax
cmp byte [rbx + rax], 0
jne 0x1400a6940
add r13d, eax
mov dword [rsp + 0x90], r13d
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
mov rbp, rdi
mov word [rsp + 0x60], ax
inc rbp
cmp byte [rsi + rbp], 0
jne 0x1400a6962
mov rax, rdi
nop
inc rax
cmp byte [rbx + rax], 0
jne 0x1400a6970
imul ebp, eax
mov eax, dword [rsp + 0x68]
imul eax, r14d
imul eax, dword [rsp + 0x64]
sub ebp, eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rdx, str.garter
mov r8d, r13d
mov rcx, rbx
mov qword [rsp + 0xb0], rax
call qword [sym.imp.KERNEL32.dll_CopyFileA]
xor ecx, ecx
mov edx, 0x268
lea r8d, [rcx + 0x1d]
mov dword [rsp + 0x78], eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r14, rdi
mov qword [rsp + 0x88], rax
nop dword [rax]
inc r14
cmp byte [rsi + r14], 0
jne 0x1400a69d0
mov rax, rdi
nop dword [rax]
inc rax
cmp byte [rbx + rax], 0
jne 0x1400a69e0
movzx edx, word [rsp + 0x60]
imul r14d, eax
mov rax, rdi
imul r14d, dword [rsp + 0x98]
movzx edx, dl
sub r14d, dword [rsp + 0x80]
add r14d, 6
nop dword [rax]
inc rax
cmp byte [r12 + rax], 0
jne 0x1400a6a10
mov rcx, rdi
nop dword [rax]
inc rcx
cmp byte [r15 + rcx], 0
jne 0x1400a6a20
imul eax, ecx
mov ecx, 6
imul eax, r13d
sub ecx, eax
mov rax, rdi
sub ecx, edx
nop dword [rax]
inc rax
cmp byte [rbx + rax], 0
jne 0x1400a6a40
add ecx, eax
mov dword [rsp + 0xc8], ecx
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rcx, rdi
nop dword [rax + rax]
inc rcx
cmp byte [r12 + rcx], 0
jne 0x1400a6a60
movzx eax, r13b
imul cl
movzx ecx, al
movzx eax, byte [rsp + 0x70]
imul cl
mov rcx, rdi
movzx edx, al
inc rcx
cmp byte [r15 + rcx], 0
jne 0x1400a6a80
movzx eax, byte [rsp + 0x68]
imul cl
mov rcx, rdi
movzx r15d, al
sub r15b, dl
sub r15b, 0x10
add r15b, byte [rsp + 0xc8]
add r15b, byte [rsp + 0x88]
nop
inc rcx
cmp byte [rsi + rcx], 0
jne 0x1400a6ab0
add r15b, cl
mov rax, rdi
nop
inc rax
cmp byte [rbx + rax], 0
jne 0x1400a6ac0
mov r9d, dword [rsp + 0x64]
xor ecx, ecx
add r15b, al
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rcx
mov eax, r13d
lea r8, str.garter
mov rdx, rsi
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], ebp
mov qword [rsp + 0xa0], rax
mov eax, dword [rsp + 0x78]
mov ecx, r9d
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov rcx, rdi
mov qword [rsp + 0x70], rax
inc rcx
cmp byte [rsi + rcx], 0
jne 0x1400a6b23
mov rax, qword [rsp + 0xb0]
mov r13d, dword [rsp + 0x88]
imul eax, dword [rsp + 0x80]
sub r13d, eax
mov rax, rdi
sub r13d, dword [rsp + 0x98]
sub r13d, ecx
inc rax
cmp byte [rbx + rax], 0
jne 0x1400a6b55
xor ecx, ecx
mov edx, 0xaf
add r13d, eax
lea r8d, [rcx + 0x1b]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r9, qword [rsp + 0x70]
movsx r8d, r15b
movzx edx, r13b
mov dword [rsp + 0x80], r8d
sub dl, r9b
sub dl, 0x40
add dl, al
add dl, r15b
mov byte [rsp + 0x62], dl
cmp dword [rsp + 0x64], r8d
jl 0x1400a6cea
mov rcx, rdi
inc rcx
cmp byte [r12 + rcx], 0
jne 0x1400a6ba4
mov al, 0xb
imul r9b
lea r15d, [rax + rbp]
mov rax, rdi
add r15b, dl
add r15b, byte [rsp + 0x60]
sub r15b, cl
inc rax
cmp byte [rbx + rax], 0
jne 0x1400a6bc5
mov ecx, dword [rsp + 0x78]
xor edx, edx
mov r9d, ebp
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x38], r8d
mov dword [rsp + 0x30], 0xb
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], ecx
mov r8, rsi
mov ecx, r13d
mov rdx, rsi
add r15b, al
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov rsi, rax
inc rdi
cmp byte [rbx + rdi], 0
jne 0x1400a6c15
movzx ecx, byte [rsp + 0x62]
mov eax, dword [rsp + 0x80]
mov rbx, qword [rsp + 0x70]
imul ecx, ebx
imul eax, r14d
shl ecx, 6
xor edx, edx
mov r8d, 0x140
add ecx, eax
sub ecx, dword [rsp + 0x88]
add ecx, dword [rsp + 0x64]
add edi, ecx
lea rcx, [rsp + 0xf0]
mov dword [rsp + 0xb8], edi
call fcn.1400e27d0
lea rdx, [rsp + 0xf0]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r8d, dword [rsp + 0x68]
movzx edx, word [rsp + 0x60]
mov r9d, dword [rsp + 0x90]
movzx eax, r15b
imul sil
movzx ecx, al
mov al, 0x2a
imul cl
sub al, dil
xor edi, edi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
movsx ecx, al
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], r8d
movzx eax, dl
mov rdx, qword [rsp + 0xa8]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], r8d
lea ecx, [rdi + 0x40]
mov r8, r12
call qword [sym.imp.USER32.dll_CreateWindowExA]
jmp 0x1400a6cf1
mov rbx, qword [rsp + 0x70]
xor edi, edi
mov edx, 0x72
xor ecx, ecx
lea r8d, [rdx - 0x6e]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0xf0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
movzx r9d, byte [rsp + 0x60]
lea r8, [0x140001b00]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
mov edx, 0x362
lea r8d, [rcx + 0xd]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rax, rbx
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x248
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret