Function at 0x14007d950
Capabilities:
Create thread

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x198
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov rax, qword [rsp + 0x200]
mov rdi, qword [rsp + 0x208]
mov r12d, dword [rsp + 0x210]
xor ebx, ebx
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x60], r9
mov r14, r8
mov ebp, edx
mov esi, ecx
cmp ecx, edx
jne 0x14007da02
lea r8d, [rbx + 0x14]
mov edx, 0x1d2
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea r8, [0x140001b00]
mov r9d, esi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea r8d, [rbx + 7]
mov edx, 0x160
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r13, rax
lea r15d, [rax - 2]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
test bpl, bpl
je 0x14007dbc5
or rcx, 0xffffffffffffffff
mov rbx, rcx
inc rbx
cmp byte [rdi + rbx], 0
jne 0x14007da25
imul ebx, r13d
sub ebx, dword [rsp + 0x68]
sub ebx, ebp
add ebx, esi
nop word [rax + rax]
inc rcx
cmp byte [r14 + rcx], 0
jne 0x14007da40
sub ebx, ecx
sub ebx, 0xa
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor r13d, r13d
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], ebp
mov dword [rsp + 0x30], ebx
lea r8, [0x1400ed7c8]
lea rdx, str.wetsuit
mov r9d, ebx
mov ecx, ebx
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], ebp
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r13
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], r12d
lea r8, str.wetsuit
xor r9d, r9d
mov rdx, rdi
xor ecx, ecx
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], ebp
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea r8, [0x140001b00]
mov r9, rsi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [rsp + 0x70]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea edx, [r13 + 0x29]
lea r8d, [r13 + 0xc]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x38], r15d
mov dword [rsp + 0x30], r13d
lea r8, str.intestine
lea rdx, str.attachment
xor r9d, r9d
mov ecx, r15d
mov dword [rsp + 0x28], r13d
movzx edi, ax
mov dword [rsp + 0x20], r12d
call qword [sym.imp.USER32.dll_CreateWindowExA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea r8d, [r13 + 0xb]
mov edx, 0x3d1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea r8d, [r13 + 0x11]
mov edx, 0x35e
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea r8, [0x140001b00]
movzx r9d, dil
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov edx, 0x112
xor ecx, ecx
lea r8d, [r13 + 0x16]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
jmp 0x14007dbc8
xor r13d, r13d
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r8, qword [rsp + 0x60]
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r13
mov eax, r15d
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], r15d
mov r9d, r15d
mov rdx, r14
mov ecx, r12d
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], ebp
mov dword [rsp + 0x30], ebp
lea r8, [0x1400ed7c8]
lea rdx, [0x1400ed7c8]
mov r9d, esi
mov ecx, r12d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
call qword [sym.imp.USER32.dll_CreateWindowExA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x198
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret