Function at 0x140033980
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3b0]
sub rsp, 0x4b0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x3a0], rax
call fcn.14005ed30
mov r13, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rbp + 0x290]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rbp + 0x40], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rbp + 0x290]
mov edx, 0x104
mov rdi, rax
mov qword [rbp - 0x80], rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov r14, rax
mov qword [rbp - 0x30], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rcx, [rbp + 0x150]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r15d, r15d
mov esi, eax
cmp eax, 0x24
jbe 0x140033a8d
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea r8d, [r15 + 0xf]
mov edx, 0x137
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea r8, [0x140001b00]
mov r9d, esi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rdx, str.c5a1
lea rcx, [rbp + 0x100]
call fcn.1400dcfb0
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rcx, rax
mov rsi, rax
mov qword [rbp - 0x58], rax
call fcn.1400a55b0
mov r15, rax
mov qword [rbp - 0x78], rax
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
movzx r12d, ax
lea rax, str.himalayan
mov ecx, r14d
mov qword [rbp + 0x10], rax
mov eax, dword [rbp + 0x40]
mov word [rsp + 0x60], r12w
imul ecx, r13d
add ecx, 0x18
mov qword [rbp + 8], rdi
imul eax, r13d
sub eax, esi
add r15d, ecx
mov ecx, 0xffff
add eax, 4
mov dword [rsp + 0x64], r15d
mov dword [rbp - 0x48], eax
mov dword [rbp + 0x18], eax
lea rax, str.c1a3
mov qword [rbp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
mov dword [rbp + 0x28], eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea r9, str.scorn
movups xmm0, xmmword [rbp + 8]
movups xmm1, xmmword [rbp + 0x18]
mov qword [rbp + 0x30], rax
lea rax, [rbp + 0xc0]
lea r8, str.c1a3
movaps xmmword [rbp + 0xc0], xmm0
movaps xmmword [rbp + 0xd0], xmm1
movups xmm0, xmmword [rbp + 0x28]
mov qword [rsp + 0x30], rax
lea rax, str.fundraising
lea rcx, [rbp + 0x50]
movaps xmmword [rbp + 0xe0], xmm0
mov qword [rsp + 0x28], rax
movzx edx, r12b
mov dword [rsp + 0x20], r15d
call fcn.1400aa740
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xc0], xmm0
movsd xmm0, qword [rax + 0x20]
movups xmmword [rbp + 0xd0], xmm1
movzx eax, r12b
movsd qword [rbp + 0xe0], xmm0
cmp r15d, eax
jl 0x140033c20
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rax, str.c3a1
mov edx, 0x1c
mov qword [rbp - 0x20], rax
lea rax, str.bench
lea r8d, [rdx - 0x17]
xor ecx, ecx
mov qword [rbp - 0x18], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x314
mov qword [rbp + 0x50], rax
lea rax, str.lion
lea r8d, [rcx + 0x1d]
mov qword [rbp + 0x58], rax
mov dword [rbp + 0x60], 0
call qword [sym.imp.KERNEL32.dll_FindResourceA]
movups xmm0, xmmword [rbp + 0x50]
mov qword [rbp + 0x68], rax
lea rcx, str.payment
mov r9d, 0x10
movaps xmmword [rbp + 0xa0], xmm0
movaps xmm0, xmmword [rbp - 0x20]
movups xmm1, xmmword [rbp + 0x60]
movdqa xmmword [rbp - 0x20], xmm0
movaps xmmword [rbp + 0xb0], xmm1
call fcn.14008eb10
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rbp + 0x150]
mov edx, 0x104
mov r12, rax
mov qword [rbp - 0x68], rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea r9, str.c1a3
mov r8, rdi
mov rcx, r12
mov rdx, rax
mov r15, rax
call fcn.1400945b0
mov rdi, rax
call fcn.140087c50
movzx r12d, sil
neg r12b
mov rcx, rax
mov qword [rbp - 0x50], rax
shl r12b, 2
mov al, 0xb
lea r8d, [r15 + r15]
sub r8d, dword [rbp - 0x68]
imul byte [rbp + 0xd0]
sub r12b, al
mov eax, dword [rsp + 0x64]
sub r12b, byte [rsp + 0x60]
sub r8d, eax
lea r11d, [rax + rax*4]
add r8d, ecx
add r12b, 5
add r8d, esi
add r12b, bl
add r8d, r13d
add r12b, r13b
or rsi, 0xffffffffffffffff
mov rdx, rsi
mov byte [rsp + 0x6c], r12b
mov dword [rbp - 0x70], r8d
inc rdx
cmp byte [rdi + rdx], 0
jne 0x140033cb7
mov r9, qword [rbp - 0x80]
movzx eax, word [rsp + 0x60]
lea ecx, [r13 - 1]
movzx r10d, al
imul ecx, r9d
mov qword [rsp + 0x30], r9
mov eax, r10d
imul eax, dword [rbp - 0x78]
add ecx, eax
mov rax, qword [rbp - 0x50]
lea eax, [rax*4]
sub ecx, r11d
add ecx, 4
add ecx, edx
dec eax
movzx edx, r12b
mov dword [rsp + 0x68], ecx
mov r9d, ecx
lea rcx, str.offence
imul eax, r15d
sub eax, dword [rbp + 0x28]
sub eax, dword [rbp - 0x78]
sub eax, r14d
add eax, 0xfffffffe
add eax, r10d
add eax, r11d
add eax, dword [rbp - 0x68]
add eax, r13d
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x78], eax
lea rax, str.rank
mov qword [rsp + 0x20], rax
call fcn.1400847d0
mov rdx, qword [rbp - 0x80]
imul ecx, dword [rsp + 0x68], 7
imul r8d, dword [rsp + 0x64], 0xb
lea r9d, [rdx*4]
mov r14, rax
mov rax, rsi
mov dword [rbp - 0x60], ecx
mov dword [rbp - 0x40], r8d
mov dword [rbp - 0x44], r9d
inc rax
cmp byte [rdi + rax], 0
jne 0x140033d67
imul ecx, dword [rbp - 0x50]
imul eax, r15d
sub ecx, eax
mov eax, r13d
imul eax, r13d
add ecx, eax
mov rax, rsi
sub ecx, edx
add ecx, r8d
add ecx, r9d
add ecx, dword [rbp - 0x68]
add ecx, dword [rbp - 0x78]
add ecx, dword [rbp - 0x30]
nop word [rax + rax]
inc rax
cmp byte [r14 + rax], 0
jne 0x140033da0
add eax, 0xffffffee
add eax, ecx
mov dword [rsp + 0x70], eax
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
mov r10d, dword [rsp + 0x78]
movzx edx, word [rsp + 0x60]
xor ecx, ecx
mov word [rsp + 0x62], ax
movsxd rax, dword [rsp + 0x64]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
mov eax, dword [rbp - 0x70]
movzx ecx, dl
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], r10d
mov dword [rsp + 0x28], ecx
mov r9d, ecx
lea r8, str.rank
lea rdx, str.c1a3
mov ecx, r10d
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov edx, dword [rsp + 0x70]
lea r9, str.c7a0
mov qword [rsp + 0x28], rax
mov qword [rbp], rax
movzx eax, word [rsp + 0x62]
lea r8, str.baobab
mov ecx, 4
mov byte [rsp + 0x20], al
call fcn.1400d5840
movzx r9d, byte [rsp + 0x62]
mov rcx, rsi
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x70]
lea r10d, [rax*4]
mov dword [rbp - 0x6c], r10d
nop
inc rcx
cmp byte [r14 + rcx], 0
jne 0x140033e60
mov r8, qword [rbp - 0x50]
mov eax, r10d
sub eax, r9d
lea edx, [r8*4]
mov r8, qword [rbp - 0x58]
sub eax, dword [rbp - 0x40]
sub eax, edx
mov rdx, qword [rbp - 0x80]
sub eax, dword [rbp]
sub eax, edx
sub eax, r8d
add eax, dword [rbp + 0xc0]
add eax, dword [rbp - 0x78]
add eax, r13d
sub eax, ecx
mov rcx, rsi
inc rcx
cmp byte [rdi + rcx], 0
jne 0x140033ea2
add eax, 0xfffffff4
mov qword [rbp - 0x18], r15
add eax, ecx
mov rcx, rsi
mov dword [rbp - 0x20], eax
nop word [rax + rax]
inc rcx
cmp byte [rdi + rcx], 0
jne 0x140033ec0
mov eax, dword [rbp + 0xe0]
imul ebx, r13d
imul eax, dword [rbp + 0x28]
sub ebx, eax
lea eax, [r8 + r8*2]
movzx r8d, word [rsp + 0x60]
add eax, eax
sub ebx, eax
movzx eax, r8b
sub ebx, r9d
sub ebx, eax
sub ebx, r10d
add ebx, dword [rbp - 0x60]
add ebx, edx
sub ebx, ecx
sub ebx, 0x37
mov dword [rbp - 0x10], ebx
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [rbp + 0x50], 0
mov qword [rbp - 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
mov edx, 0x118
movzx ecx, ax
lea rax, str.c7ret
mov dword [rbp + 0x58], ecx
xor ecx, ecx
mov qword [rbp + 0x60], rax
lea rax, str.virtue
lea r8d, [rcx + 4]
mov qword [rbp + 0x68], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
lea r8d, [rcx + 0x10]
mov edx, 0xa4
mov qword [rbp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
movsx rbx, r12b
mov rdx, rsi
mov qword [rbp + 0x78], rax
mov qword [rbp - 0x38], rbx
nop dword [rax]
inc rdx
cmp byte [rdi + rdx], 0
jne 0x140033f70
mov r8, qword [rbp - 0x58]
mov eax, dword [rbp + 0x30]
mov r9d, dword [rsp + 0x64]
imul eax, dword [rbp - 0x68]
imul eax, r9d
imul ecx, eax, 0xb
movzx eax, word [rsp + 0x60]
movzx r10d, al
mov eax, r10d
imul eax, r8d
movzx r8d, word [rsp + 0x62]
sub eax, ecx
movzx r11d, r8b
mov r8, qword [rbp - 0x80]
sub eax, r11d
mov rcx, rsi
sub eax, r8d
sub eax, r15d
sub eax, dword [rbp - 0x70]
add eax, ebx
add eax, dword [rsp + 0x70]
add eax, dword [rsp + 0x68]
add eax, r13d
sub eax, edx
nop
inc rcx
cmp byte [r14 + rcx], 0
jne 0x140033fd0
mov ebx, dword [rbp + 0xd8]
sub eax, ecx
movsx rdx, r12b
add eax, 2
lea ecx, [rbx*4]
mov dword [rbp + 0x80], eax
mov eax, r11d
imul eax, dword [rbp]
sub ecx, eax
sub ecx, r10d
sub ecx, edx
xor edx, edx
sub ecx, dword [rsp + 0x74]
sub ecx, dword [rbp - 0x68]
sub ecx, dword [rbp - 0x78]
lea eax, [r8 + rcx]
lea rcx, [rbp + 0x150]
mov r8d, 0x140
add eax, 0xfffffff3
add eax, r9d
add eax, r13d
mov dword [rbp + 0x84], eax
call fcn.1400e27d0
lea rdx, [rbp + 0x150]
lea rcx, str.baobab
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
xor ecx, ecx
mov edx, 0x240
lea r8d, [rcx + 0x13]
mov qword [rbp + 0x88], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
movzx ecx, word [rsp + 0x62]
movaps xmm0, xmmword [rbp + 0x50]
movaps xmm1, xmmword [rbp + 0x60]
imul ebx, r15d
imul ebx, dword [rbp - 0x48]
mov qword [rbp + 0x90], rax
movzx eax, cl
movaps xmmword [rbp + 0x100], xmm0
movaps xmm0, xmmword [rbp + 0x70]
movaps xmmword [rbp + 0x110], xmm1
lea edx, [rax*4]
movsx eax, r12b
mov r12, qword [rbp - 0x80]
imul ecx, ebx, 0xb
imul eax, dword [rsp + 0x68]
dec ecx
mov dword [rbp - 0x60], edx
movaps xmm1, xmmword [rbp + 0x80]
movaps xmmword [rbp + 0x120], xmm0
movsd xmm0, qword [rbp + 0x90]
movsd qword [rbp + 0x140], xmm0
movups xmm0, xmmword [rbp - 0x20]
movaps xmmword [rbp + 0x130], xmm1
imul ecx, dword [rbp - 0x80]
movaps xmmword [rbp + 0xa0], xmm0
movsd xmm1, qword [rbp - 0x10]
add ecx, eax
mov eax, edx
imul eax, dword [rsp + 0x74]
movsd qword [rbp + 0xb0], xmm1
sub ecx, eax
mov eax, dword [rbp - 0x58]
imul eax, r13d
lea eax, [rax + rax*2]
lea ecx, [rcx + rax*8]
imul eax, dword [rbp - 0x50], 7
sub ecx, eax
mov rax, qword [rbp - 0x78]
lea eax, [rax + rax*4]
sub ecx, eax
mov eax, dword [rsp + 0x64]
sub ecx, dword [rsp + 0x78]
add eax, 0xffffffea
add ecx, dword [rsp + 0x70]
add eax, ecx
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x68], eax
lea rax, str.meaning
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
mov rdx, qword [rbp - 0x40]
lea r8, [rbp + 0x100]
lea rcx, [rbp + 0xa0]
xor r9d, r9d
call fcn.1400b2a30
mov ebx, dword [rbp - 0x70]
mov qword [rbp - 0x20], rax
cmp ebx, dword [rsp + 0x78]
jl 0x14003433c
lea rcx, str.c9a4
call fcn.1400d7e70
mov rcx, rsi
nop word [rax + rax]
inc rcx
cmp byte [rdi + rcx], 0
jne 0x140034180
movzx eax, byte [rbp - 0x68]
movzx r8d, word [rsp + 0x60]
imul cl
movzx ecx, al
shl cl, 2
lea edx, [rcx + rax]
movzx eax, r13b
imul byte [rbp - 0x30]
movzx ecx, al
movzx eax, r8b
imul cl
movzx ecx, al
add cl, cl
lea r12d, [rcx + rax]
movzx eax, r15b
add r12b, r12b
imul byte [rbp + 0x88]
sub r12b, dl
mov edx, dword [rsp + 0x68]
sub r12b, byte [rsp + 0x78]
movzx ecx, al
mov al, 7
shl r12b, 2
imul cl
sub r12b, al
mov rax, rsi
sub r12b, 2
add r12b, bl
add r12b, dl
add r12b, byte [rsp + 0x6c]
inc rax
cmp byte [r14 + rax], 0
jne 0x1400341f0
imul ebx, dword [rbp - 0x44]
mov ecx, dword [rbp + 0xe0]
imul ecx, dword [rbp - 0x50]
imul ecx, ecx, 7
sub ecx, eax
mov eax, dword [rbp - 0x58]
shl ecx, 2
imul eax, dword [rbp - 0x78]
sub ecx, eax
movzx eax, r8b
add ebx, ecx
sub ebx, eax
sub ebx, dword [rbp - 0x38]
sub ebx, edx
sub ebx, dword [rsp + 0x74]
sub ebx, dword [rbp - 0x80]
add ebx, dword [rbp - 0x6c]
add ebx, dword [rbp + 0x30]
add ebx, dword [rbp]
add ebx, dword [rsp + 0x64]
add ebx, r13d
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea r9d, [rbx - 0xb]
mov rbx, qword [rbp - 0x20]
mov r8, r13
movzx ecx, r12b
mov rdx, rbx
mov qword [rsp + 0x20], rax
call fcn.140074310
movsxd r9, dword [rsp + 0x64]
lea r8, [0x140001b00]
mov dword [rbp - 0x6c], eax
xor eax, eax
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [rbp + 0xa8], 0
mov qword [rbp + 0xa0], rax
lea rax, str.raise
mov qword [rbp + 0xb0], rax
mov rax, rsi
movups xmm0, xmmword [rbp + 0xa0]
movsd xmm1, qword [rbp + 0xb0]
movsd qword [rbp + 0x60], xmm1
movaps xmmword [rbp + 0x50], xmm0
nop dword [rax]
inc rax
cmp byte [rdi + rax], 0
jne 0x1400342c0
mov rdx, qword [rbp - 0x30]
imul eax, r15d
mov ecx, r15d
imul ecx, dword [rbp - 0x68]
imul edx, r13d
sub edx, ecx
mov ecx, dword [rsp + 0x74]
imul edx, dword [rbp - 0x80]
imul ecx, dword [rsp + 0x70]
shl ecx, 2
sub edx, ecx
imul ecx, dword [rsp + 0x68], 7
sub edx, ecx
imul ecx, dword [rbp - 0x48], 0xb
add eax, edx
movzx edx, word [rsp + 0x60]
add eax, ecx
movsx rcx, r12b
add eax, ecx
movzx ecx, dl
mov rdx, qword [rbp - 0x38]
sub eax, ecx
sub eax, edx
mov rdx, qword [rbp - 0x58]
sub eax, ebx
add edx, 0xfffffff9
sub eax, ebx
sub eax, dword [rbp - 0x44]
sub eax, r13d
add eax, dword [rbp - 0x40]
add eax, dword [rbp - 0x6c]
add edx, eax
call fcn.1400b9210
call fcn.14009da90
mov r12, qword [rbp - 0x80]
lea rcx, str.c1a3
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, qword [rbp - 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rbp - 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
movzx ebx, byte [rsp + 0x62]
lea rcx, str.c7a0
mov word [rsp + 0x6c], ax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.bank
mov r9d, ebx
mov rcx, rax
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
lea rbx, str.c5a3
mov dword [rbp + 8], eax
mov qword [rbp + 0x10], rbx
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [rbp + 0x18], rax
mov rax, rsi
nop dword [rax + rax]
inc rax
cmp byte [r14 + rax], 0
jne 0x1400343b0
movzx edx, word [rsp + 0x60]
mov r9, qword [rbp - 0x20]
mov r8d, dword [rbp + 0xd0]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x30], xmm0
add eax, eax
movzx ecx, dl
mov qword [rbp + 0x28], rbx
imul ecx, ecx, 0xf
sub ecx, eax
lea eax, [r9 - 1]
sub ecx, r15d
add ecx, 3
imul eax, r12d
lea edx, [rax + rcx*2]
mov ecx, dword [rsp + 0x64]
mov eax, r8d
imul eax, ecx
imul eax, eax, 0xb
sub edx, eax
add edx, dword [rbp - 0x60]
add edx, r13d
mov dword [rbp + 0x20], edx
nop dword [rax]
inc rsi
cmp byte [rdi + rsi], 0
jne 0x140034410
imul esi, r15d
imul r15d, r8d
movzx r8d, word [rsp + 0x62]
sub r15d, dword [rbp + 0x40]
movzx eax, r8b
imul eax, dword [rsp + 0x74]
imul r15d, r12d
sub r15d, eax
mov rax, qword [rbp - 0x58]
add esi, r15d
imul eax, ecx
lea eax, [rax + rax*4]
add esi, eax
mov eax, dword [rsp + 0x70]
lea eax, [rax + rax*2]
lea ebx, [rsi + rax*8]
sub ebx, dword [rbp - 0x40]
sub ebx, dword [rsp + 0x68]
add ebx, r9d
add ebx, dword [rsp + 0x78]
add ebx, r13d
call qword [sym.imp.USER32.dll_GetForegroundWindow]
movzx edx, byte [rsp + 0x6c]
movups xmm0, xmmword [rbp + 8]
movups xmm1, xmmword [rbp + 0x18]
mov rcx, qword [rbp - 0x38]
lea r9d, [rbx + 7]
movaps xmmword [rbp + 0xc0], xmm0
movaps xmmword [rbp + 0xd0], xmm1
movups xmm0, xmmword [rbp + 0x28]
movsd xmm1, qword [rbp + 0x38]
movaps xmmword [rbp + 0xe0], xmm0
movsd qword [rbp + 0xf0], xmm1
call fcn.1400be6e0
lea rax, str.c3a2
mov rcx, qword [rbp + 0x3a0]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x4b0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret