Function at 0x140035880
Capabilities:
Copy file
Create thread

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x218]
sub rsp, 0x318
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x200], rax
mov rax, qword [rbp + 0x280]
mov ebx, dword [rbp + 0x288]
mov r13, r9
mov r12, r8
mov r15, rdx
mov rsi, rcx
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x6c], ebx
call fcn.140079de0
mov byte [rsp + 0x60], al
cmp al, bl
jbe 0x140035928
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
mov edx, 0x188
lea r8d, [rcx + 0xa]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rbp + 0xc0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov edx, 0x8c
lea r8d, [rdx - 0x7c]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
or r14, 0xffffffffffffffff
mov dword [rsp + 0x68], eax
mov rbx, r14
nop dword [rax]
inc rbx
cmp byte [r15 + rbx], 0
jne 0x140035940
mov rax, r14
nop dword [rax]
inc rax
cmp byte [rsi + rax], 0
jne 0x140035950
add ebx, eax
mov rdi, r14
mov dword [rbp - 0x58], ebx
inc rdi
cmp byte [r15 + rdi], 0
jne 0x140035961
mov rax, r14
nop
inc rax
cmp byte [rsi + rax], 0
jne 0x140035970
imul edi, eax
lea rcx, [rbp + 0xc0]
xor edx, edx
mov r8d, 0x140
mov qword [rbp + 0xb8], rdi
mov dword [rbp - 0x54], edi
call fcn.1400e27d0
lea rdx, [rbp + 0xc0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rbp - 0x50], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [rbp - 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
movzx edx, byte [rsp + 0x68]
movups xmm0, xmmword [rbp - 0x58]
mov dword [rbp - 0x40], eax
lea r8, [rbp + 0x80]
lea rcx, str.observatory
movaps xmmword [rbp + 0x80], xmm0
movups xmm1, xmmword [rbp - 0x48]
movaps xmmword [rbp + 0x90], xmm1
call fcn.14008d4c0
movzx r10d, byte [rsp + 0x60]
movsxd rdx, dword [rsp + 0x68]
mov dword [rsp + 0x64], eax
cmp r10b, dl
ja 0x140035e80
imul ecx, eax, 0xb
mov rdi, r14
mov dword [rsp + 0x70], ecx
inc rdi
cmp byte [r12 + rdi], 0
jne 0x140035a11
mov rax, r14
nop
inc rax
cmp byte [rsi + rax], 0
jne 0x140035a20
mov r9d, dword [rsp + 0x6c]
imul edi, eax
movzx eax, r10b
add edi, ecx
movsx r8, dl
add edi, r9d
imul ecx, eax, 0xb
mov rax, r14
mov dword [rbp - 0x80], ecx
nop word [rax + rax]
inc rax
cmp byte [r13 + rax], 0
jne 0x140035a50
mov r11, qword [rsp + 0x78]
imul eax, r11d
sub eax, ecx
mov rcx, r14
nop dword [rax]
inc rcx
cmp byte [r12 + rcx], 0
jne 0x140035a70
lea edx, [r9 + rax]
mov rax, r14
inc rax
cmp byte [r15 + rax], 0
jne 0x140035a81
add ecx, edx
mov rdx, r14
inc rdx
cmp byte [rsi + rdx], 0
jne 0x140035a90
add ecx, eax
add edx, ecx
mov rcx, r14
add edx, r8d
add edx, ebx
mov qword [rbp - 0x70], rdx
nop dword [rax]
inc rcx
cmp byte [r13 + rcx], 0
jne 0x140035ab0
mov rax, r14
nop
inc rax
cmp byte [rsi + rax], 0
jne 0x140035ac0
imul cl
movzx ecx, al
movzx eax, r11b
imul cl
movzx ecx, al
movzx eax, r10b
imul r9b
sub cl, al
sub cl, byte [rsp + 0x68]
mov byte [rsp + 0x61], cl
mov ecx, r9d
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, qword [rbp - 0x70]
lea rdx, [0x1400ed878]
lea rcx, str.bank
mov r9d, ebx
mov r8d, edi
mov qword [rbp - 0x68], rax
mov qword [rsp + 0x30], rax
call fcn.14007dc80
mov r8d, ebx
mov rcx, r14
mov rdx, rax
mov qword [rbp + 0x20], rax
imul r8d, edi
mov dword [rbp - 0x60], r8d
nop dword [rax]
inc rcx
cmp byte [r15 + rcx], 0
jne 0x140035b30
mov rax, r14
nop dword [rax]
inc rax
cmp byte [rsi + rax], 0
jne 0x140035b40
imul ecx, eax
mov eax, edx
movzx edx, byte [rsp + 0x60]
imul eax, dword [rbp - 0x68]
sub ecx, eax
sub ecx, r8d
sub ecx, edx
movsxd rdx, dword [rsp + 0x68]
movsx rax, dl
add ecx, eax
mov rax, r14
add ecx, dword [rbp - 0x48]
nop
inc rax
cmp byte [r12 + rax], 0
jne 0x140035b70
add eax, 0xfffffff5
add eax, ecx
mov dword [rbp - 0x78], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edx, dword [rbp - 0x78]
mov r8, rax
xor ecx, ecx
mov qword [rbp + 0xb0], rax
call fcn.14008f2d0
movsx r8, byte [rsp + 0x61]
mov rcx, r14
mov rdx, rax
nop dword [rax + rax]
inc rcx
cmp byte [r15 + rcx], 0
jne 0x140035bb0
mov rax, r14
nop dword [rax]
inc rax
cmp byte [rsi + rax], 0
jne 0x140035bc0
imul ecx, eax
mov eax, dword [rbp + 0x20]
imul eax, dword [rbp - 0x78]
add ecx, eax
mov rax, qword [rsp + 0x78]
sub ecx, r8d
add eax, 0xfffffffd
sub ecx, edi
add ecx, dword [rsp + 0x70]
add eax, ecx
mov dword [rsp + 0x70], eax
mov rax, qword [rbp - 0x68]
mov qword [rbp + 0x30], rax
mov rax, r14
nop word [rax + rax]
inc rax
cmp byte [r13 + rax], 0
jne 0x140035c00
imul eax, dword [rsp + 0x6c]
mov ecx, dword [rbp - 0x48]
movsxd r8, dword [rsp + 0x68]
lea ecx, [rax + rcx*4]
movsx rax, r8b
sub ecx, ebx
add ecx, eax
mov rax, r14
add ecx, edi
nop dword [rax + rax]
inc rax
cmp byte [r15 + rax], 0
jne 0x140035c30
sub ecx, eax
mov rax, r14
nop
inc rax
cmp byte [r12 + rax], 0
jne 0x140035c40
sub ecx, eax
mov rax, r14
nop
inc rax
cmp byte [rsi + rax], 0
jne 0x140035c50
add ecx, eax
mov rax, r14
nop
inc rax
cmp byte [rdx + rax], 0
jne 0x140035c60
xor edi, edi
add eax, 7
lea r8, [0x140001b00]
add eax, ecx
mov r9d, ebx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
mov dword [rbp + 0x38], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, r14
mov qword [rbp + 0x40], rax
nop word [rax + rax]
inc rcx
cmp byte [r13 + rcx], dil
jne 0x140035ca0
mov rax, r14
nop dword [rax]
inc rax
cmp byte [r12 + rax], dil
jne 0x140035cb0
movzx edx, byte [rsp + 0x60]
imul ecx, eax
mov rax, r14
imul ecx, edx
inc rax
cmp byte [r15 + rax], dil
jne 0x140035cc7
mov rdx, r14
inc rdx
cmp byte [rsi + rdx], dil
jne 0x140035cd3
mov r8, qword [rsp + 0x78]
imul eax, edx
mov edx, dword [rbp - 0x78]
add ecx, eax
mov qword [rbp + 0x58], r8
imul eax, dword [rbp - 0x40], 0x21
add ecx, eax
mov eax, dword [rbp - 0x60]
sub ecx, dword [rbp + 0x20]
add eax, 4
sub ecx, edx
add eax, ecx
mov dword [rbp + 0x48], eax
lea rax, [0x1400ed4d4]
mov qword [rbp + 0x50], rax
lea rax, str.minion
mov qword [rbp + 0x60], rax
mov rax, r14
nop dword [rax]
inc rax
cmp byte [r15 + rax], dil
jne 0x140035d20
mov rcx, r14
nop dword [rax]
inc rcx
cmp byte [rsi + rcx], dil
jne 0x140035d30
mov r10, qword [rbp + 0xb0]
imul eax, ecx
mov ecx, dword [rbp - 0x80]
imul ecx, r8d
movsx r8, byte [rsp + 0x61]
imul ecx, dword [rsp + 0x6c]
sub eax, ecx
mov rcx, r14
sub eax, dword [rbp - 0x68]
add eax, r8d
add eax, r10d
add eax, edx
add eax, ebx
inc rcx
cmp byte [r12 + rcx], dil
jne 0x140035d67
movaps xmm0, xmmword [rbp + 0x30]
movaps xmm1, xmmword [rbp + 0x40]
mov r9d, dword [rsp + 0x70]
sub eax, ecx
mov qword [rbp + 0x70], rdi
lea rdx, [0x1400ed4fc]
mov dword [rbp + 0x68], eax
movaps xmmword [rbp - 0x30], xmm0
movaps xmm0, xmmword [rbp + 0x50]
lea rax, [rbp - 0x30]
mov rcx, r10
movaps xmmword [rbp - 0x20], xmm1
movaps xmm1, xmmword [rbp + 0x60]
movaps xmmword [rbp - 0x10], xmm0
mov qword [rsp + 0x28], rax
lea rax, str.c3a1
movsd xmm0, qword [rbp + 0x70]
movsd qword [rbp + 0x10], xmm0
mov qword [rsp + 0x20], rax
movaps xmmword [rbp], xmm1
call fcn.1400a8810
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rbp + 0xc0]
xor edx, edx
mov r8d, 0x140
mov rdi, rax
call fcn.1400e27d0
lea rdx, [rbp + 0xc0]
lea rcx, str.bank
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
movsx ecx, byte [rsp + 0x61]
movzx r9d, byte [rsp + 0x60]
xor edx, edx
mov rbx, rax
mov eax, dword [rsp + 0x64]
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rdx
mov edx, dword [rsp + 0x6c]
mov qword [rsp + 0x40], rax
mov rax, qword [rbp - 0x70]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], edx
mov edx, dword [rsp + 0x70]
mov dword [rsp + 0x28], edx
lea rdx, str.view
lea r8, str.bank
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov r8, qword [rbp - 0x68]
mov qword [rsp + 0x30], rax
lea r9, str.c3a4
lea rcx, str.ocelot
mov rdx, rdi
mov qword [rsp + 0x28], rbx
call fcn.1400cc920
mov rdi, qword [rbp + 0xb8]
mov rcx, qword [rsp + 0x78]
call fcn.1400d7960
mov rbx, rax
mov qword [rbp - 0x80], rax
movsx eax, byte [rsp + 0x68]
cmp dword [rsp + 0x64], eax
je 0x140036007
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, 9
lea r8d, [rdx - 8]
xor ecx, ecx
mov dword [rbp - 0x30], eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, r14
mov qword [rbp - 0x28], rax
nop word [rax + rax]
inc rcx
cmp byte [r13 + rcx], 0
jne 0x140035ed0
mov rax, r14
nop
inc rax
cmp byte [r12 + rax], 0
jne 0x140035ee0
imul ecx, eax
mov rax, r14
inc rax
cmp byte [r15 + rax], 0
jne 0x140035ef0
imul ecx, eax
mov rax, r14
inc rax
cmp byte [rsi + rax], 0
jne 0x140035f00
movzx r8d, byte [rsp + 0x60]
imul ecx, eax
mov eax, ebx
imul ecx, dword [rsp + 0x6c]
imul eax, dword [rsp + 0x64]
mov rdx, r13
add ecx, eax
lea rax, [0x1400ed4fc]
mov dword [rbp - 0x20], ecx
mov rcx, r13
mov qword [rbp - 0x18], rax
call qword [sym.imp.KERNEL32.dll_CopyFileA]
xor ecx, ecx
mov edx, 0x192
lea r8d, [rcx + 0x16]
mov dword [rbp - 0x10], eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rbp - 8], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rcx, r14
mov qword [rbp], rax
nop
inc rcx
cmp byte [r13 + rcx], 0
jne 0x140035f60
mov rax, r14
nop
inc rax
cmp byte [r12 + rax], 0
jne 0x140035f70
imul cl
movzx ecx, al
mov al, 0xb
imul byte [rbp - 0x40]
movzx ebx, al
mov rax, r14
sub bl, cl
nop dword [rax]
inc rax
cmp byte [r15 + rax], 0
jne 0x140035f90
add bl, al
mov rax, r14
nop
inc rax
cmp byte [rsi + rax], 0
jne 0x140035fa0
movzx r9d, byte [rsp + 0x60]
add bl, al
mov rax, qword [rbp - 0x80]
add bl, al
xor eax, eax
lea r8, [0x140001b00]
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov byte [rsp + 0x28], bl
movups xmm0, xmmword [rbp - 0x30]
movups xmm1, xmmword [rbp - 0x20]
movaps xmmword [rbp + 0x30], xmm0
movaps xmmword [rbp + 0x40], xmm1
movups xmm0, xmmword [rbp - 0x10]
movsd xmm1, qword [rbp]
movaps xmmword [rbp + 0x50], xmm0
movsd qword [rbp + 0x60], xmm1
call fcn.1400af560
call fcn.1400c47e0
mov rbx, qword [rbp - 0x80]
mov ecx, dword [rsp + 0x64]
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x80], rax
mov rax, r14
nop word [rax + rax]
inc rax
cmp byte [r13 + rax], 0
jne 0x140036030
mov ecx, dword [rsp + 0x64]
add ecx, ebx
add ecx, edi
sub ecx, eax
mov rax, r14
nop dword [rax + rax]
inc rax
cmp byte [rsi + rax], 0
jne 0x140036050
add eax, 0xfffffff5
mov edx, 0xd4
add eax, ecx
xor ecx, ecx
lea r8d, [rcx + 0x15]
mov dword [rbp + 0x90], eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x232
lea r8d, [rcx + 8]
mov qword [rbp + 0x98], rax
mov qword [rbp + 0xa0], rbx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r9d, dword [rsp + 0x64]
lea r8, [0x140001b00]
mov qword [rbp + 0xa8], rax
xor eax, eax
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
movzx edx, byte [rsp + 0x60]
movsx r8, byte [rsp + 0x68]
mov rbx, rax
mov rax, r14
nop dword [rax]
inc rax
cmp byte [r13 + rax], 0
jne 0x1400360d0
mov rcx, r14
nop
inc rcx
cmp byte [r12 + rcx], 0
jne 0x1400360e0
imul eax, ecx
mov edi, edx
sub edi, eax
mov rax, r14
sub edi, dword [rsp + 0x78]
sub edi, r8d
add edi, dword [rbp - 0x48]
add edi, dword [rsp + 0x64]
inc rax
cmp byte [r15 + rax], 0
jne 0x140036102
sub edi, eax
mov rax, r14
inc rax
cmp byte [rsi + rax], 0
jne 0x140036111
movups xmm0, xmmword [rbp + 0x80]
movups xmm1, xmmword [rbp + 0x90]
add edi, eax
mov rax, qword [rbp - 0x80]
lea r8, [rbp - 0x30]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor edx, edx
xor ecx, ecx
movaps xmmword [rbp - 0x30], xmm0
movaps xmmword [rbp - 0x20], xmm1
movups xmm0, xmmword [rbp + 0xa0]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
movaps xmmword [rbp - 0x10], xmm0
call fcn.1400d9010
movzx r10d, byte [rsp + 0x60]
mov r9, rax
mov qword [rbp - 0x70], rax
cmp r10b, dil
ja 0x140036330
mov rcx, r14
nop dword [rax + rax]
inc rcx
cmp byte [r13 + rcx], 0
jne 0x140036180
movzx eax, byte [rsp + 0x78]
imul cl
movzx ecx, al
movzx eax, byte [rsp + 0x6c]
imul cl
movzx ecx, byte [rsp + 0x64]
movzx edx, al
movzx eax, byte [rbp - 0x80]
add cl, bl
imul cl
movzx ecx, al
mov rax, r14
sub cl, dl
sub cl, byte [rbp - 0x48]
nop word [rax + rax]
inc rax
cmp byte [r12 + rax], 0
jne 0x1400361c0
sub cl, al
mov rax, r14
nop
inc rax
cmp byte [r15 + rax], 0
jne 0x1400361d0
add cl, al
mov rax, r14
nop
inc rax
cmp byte [rsi + rax], 0
jne 0x1400361e0
add cl, 0xb
add cl, al
mov byte [rsp + 0x61], cl
movzx ecx, r10b
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rbp - 0x30], rax
mov rax, r14
inc rax
cmp byte [r13 + rax], 0
jne 0x140036203
imul eax, dword [rbp - 0x50]
mov rcx, r14
inc rcx
cmp byte [r15 + rcx], 0
jne 0x140036215
sub eax, ecx
mov rcx, r14
inc rcx
cmp byte [r12 + rcx], 0
jne 0x140036224
sub eax, ecx
mov rcx, r14
inc rcx
cmp byte [rsi + rcx], 0
jne 0x140036233
add eax, ecx
mov dword [rbp - 0x28], eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x70]
lea r8d, [rcx + 2]
mov qword [rbp - 0x18], rax
lea rax, str.legal
mov edx, 0xc7
mov qword [rbp - 0x10], rax
lea rax, [0x1400ed3f4]
mov qword [rbp - 8], rax
lea rax, [0x1400ed4d4]
mov qword [rbp], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
movsxd rcx, dword [rsp + 0x68]
mov r9d, dword [rsp + 0x6c]
mov rbx, rax
xor eax, eax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
movsx rax, cl
mov r8, r15
mov rdx, r13
mov qword [rsp + 0x40], rax
movsx eax, cl
mov ecx, edi
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], edi
call qword [sym.imp.USER32.dll_CreateWindowExA]
movups xmm0, xmmword [rbp - 0x30]
movups xmm1, xmmword [rbp - 0x20]
movzx ecx, byte [rsp + 0x61]
lea rax, str.garter
lea r9, [0x1400ed3f4]
movaps xmmword [rbp + 0x30], xmm0
movaps xmmword [rbp + 0x40], xmm1
movups xmm0, xmmword [rbp - 0x10]
movsd xmm1, qword [rbp]
mov qword [rsp + 0x30], rax
lea r8, [rbp + 0x30]
mov edx, 1
movaps xmmword [rbp + 0x50], xmm0
movsd qword [rbp + 0x60], xmm1
mov qword [rsp + 0x20], rbx
call fcn.14007c8b0
mov rcx, rax
call fcn.140095a70
mov r9, qword [rbp - 0x70]
movzx r10d, byte [rsp + 0x60]
mov rcx, r14
inc rcx
cmp byte [r15 + rcx], 0
jne 0x140036333
mov rax, r14
inc rax
cmp byte [rsi + rax], 0
jne 0x140036340
imul cl
mov rcx, r14
movzx r8d, al
inc rcx
cmp byte [r13 + rcx], 0
jne 0x140036352
movzx eax, byte [rsp + 0x6c]
imul cl
lea ecx, [rax - 1]
movzx eax, byte [rsp + 0x78]
imul cl
movzx edx, al
movzx eax, byte [rsp + 0x68]
imul byte [rbp - 0x50]
movzx ecx, al
movzx eax, r10b
imul cl
movzx ecx, al
mov al, 0xb
imul cl
add dl, al
mov rax, qword [rbp - 0x80]
add al, al
sub dl, al
add r8b, dl
sub r8b, byte [rsp + 0x64]
sub r8b, dil
add r8b, r9b
add r8b, byte [rbp + 0xa8]
nop dword [rax + rax]
inc r14
cmp byte [r12 + r14], 0
jne 0x1400363b0
sub r8b, r14b
movzx eax, r8b
mov rcx, qword [rbp + 0x200]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x318
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret