Function at 0x1400aa2f0
Capabilities:
Create thread

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x248
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rax, qword [rsp + 0x2b0]
mov r15, qword [rsp + 0x2c0]
mov r14, qword [rsp + 0x2b8]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x80], r15
mov edi, r9d
mov dword [rsp + 0x64], r9d
mov rbx, r8
mov dword [rsp + 0x60], edx
movzx r13d, cl
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rbp, rax
mov qword [rsp + 0x68], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0xb0], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
lea r8d, [rcx + 0xf]
mov edx, 0x1a7
call qword [sym.imp.KERNEL32.dll_FindResourceA]
or rsi, 0xffffffffffffffff
mov eax, r13d
mov rcx, rsi
inc rcx
cmp byte [rbx + rcx], 0
jne 0x1400aa391
sub edi, r15d
mov edx, 0x31
add edi, eax
lea r8d, [rdx - 0x29]
sub edi, ecx
xor ecx, ecx
mov dword [rsp + 0xc8], edi
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x120]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov r12, rax
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, r12d
xor edx, edx
mov r15d, eax
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rdx
imul ecx, eax
mov eax, dword [rsp + 0x60]
mov r12d, 6
lea r8, str.objective
sub r12d, ecx
mov qword [rsp + 0x40], rax
lea rdx, str.objective
add r12d, r12d
sub r12d, ebp
movzx ebp, r13b
add r12d, edi
mov ecx, ebp
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], eax
mov r9d, r12d
mov dword [rsp + 0x20], ebp
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov ecx, ebp
mov eax, r15d
imul eax, edi
lea eax, [rax + rax*2]
sub ecx, eax
mov eax, dword [rsp + 0x64]
sub ecx, eax
add ecx, 2
mov dword [rsp + 0x100], ecx
mov rcx, rsi
nop
inc rcx
cmp byte [r14 + rcx], 0
jne 0x1400aa460
mov rdx, qword [rsp + 0x80]
mov r9d, dword [rsp + 0x60]
imul cl
movzx ecx, al
movzx eax, dl
imul cl
mov rcx, rsi
movzx ebp, al
sub bpl, r9b
add bpl, r15b
add bpl, r12b
add bpl, r13b
add bpl, byte [rsp + 0xb0]
nop dword [rax + rax]
inc rcx
cmp byte [rbx + rcx], 0
jne 0x1400aa4a0
sub bpl, cl
mov r8, rsi
sub bpl, 6
inc r8
cmp byte [rbx + r8], 0
jne 0x1400aa4b3
mov rdi, qword [rsp + 0x68]
movzx eax, dil
imul dl
movzx ecx, al
shl cl, 3
lea edx, [rcx + rax]
mov al, 0xfe
mov rcx, rsi
imul byte [rsp + 0x78]
sub al, dl
sub al, r12b
add al, r9b
add al, r13b
sub al, r8b
nop dword [rax + rax]
inc rcx
cmp byte [r14 + rcx], 0
jne 0x1400aa4f0
sub al, cl
cmp r13b, al
je 0x1400aa5ee
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
mov rcx, rsi
inc rcx
cmp byte [rbx + rcx], 0
jne 0x1400aa513
mov r9d, dword [rsp + 0x64]
mov r8, qword [rsp + 0x80]
movzx eax, r9b
imul cl
movzx ecx, al
movzx eax, r8b
imul cl
movzx edx, al
movzx eax, dil
imul dil
movzx ecx, al
movzx eax, bpl
imul cl
movzx r15d, al
sub r15b, dl
mov rdx, rsi
sub r15b, 5
add r15b, r13b
add r15b, byte [rsp + 0x78]
inc rdx
cmp byte [rbx + rdx], 0
jne 0x1400aa561
imul edx, dword [rsp + 0x60]
movzx eax, bpl
mov ecx, 2
imul eax, edi
imul edx, r9d
lea eax, [rax + rax*2]
sub ecx, eax
imul ecx, edi
movzx edi, r13b
add edi, 3
sub ecx, edx
mov edx, 0x2b
sub ecx, r8d
lea r8d, [rdx - 0x1a]
sub ecx, r12d
mov r12, qword [rsp + 0x70]
add ecx, r12d
add edi, ecx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rcx, rbx
movsxd rdi, edi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r9, rdi
mov r8, rdi
mov rdx, r14
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
movsx r8, r15b
mov rdx, rbx
mov r9, r8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
mov rdi, qword [rsp + 0x68]
jmp 0x1400aa5f3
mov r12, qword [rsp + 0x70]
xor ecx, ecx
mov edx, 0x297
lea r8d, [rcx + 6]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r8, rax
inc rsi
cmp byte [rbx + rsi], 0
jne 0x1400aa607
movzx eax, byte [rsp + 0xc8]
imul sil
movzx ecx, al
shl cl, 3
lea edx, [rcx + rax]
movzx eax, dil
lea ecx, [rbp + 7]
xor edi, edi
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
imul cl
sub dl, al
xor ecx, ecx
sub dl, byte [rsp + 0x100]
add dl, r13b
movzx eax, dl
xor edx, edx
sub r8d, eax
sub r8d, 0x3e
movsxd r9, r8d
lea r8, [0x140001b00]
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov ecx, dword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, str.mention
movzx ebx, bpl
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea r8d, [rdi + 0x40]
lea rdx, str.turkish
mov r9d, ebx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rdx, r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
movsxd rcx, dword [rsp + 0x64]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x30], ecx
lea r9d, [rdi + 0x10]
lea rdx, str.mention
mov r8, r14
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea ecx, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea edx, [rdi + 0x5a]
lea r8d, [rdi + 0x1c]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x248
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret