Function at 0x140059940
Capabilities:
Copy file
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x250]
sub rsp, 0x350
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x240], rax
mov r15, rcx
lea rcx, str.cytoplasm
call fcn.1400cd2f0
mov rbx, rax
call fcn.1400d5bd0
xor r14d, r14d
mov esi, eax
lea r8, [0x140001b00]
xor edx, edx
mov r9d, eax
xor ecx, ecx
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x70], esi
mov qword [rbp - 0x70], rsi
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r12d, [r15 + 9]
mov edx, r12d
mov rcx, rax
mov rdi, rax
mov qword [rbp - 0x50], rax
call fcn.1400808a0
movsxd r13, eax
cmp r13d, r12d
jg 0x1400599e4
lea edx, [r14 + 8]
mov rcx, rdi
call fcn.1400808a0
movzx eax, r13b
xor edx, edx
mov r8d, 0x140
imul sil
movzx ecx, al
movzx eax, r15b
imul cl
movzx ecx, al
movzx eax, dil
imul cl
lea rcx, [rbp + 0x100]
mov byte [rsp + 0x60], al
call fcn.1400e27d0
lea rdx, [rbp + 0x100]
lea rcx, str.cytoplasm
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
xor ecx, ecx
mov edx, 0x122
lea r8d, [rcx + 0x1b]
mov rdi, rax
mov qword [rbp - 0x68], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea r8, [0x140001b00]
mov r9, r13
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r14
mov qword [rbp + 0x38], rax
mov dword [rbp + 0x40], 2
mov qword [rbp + 0x48], r15
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateThread]
or r14, 0xffffffffffffffff
mov qword [rsp + 0x78], rax
mov rsi, r14
nop word [rax + rax]
inc rsi
cmp byte [rbx + rsi], 0
jne 0x140059a80
movups xmm0, xmmword [rbp + 0x38]
movsd xmm1, qword [rbp + 0x48]
movzx edx, byte [rsp + 0x60]
imul esi, r15d
sub esi, r13d
lea r9, [rbp - 0x30]
sub esi, r12d
lea rcx, [rbp + 0xb0]
mov r8, rdi
movaps xmmword [rbp - 0x30], xmm0
movsd qword [rbp - 0x20], xmm1
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x28], rax
lea rax, str.c0a0
mov qword [rsp + 0x20], rax
call fcn.1400a6ef0
lea rcx, [rbp + 0x100]
mov edx, 0x104
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rbp + 0x60], xmm0
movaps xmmword [rbp + 0x70], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmm1, xmmword [rax + 0x30]
movaps xmmword [rbp + 0x80], xmm0
movaps xmmword [rbp + 0x90], xmm1
movsd xmm0, qword [rax + 0x40]
mov eax, edi
movsd qword [rbp + 0xa0], xmm0
imul eax, r12d
inc eax
imul eax, r15d
sub eax, esi
mov dword [rsp + 0x64], eax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor ecx, ecx
lea r8d, [rcx + 0xc]
mov edx, 0x17f
mov qword [rbp - 0x30], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, r14
mov qword [rbp - 0x28], rax
inc rcx
cmp byte [rbx + rcx], 0
jne 0x140059b44
mov eax, edi
imul ecx, r12d
mov edx, r15d
imul eax, esi
mov qword [rbp - 0x18], r15
mov rdi, r14
imul eax, r13d
sub edx, eax
movsx rax, byte [rsp + 0x60]
sub edx, ecx
add edx, 9
mov dword [rbp - 0x58], edx
mov dword [rbp - 0x20], edx
inc rdi
cmp byte [rbx + rdi], 0
jne 0x140059b77
mov rcx, qword [rbp - 0x50]
mov edx, dword [rsp + 0x70]
imul edi, r15d
lea r8d, [r15 + r15*8]
mov r9d, edx
imul edi, ecx
imul edi, r13d
mov dword [rbp - 0x44], r8d
imul edi, edx
add edi, eax
mov eax, dword [rsp + 0x78]
add edi, dword [rbp - 0x68]
add edi, esi
imul eax, ecx
mov ecx, r8d
lea r8, [0x140001b00]
sub ecx, eax
xor eax, eax
mov dword [rbp - 0x10], edi
sub ecx, edx
mov qword [rsp + 0x28], rax
xor edx, edx
mov dword [rbp - 0x7c], ecx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r8, qword [rbp - 0x68]
xor r9d, r9d
mov qword [rbp], rax
lea rax, [0x1400ee40c]
mov ecx, r15d
mov qword [rbp + 0x10], rax
mov eax, dword [rbp + 0x98]
mov qword [rbp + 8], r9
imul ecx, dword [rbp - 0x50]
imul ecx, r13d
imul ecx, r12d
lea eax, [rax*4]
mov rdx, r14
sub ecx, eax
mov rax, qword [rsp + 0x78]
lea eax, [rax*4]
add ecx, r8d
mov dword [rbp - 0x48], eax
mov dword [rbp + 0x18], ecx
nop dword [rax + rax]
inc rdx
cmp byte [rbx + rdx], r9b
jne 0x140059c30
imul edx, dword [rsp + 0x70]
movsx rcx, byte [rsp + 0x60]
mov qword [rsp + 0x58], r9
mov qword [rsp + 0x50], r9
mov qword [rsp + 0x48], r9
imul eax, esi
sub ecx, eax
lea eax, [r12 + 9]
sub ecx, edx
lea rdx, str.cytoplasm
sub ecx, r8d
mov r8, rbx
add ecx, r15d
add ecx, r13d
add eax, ecx
mov rcx, qword [rbp - 0x70]
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x38], r12d
mov dword [rbp + 0x1c], eax
movsx eax, byte [rsp + 0x60]
mov dword [rsp + 0x30], esi
mov ecx, esi
mov r9d, eax
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], r12d
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov r9d, dword [rbp - 0x7c]
mov ecx, dword [rsp + 0x64]
movups xmm0, xmmword [rbp]
movups xmm1, xmmword [rbp + 0x10]
mov qword [rbp + 0x20], rax
mov eax, r15d
lea r8, str.legal
movaps xmmword [rbp + 0xb0], xmm0
movaps xmmword [rbp + 0xc0], xmm1
movups xmm1, xmmword [rbp - 0x20]
sub eax, dword [rsp + 0x78]
lea rdx, [rbp]
movaps xmmword [rbp + 0x10], xmm1
sub eax, r12d
add eax, dword [rsp + 0x70]
mov dword [rbp + 0x28], eax
lea rax, str.c0ret
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xb0]
movups xmm0, xmmword [rbp + 0x20]
mov qword [rsp + 0x20], rax
movaps xmmword [rbp + 0xd0], xmm0
movups xmm0, xmmword [rbp - 0x30]
movaps xmmword [rbp], xmm0
movsd xmm0, qword [rbp - 0x10]
movsd qword [rbp + 0x20], xmm0
call fcn.1400a2560
mov r8, r14
mov dword [rsp + 0x68], eax
nop dword [rax]
inc r8
cmp byte [rbx + r8], 0
jne 0x140059d30
mov edx, dword [rsp + 0x78]
imul r8d, r12d
lea eax, [r15 + r15*4]
lea rcx, str.legal
imul edx, dword [rsp + 0x64]
sub edx, r8d
mov r8d, esi
add edx, eax
movsx rax, byte [rsp + 0x60]
sub edx, dword [rbp - 0x28]
add eax, 0xfffffff2
add eax, edx
lea rdx, str.c0a0
mov dword [rsp + 0x6c], eax
call qword [sym.imp.KERNEL32.dll_CopyFileA]
mov r9, qword [rsp + 0x78]
mov r8d, dword [rsp + 0x6c]
lea rcx, str.c4a3
lea rdx, str.queen
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rcx
lea rcx, str.c5a2
mov dword [rbp - 0x80], eax
mov dword [rsp + 0x20], eax
call fcn.1400a6890
lea rdx, str.c4a3
mov rcx, r15
mov qword [rbp + 0x50], rax
call fcn.14009f6a0
xor ecx, ecx
mov edx, 0x278
lea r8d, [rcx + 0x13]
mov qword [rbp - 0x60], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
movsx rcx, byte [rsp + 0x60]
movsx edx, byte [rsp + 0x60]
imul ecx, r13d
mov r8, qword [rsp + 0x78]
mov qword [rbp - 0x38], rax
xor eax, eax
mov qword [rbp - 0x30], rax
lea ecx, [rcx + rcx*8]
xor r9d, r9d
lea eax, [rcx*4 + 1]
mov ecx, dword [rsp + 0x6c]
mov qword [rbp - 0x28], r15
imul eax, r15d
imul ecx, dword [rsp + 0x68]
sub eax, ecx
mov ecx, dword [rbp - 0x80]
sub eax, dword [rbp + 0x78]
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], edx
sub eax, ecx
mov rcx, qword [rbp - 0x60]
mov rdx, r8
sub eax, edi
mov edi, dword [rsp + 0x64]
sub eax, edi
mov dword [rsp + 0x20], edi
dec eax
mov dword [rbp - 0x40], eax
mov dword [rbp - 0x20], eax
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
movups xmm0, xmmword [rbp - 0x30]
movsd xmm1, qword [rbp - 0x20]
mov rcx, qword [rbp - 0x38]
lea rdx, [rbp]
mov r8d, eax
movaps xmmword [rbp], xmm0
movsd qword [rbp + 0x10], xmm1
mov dword [rsp + 0x64], eax
call fcn.1400b16d0
mov ecx, dword [rsp + 0x68]
imul ecx, dword [rbp - 0x7c]
mov edx, r15d
lea ecx, [rcx + rcx*2]
mov byte [rsp + 0x61], al
mov eax, dword [rbp + 0x98]
imul edx, edi
sub edx, ecx
mov ecx, dword [rbp - 0x68]
imul eax, esi
add edx, eax
imul ecx, r13d
add edx, ecx
xor ecx, ecx
sub edx, dword [rsp + 0x64]
lea r8d, [rcx + 9]
sub edx, dword [rsp + 0x6c]
add edx, dword [rbp - 0x38]
mov dword [rbp - 0x78], edx
mov edx, 0x372
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, dword [rbp - 0x80]
mov edx, dword [rsp + 0x68]
mov qword [rbp - 0x70], rax
xor eax, eax
lea r8, str.c0a0
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rcx
movsx ecx, byte [rsp + 0x60]
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], ecx
mov r9d, ecx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edx
mov ecx, r13d
mov rdx, rbx
call qword [sym.imp.USER32.dll_CreateWindowExA]
movsx r9, byte [rsp + 0x60]
lea r8, [0x140001b00]
mov qword [rbp], rax
xor eax, eax
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], eax
mov qword [rbp + 8], rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r8, qword [rbp - 0x70]
movaps xmm0, xmmword [rbp]
movdqa xmmword [rbp - 0x30], xmm0
mov rdx, qword [rbp - 0x60]
mov ecx, dword [rbp - 0x78]
lea r9, str.acid
mov qword [rbp + 0x30], rax
mov qword [rsp + 0x28], rax
call fcn.1400a9af0
mov r8, rax
nop dword [rax + rax]
inc r14
cmp byte [rbx + r14], 0
jne 0x140059f60
mov rcx, qword [rbp - 0x38]
imul r15d, dword [rbp + 0x50]
mov eax, 1
imul ecx, dword [rsp + 0x64]
imul ecx, dword [rbp - 0x40]
sub eax, ecx
mov rcx, qword [rbp + 0x30]
imul eax, dword [rbp - 0x60]
imul ecx, dword [rbp]
add ecx, dword [rbp - 0x80]
lea ecx, [rax + rcx*4]
mov eax, dword [rbp + 0x60]
imul eax, edi
imul eax, esi
add ecx, eax
movsx eax, byte [rsp + 0x60]
add ecx, r15d
imul eax, dword [rbp - 0x68]
add ecx, eax
imul eax, dword [rbp - 0x7c], 0xf
add ecx, eax
movsx rax, byte [rsp + 0x61]
sub ecx, eax
mov rax, qword [rsp + 0x78]
sub ecx, dword [rbp - 0x48]
add eax, 0xfffffff1
sub ecx, dword [rbp - 0x70]
sub ecx, dword [rbp + 0x38]
sub ecx, dword [rsp + 0x68]
sub ecx, dword [rbp - 0x50]
sub ecx, dword [rbp - 0x58]
sub ecx, r13d
sub ecx, r12d
sub ecx, dword [rsp + 0x70]
add ecx, dword [rbp - 0x44]
add ecx, r8d
add ecx, dword [rbp - 0x78]
add ecx, dword [rsp + 0x6c]
add eax, ecx
add eax, r14d
mov rcx, qword [rbp + 0x240]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x350]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret