Function at 0x140077850
Capabilities:
Copy file
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x10], edx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x130
xor eax, eax
mov r14, r8
mov r15d, r9d
mov esi, edx
mov rbx, rcx
mov r9d, edx
mov qword [rsp + 0x28], rax
lea r8, [0x140001b00]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
or rdi, 0xffffffffffffffff
mov r12, rax
mov qword [rsp + 0x68], rax
mov rbp, rdi
nop dword [rax]
inc rbp
cmp byte [rbx + rbp], 0
jne 0x1400778b0
add ebp, esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
mov rdx, rdi
movzx r13d, al
mov dword [rsp + 0x3c], eax
mov dword [rsp + 0x70], r13d
inc rdx
cmp byte [rbx + rdx], 0
jne 0x1400778d1
imul edx, esi
mov ecx, r13d
imul ecx, ebp
lea eax, [r15 + rdx]
add ecx, 0xfffffff9
add eax, ecx
mov dword [rsp + 0x40], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x1400ed4d4]
lea rcx, str.shampoo
mov r8d, ebp
mov dword [rsp + 0x38], eax
call qword [sym.imp.KERNEL32.dll_CopyFileA]
mov rcx, rdi
mov r9d, eax
mov dword [rsp + 0x48], eax
nop dword [rax + rax]
inc rcx
cmp byte [r14 + rcx], 0
jne 0x140077920
mov edx, r13d
mov rax, rdi
sub edx, r12d
sub edx, ecx
inc rax
cmp byte [rbx + rax], 0
jne 0x140077935
add edx, 9
mov rcx, rdi
add edx, eax
mov dword [rsp + 0x34], edx
nop word [rax + rax]
inc rcx
cmp byte [r14 + rcx], 0
jne 0x140077950
mov r8d, dword [rsp + 0x3c]
movzx eax, sil
movzx r13d, r15b
imul cl
sub r13b, al
mov rax, rdi
sub r13b, r8b
inc rax
cmp byte [rbx + rax], 0
jne 0x140077972
add r13b, al
mov rsi, rdi
add r13b, r12b
movsx rcx, r13b
mov byte [rsp + 0x30], r13b
mov qword [rsp + 0x80], rcx
inc rsi
cmp byte [r14 + rsi], 0
jne 0x140077995
imul esi, dword [rsp + 0x178]
imul eax, r9d, 7
add esi, eax
mov rax, rdi
sub esi, ecx
sub esi, r12d
inc rax
cmp byte [rbx + rax], 0
jne 0x1400779b5
add esi, eax
mov r12, rdi
inc r12
cmp byte [rbx + r12], 0
jne 0x1400779c3
mov al, 7
movzx ecx, r15b
imul dl
mov edx, esi
sub cl, al
sub cl, r8b
lea r8, str.debtor
add r12b, cl
lea rcx, [rsp + 0xe0]
mov byte [rsp + 0x20], r12b
call fcn.1400db3c0
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0xa0], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmm1, xmmword [rax + 0x30]
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0xc0], xmm1
movsd xmm0, qword [rax + 0x40]
movsd qword [rsp + 0xd0], xmm0
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rdx, str.breakpoint
lea rcx, [0x1400ed4d4]
mov r8d, esi
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_CopyFileA]
mov dword [rsp + 0x4c], eax
movzx eax, al
cmp esi, eax
jb 0x140077b79
mov rcx, rdi
nop dword [rax]
inc rcx
cmp byte [rbx + rcx], 0
jne 0x140077a70
movzx eax, bpl
mov edx, 0x11d
imul cl
movzx ecx, al
movzx eax, r15b
imul cl
movzx ecx, al
movzx eax, byte [rsp + 0x3c]
imul byte [rsp + 0x40]
sub cl, al
add cl, byte [rsp + 0x60]
mov byte [rsp + 0x31], cl
xor ecx, ecx
lea r8d, [rcx + 8]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r15, rdi
mov rcx, rax
inc r15
cmp byte [rbx + r15], 0
jne 0x140077ab5
sub cl, byte [rsp + 0x60]
sub cl, 3
movzx eax, cl
add al, al
add cl, al
movzx eax, r13b
mov r13, qword [rsp + 0x68]
add cl, cl
imul byte [rsp + 0x38]
sub cl, al
movzx eax, r13b
imul byte [rsp + 0x178]
sub cl, al
mov al, 0xe
imul byte [rsp + 0x3c]
sub cl, al
sub cl, byte [rsp + 0x31]
add r15b, cl
add r15b, byte [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
movsx r9, r15b
xor r15d, r15d
lea r8, [0x140001b00]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateThread]
movsxd r9, dword [rsp + 0x38]
lea r8, [0x140001b00]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r8d, [r15 + 0x10]
mov edx, 0x1bd
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea r8d, [r15 + 8]
mov edx, 0x3d6
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x140077b7e
mov r13, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
mov r11, qword [rsp + 0x60]
movzx r8d, r12b
movzx eax, ax
mov dword [rsp + 0x78], r8d
mov rcx, rdi
imul edx, r11d, 7
mov dword [rsp + 0x44], eax
mov rax, qword [rsp + 0xa8]
mov dword [rsp + 0x54], edx
nop dword [rax]
inc rcx
cmp byte [rax + rcx], 0
jne 0x140077bb0
mov eax, dword [rsp + 0x70]
mov r9d, dword [rsp + 0x40]
imul ecx, r8d
mov r15d, 3
imul eax, ebp
sub r15d, eax
mov eax, dword [rsp + 0x34]
add r15d, r15d
imul eax, dword [rsp + 0x48]
sub r15d, eax
imul eax, r9d, 7
sub r15d, ecx
sub r15d, eax
mov rax, rdi
nop
inc rax
cmp byte [rbx + rax], 0
jne 0x140077bf0
mov r10d, dword [rsp + 0x188]
imul eax, r10d
add r15d, eax
sub r15d, esi
add r15d, edx
mov rdx, rdi
inc rdx
cmp byte [rbx + rdx], 0
jne 0x140077c11
add edx, 0x19
mov eax, r8d
imul eax, esi
lea ecx, [rax + rax*2]
mov eax, ebp
add ecx, ecx
sub eax, ecx
sub eax, dword [rsp + 0xb0]
sub eax, r11d
sub eax, r9d
mov r9d, r11d
add eax, edx
mov rdx, rdi
mov dword [rsp + 0x74], eax
imul r9d, dword [rsp + 0x44]
mov dword [rsp + 0x50], r9d
inc rdx
cmp byte [rbx + rdx], 0
jne 0x140077c50
mov eax, dword [rsp + 0x38]
imul ecx, r13d, 0xfffffffe
mov r13d, dword [rsp + 0x48]
lea eax, [rax + rax*4]
add r13d, 0x17
add eax, eax
sub ecx, eax
sub ecx, r9d
sub ecx, r15d
sub ecx, r10d
lea eax, [r8 + rcx]
xor ecx, ecx
add edx, eax
mov eax, r11d
add edx, dword [rsp + 0xb8]
add edx, dword [rsp + 0x34]
imul eax, dword [rsp + 0x68]
add r13d, edx
mov edx, 0x32
add eax, r13d
lea r8d, [rdx - 0x1c]
mov dword [rsp + 0x58], r13d
mov dword [rsp + 0x7c], eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdx, rdi
mov r9, rax
mov qword [rsp + 0x88], rax
inc rdx
cmp byte [r14 + rdx], 0
jne 0x140077cc1
mov r10, qword [rsp + 0x68]
mov r11, qword [rsp + 0x80]
imul eax, r13d
mov ecx, 0x13
sub ecx, eax
mov eax, ebp
sub eax, dword [rsp + 0x74]
imul eax, r10d
lea r13d, [rax + rcx*2]
mov eax, dword [rsp + 0x78]
mov ecx, dword [rsp + 0x188]
imul eax, dword [rsp + 0x60]
add r13d, eax
mov rax, rdi
sub r13d, r15d
sub r13d, dword [rsp + 0x54]
add r13d, r11d
add r13d, dword [rsp + 0x44]
add r13d, dword [rsp + 0x40]
add r13d, ecx
sub r13d, edx
inc rax
cmp byte [rbx + rax], 0
jne 0x140077d22
add r13d, eax
mov r8, rdi
inc r8
cmp byte [rbx + r8], 0
jne 0x140077d31
imul r11d, dword [rsp + 0x34]
lea eax, [r11 + r11*4]
sub ecx, eax
sub ecx, dword [rsp + 0x58]
imul eax, dword [rsp + 0x70], 7
lea edx, [rax + rcx*2]
mov ecx, dword [rsp + 0x4c]
sub edx, dword [rsp + 0x50]
movzx eax, cl
xor ecx, ecx
sub edx, eax
lea eax, [r9 + 0xb]
sub edx, r10d
sub edx, ebp
add eax, edx
xor edx, edx
add eax, r8d
mov dword [rsp + 0x54], eax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r9d, dword [rsp + 0x188]
mov r11d, eax
mov dword [rsp + 0x50], eax
cmp r9d, dword [rsp + 0x34]
jbe 0x140077da5
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r9d, dword [rsp + 0x188]
mov r11d, dword [rsp + 0x50]
mov r8, rdi
nop dword [rax + rax]
inc r8
cmp byte [r14 + r8], 0
jne 0x140077db0
movzx eax, byte [rsp + 0x4c]
mov r10, qword [rsp + 0x60]
add r9b, r9b
dec r9b
add r9b, byte [rsp + 0x7c]
imul r10b
movzx ecx, al
mov al, 0x2a
imul byte [rsp + 0xb0]
movzx edx, al
movzx eax, r10b
sub dl, cl
mov ecx, 2
inc dl
sub cl, r11b
imul dl
movzx edx, al
mov rax, qword [rsp + 0x88]
sub al, r13b
sub al, byte [rsp + 0x44]
add al, al
add al, byte [rsp + 0x58]
add al, al
add dl, al
movzx eax, byte [rsp + 0x68]
imul r9b
add dl, al
movzx eax, cl
shl al, 3
add cl, al
movzx eax, byte [rsp + 0x3c]
add dl, cl
imul byte [rsp + 0x40]
movzx ecx, al
mov al, 7
imul cl
add dl, al
movzx eax, r15b
shl al, 2
add r15b, al
sub dl, r15b
sub dl, byte [rsp + 0x38]
sub dl, byte [rsp + 0x74]
sub dl, sil
sub dl, byte [rsp + 0x34]
sub dl, byte [rsp + 0x178]
sub dl, byte [rsp + 0x30]
add dl, byte [rsp + 0x48]
add dl, byte [rsp + 0x54]
add dl, bpl
add dl, r12b
sub dl, r8b
nop dword [rax]
cmp byte [rbx + rdi + 1], 0
lea rdi, [rdi + 1]
jne 0x140077e70
lea eax, [rdi + rdx]
mov rbx, qword [rsp + 0x170]
add rsp, 0x130
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret