Function at 0x140078be0
Capabilities:
Copy file
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa8
mov r13d, r9d
mov rbx, r8
mov r14d, ecx
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov esi, ebx
sub esi, eax
mov rbp, rax
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edi, r14d
mov ecx, 0xffff
mov qword [rsp + 0x78], rax
sub edi, ebp
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
mov dword [rsp + 0x64], eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, 0xffff
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x90], rax
cmp sil, 8
je 0x140078cba
xor eax, eax
movsxd rcx, edi
lea r8, str.midwife
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x38], 8
mov dword [rsp + 0x30], r12d
lea rdx, str.midwife
mov r9d, edi
mov ecx, esi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], r14d
call qword [sym.imp.USER32.dll_CreateWindowExA]
xor ecx, ecx
mov edx, 0x2c8
lea r8d, [rcx + 0x1c]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x29e
lea r8d, [rcx + 3]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rdx, str.subsidence
lea rcx, str.midwife
mov r8d, r12d
mov r15, rax
call qword [sym.imp.KERNEL32.dll_CopyFileA]
mov dword [rsp + 0x80], eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rdx, qword [rsp + 0xf8]
mov ecx, dword [rsp + 0x70]
dec edx
mov qword [rsp + 0x88], rax
imul edx, r14d
imul ecx, dword [rsp + 0x78]
lea ecx, [rcx + rcx*4]
lea edx, [rdx + rcx*2]
sub edx, eax
lea eax, [rbx + rdx]
add eax, 4
add eax, esi
mov dword [rsp + 0x6c], eax
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
mov rdx, qword [rsp + 0x100]
movsx rcx, al
mov word [rsp + 0x68], ax
movzx eax, bpl
mov ebx, 0x1c
sub ebx, ecx
imul byte [rsp + 0x78]
sub ebx, dword [rsp + 0x6c]
movzx ecx, al
movzx eax, dl
movzx r9d, bl
imul cl
movzx ecx, al
movzx eax, sil
shl r9b, 2
mov byte [rsp + 0x60], r9b
imul cl
movzx r8d, al
movzx eax, dl
imul r14b
sub r8b, al
movzx eax, byte [rsp + 0x88]
imul r12b
movzx ecx, al
movzx eax, byte [rsp + 0x90]
imul cl
add r8b, al
mov eax, dword [rsp + 0x64]
movzx ecx, al
shl cl, 2
add al, cl
add al, al
sub r8b, al
sub r8b, byte [rsp + 0xf8]
add r8b, r14b
add r8b, byte [rsp + 0x70]
add r8b, r9b
mov byte [rsp + 0xf0], r8b
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
xor ecx, ecx
mov edx, 0x234
lea r8d, [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, qword [rsp + 0x78]
movzx edx, byte [rsp + 0x88]
add dl, 3
movzx eax, dl
shl al, 3
add dl, al
movzx eax, cl
shl al, 2
add cl, al
shl cl, 4
add dl, cl
xor ecx, ecx
sub dl, bl
lea r8d, [rcx + 8]
sub dl, byte [rsp + 0x70]
sub dl, byte [rsp + 0xf0]
add dl, dil
add dl, r13b
add dl, byte [rsp + 0x64]
add dl, r14b
add dl, bpl
add dl, sil
mov byte [rsp + 0x108], dl
mov edx, 0x12a
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rbx, rax
cmp r12d, r14d
jge 0x140078e6a
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor ecx, ecx
lea r8d, [rcx + 0x1c]
mov edx, 0xbd
call qword [sym.imp.KERNEL32.dll_FindResourceA]
movzx eax, sil
shl bl, 4
inc r13b
imul byte [rsp + 0x78]
add al, al
sub r15b, al
movzx eax, bpl
inc r15b
imul r15b
lea edx, [rbx + rax]
mov al, 0x1c
add dl, byte [rsp + 0x6c]
imul byte [rsp + 0x108]
shl dl, 2
lea ecx, [rax - 3]
movzx eax, byte [rsp + 0x100]
imul cl
add dl, al
movzx eax, r14b
imul r13b
add dl, al
movzx eax, dil
shl al, 2
add dil, al
mov al, 7
add dil, dil
sub dl, dil
imul byte [rsp + 0x70]
sub dl, al
sub dl, r12b
sub dl, byte [rsp + 0x90]
sub dl, byte [rsp + 0xf8]
sub dl, byte [rsp + 0xf0]
sub dl, byte [rsp + 0x80]
add dl, byte [rsp + 0x64]
add dl, byte [rsp + 0x88]
lea eax, [rdx + rbp]
sub al, 0x16
add al, byte [rsp + 0x60]
add al, byte [rsp + 0x68]
add rsp, 0xa8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret