Function at 0x140074e50
Capabilities:
Copy file
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1f0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
movsxd r12, dword [rsp + 0x250]
mov r13, rdx
lea rcx, [rsp + 0xa0]
mov edx, 0x104
mov esi, r9d
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea rcx, [rsp + 0xa0]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0xa0]
lea rcx, str.atelier
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbp, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
lea r8d, [rcx + 0x13]
mov edx, 0x31c
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x3cc
lea r8d, [rcx + 0x11]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
lea r8d, [rcx + 3]
mov edx, 0x2d1
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
sub bpl, r12b
mov rbx, rax
add bpl, 2
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
lea rcx, [rsp + 0xa0]
xor edx, edx
mov r8d, 0x140
mov edi, eax
call fcn.1400e27d0
lea rdx, [rsp + 0xa0]
lea rcx, str.cupola
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea rdx, [0x1400ed7c8]
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x30], rax
lea rax, str.cleric
movzx r9d, bpl
mov r8, rbx
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call fcn.1400dbec0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebx, dword [rsp + 0x260]
cmp edi, esi
je 0x140074ff1
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rdx, str.slash
lea rcx, str.numismatist
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_CopyFileA]
lea rcx, [rsp + 0xa0]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0xa0]
lea rcx, str.bank
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor ecx, ecx
lea r8d, [rcx + 0x1d]
mov edx, 0x1af
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r14, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
movzx ecx, bpl
add cl, cl
movzx r15d, ax
lea edi, [rcx + rbp]
movzx ecx, sil
add dil, bl
shl cl, 2
add dil, dil
lea eax, [rcx + rsi]
sub dil, byte [r13 + 0x20]
add dil, al
sub dil, r14b
add dil, 7
add dil, byte [rsp + 0x60]
test bl, bl
jne 0x140075080
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
lea rcx, [rsp + 0xa0]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0xa0]
lea rcx, str.angora
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor ecx, ecx
movzx r10d, r15b
movzx r11d, bpl
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x30], r10d
mov dword [rsp + 0x28], r11d
lea r8, str.cupola
lea rdx, str.slash
movsx ebx, r14b
mov ecx, esi
movsx r9d, dil
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x230]
add rsp, 0x1f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret