Function at 0x1400b5af0
Capabilities:
Copy file
Create thread
Extract resource via kernel32 functions

Disassembly:
mov dword [rsp + 0x18], r8d
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x78
mov edi, r8d
mov r14, rdx
mov r15, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
mov ebx, eax
mov dword [rsp + 0xd8], eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, ebx
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r9d, r12d
mov rsi, rax
mov eax, r15d
imul r9d, ebp
sub eax, r9d
sub eax, dword [r14 + 0x24]
add eax, ebx
mov dword [rsp + 0xc8], eax
lea r13d, [rax + 0xa]
movzx eax, dil
sub al, bpl
sub al, bl
sub al, r13b
add al, r12b
add al, r15b
mov byte [rsp + 0xc0], al
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov ecx, dword [r14 + 0x20]
add r13d, 5
mov edx, 0x1ea
imul ecx, ebp
imul ecx, r15d
add r13d, ecx
xor ecx, ecx
lea r8d, [rcx + 0x15]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, r12d
mov rbx, rax
mov eax, dword [rsp + 0xc8]
imul ecx, ebp
lea edx, [rcx + rcx*2]
lea ecx, [rax + rax*4]
lea eax, [rcx + rdx*2]
movsx rcx, byte [rsp + 0xc0]
sub eax, dword [rsp + 0xd0]
inc ecx
add eax, r15d
mov dword [rsp + 0x60], eax
imul edx, ecx, 7
xor ecx, ecx
imul eax, esi, 0xfffffffa
sub eax, edx
add eax, r12d
mov dword [rsp + 0x64], eax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [r14]
imul ebx, r13d
movsxd r14, dword [rsp + 0x60]
mov eax, ecx
imul eax, r15d
lea esi, [rax + rbx*4]
mov ebx, dword [rsp + 0xc8]
mov eax, ebp
imul ebp, ebp
imul eax, ebx
add esi, eax
mov eax, r14d
sub esi, r12d
add esi, edi
movsxd rdi, dword [rsp + 0xd8]
add esi, edi
imul ebp, edi
sub eax, ebp
sub eax, ecx
add r15d, 0x11
add r15d, eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor eax, eax
lea r8, [0x140001b00]
mov r9, r14
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
lea r8d, [rcx + 0x15]
mov edx, 0x2d9
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor ecx, ecx
lea r8d, [rcx + 8]
mov edx, 0x2b6
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea r8d, [rbx + 0xa]
lea rdx, str.management
lea rcx, str.fiction
call qword [sym.imp.KERNEL32.dll_CopyFileA]
xor ecx, ecx
mov dword [rsp + 0xc8], eax
call qword [sym.imp.KERNEL32.dll_LockResource]
cmp edi, r14d
je 0x1400b5da2
movsxd rdx, eax
xor eax, eax
lea r9d, [rbx + 0xa]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0xc8]
mov qword [rsp + 0x40], rdx
mov edx, dword [rsp + 0x64]
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edx
lea r8, str.faucet
lea rdx, [0x1400ee168]
mov ecx, 8
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExA]
xor ebp, ebp
lea r8, [0x140001b00]
mov r9, rdi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [rsp + 0x30], r14d
xor r9d, r9d
mov r8, r12
mov rdx, r12
mov rcx, rbx
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov eax, dword [rsp + 0xd0]
movsx ecx, byte [rsp + 0xc0]
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x38], r13d
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], eax
lea r8, str.paste
lea rdx, str.c4a0
xor r9d, r9d
mov dword [rsp + 0x20], ebp
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea rax, str.c3ret
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret