Function at 0x1400a8eb0
Capabilities:
Copy file
Create thread
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x278
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x260], rax
movsx esi, byte [rsp + 0x2e0]
mov rdi, r9
mov rbp, r8
mov r12, rdx
mov qword [rsp + 0x90], rdx
movzx ebx, cl
mov byte [rsp + 0x61], sil
mov byte [rsp + 0x60], cl
call qword [sym.imp.USER32.dll_GetActiveWindow]
or r14, 0xffffffffffffffff
mov r15d, esi
mov r13, rax
mov qword [rsp + 0xa8], rax
cmp esi, 0x10
jb 0x1400a8f6a
mov rcx, r14
nop dword [rax + rax]
inc rcx
cmp byte [rdi + rcx], 0
jne 0x1400a8f20
movsx rax, sil
movsx r9, bl
mov qword [rsp + 0x28], 0
lea rdx, str.sunbeam
xor r8d, r8d
imul ecx, eax
sub r9d, ecx
lea rcx, str.reamer
mov qword [rsp + 0x20], rcx
sub r9d, r13d
lea rcx, [rsp + 0xe0]
add r9d, 0x10
call fcn.1400db100
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov ecx, 0x10
mov rbx, rax
mov qword [rsp + 0xd8], rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r8d, 0x10
mov rdx, rdi
mov rcx, rdi
mov qword [rsp + 0xc0], rax
call qword [sym.imp.KERNEL32.dll_CopyFileA]
lea rcx, [rsp + 0x150]
mov edx, 0x104
mov dword [rsp + 0x64], eax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov qword [rsp + 0xa0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x98], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
movsx r8, byte [rsp + 0x60]
mov rsi, rax
mov qword [rsp + 0xc8], rax
mov rdx, r8
movsx rax, r15b
mov rcx, r14
nop
inc rcx
cmp byte [rdi + rcx], 0
jne 0x1400a8ff0
imul ecx, eax
mov eax, dword [rsp + 0xa0]
imul eax, ebx
sub edx, eax
mov rax, r14
sub edx, ecx
nop dword [rax]
inc rax
cmp byte [rax + rbp], 0
jne 0x1400a9010
mov rcx, qword [rsp + 0x98]
add edx, 0xfffffff0
xor r9d, r9d
add eax, edx
mov dword [rsp + 0x78], eax
movsx eax, r8b
mov r8, qword [rsp + 0xc0]
mov dword [rsp + 0x30], eax
mov rdx, r8
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
lea rcx, [rsp + 0x118]
mov r15d, eax
mov dword [rsp + 0x70], eax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
movzx ecx, byte [rsp + 0x60]
movsx r9, byte [rsp + 0x64]
movzx eax, ax
lea r8d, [rsi + rsi]
mov dword [rsp + 0x6c], eax
movzx eax, sil
mov dword [rsp + 0x7c], r8d
imul r15b
movzx r15d, al
movzx eax, bl
imul r12b
add r15b, al
mov rax, r14
sub r15b, byte [rsp + 0x98]
add r15b, 4
add r15b, cl
mov byte [rsp + 0x68], r15b
inc rax
cmp byte [rax + rbp], 0
jne 0x1400a90b1
imul eax, r12d
mov r12d, r9d
movsx r10, cl
sub r12d, eax
movsx rax, byte [rsp + 0x61]
sub r12d, dword [rsp + 0x70]
sub r12d, eax
mov rax, r14
add r12d, r10d
add r12d, r8d
nop
inc rax
cmp byte [rdi + rax], 0
jne 0x1400a90e0
sub r12d, eax
lea r8d, [rbx + rbx*2]
mov rdx, r14
add r8d, r8d
mov dword [rsp + 0x120], r12d
mov dword [rsp + 0xb0], r8d
inc rdx
cmp byte [rdx + rbp], 0
jne 0x1400a9106
movsx eax, byte [rsp + 0x61]
mov ecx, esi
imul ecx, dword [rsp + 0xa0]
imul eax, r13d
mov r13d, dword [rsp + 0x78]
shl eax, 4
sub ecx, eax
sub ecx, r9d
sub ecx, r8d
sub ecx, r13d
lea eax, [r10 + rcx]
xor ecx, ecx
add edx, eax
lea r8d, [rcx + 0xa]
mov dword [rsp + 0x124], edx
mov edx, 0x14e
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rax, r14
inc rax
cmp byte [rax + rbp], 0
jne 0x1400a9156
movsx edx, byte [rsp + 0x60]
movsx rcx, byte [rsp + 0x61]
imul eax, edx
lea edx, [r13 + 2]
imul eax, dword [rsp + 0x90]
imul eax, ecx
movzx ecx, r15b
movsxd r15, dword [rsp + 0x6c]
shl eax, 4
mov r13d, ecx
mov dword [rsp + 0x84], ecx
add eax, ebx
add edx, eax
mov rax, qword [rsp + 0x120]
imul r13d, r15d
shr rax, 0x20
mov dword [rsp + 0x74], edx
imul eax, edx
imul eax, esi
sub r13d, eax
add r13d, 2
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea r8, [0x140001b00]
mov qword [rsp + 0xd0], rax
xor eax, eax
mov r9, r15
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, r14
mov r8, rax
mov qword [rsp + 0xb8], rax
inc rcx
cmp byte [rdi + rcx], 0
jne 0x1400a91f2
mov r11, qword [rsp + 0x90]
mov r10d, dword [rsp + 0x78]
movzx eax, r11b
imul cl
movzx ecx, al
movzx eax, byte [rsp + 0x60]
imul cl
movzx ecx, al
movzx eax, byte [rsp + 0x98]
imul sil
sub cl, al
lea eax, [r15 + 9]
movsxd r15, dword [rsp + 0x64]
add al, al
add cl, al
mov eax, dword [rsp + 0x70]
sub cl, byte [rsp + 0x61]
lea edx, [rax + rax]
add cl, r10b
add cl, r15b
movzx r9d, cl
mov rcx, r14
mov dword [rsp + 0x80], r9d
inc rcx
cmp byte [rdi + rcx], 0
jne 0x1400a9255
mov rax, r14
inc rax
cmp byte [rax + rbp], 0
jne 0x1400a9261
imul ecx, eax
mov eax, r8d
imul eax, r13d
imul ecx, ebx
imul eax, dword [rsp + 0x74]
imul ecx, dword [rsp + 0xa8]
add ecx, eax
lea eax, [rcx + r10*2]
movsx rcx, r15b
sub eax, r9d
sub eax, r11d
sub eax, edx
movsx edx, byte [rsp + 0x60]
sub eax, esi
add eax, edx
add eax, ecx
mov rcx, qword [rsp + 0xa0]
add eax, dword [rsp + 0x98]
add ecx, 0xfffffffe
add eax, ecx
lea rcx, [0x1400ed4d4]
mov dword [rsp + 0x88], eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
xor ecx, ecx
mov edx, 0x1b6
lea r8d, [rcx + 0x15]
mov qword [rsp + 0xf0], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, r14
nop word [rax + rax]
inc rcx
cmp byte [rdi + rcx], 0
jne 0x1400a9300
mov r8, qword [rsp + 0xb8]
movsxd rdx, dword [rsp + 0x64]
mov r15d, r13d
imul r15d, dword [rsp + 0x74]
lea eax, [r8 + r8*4]
add r15d, eax
lea eax, [rsi + rsi]
sub r15d, eax
movsx rax, dl
mov edx, dword [rsp + 0x70]
sub r15d, dword [rsp + 0x90]
sub r15d, eax
lea eax, [rdx + rdx]
movsx edx, byte [rsp + 0x60]
sub r15d, eax
sub r15d, dword [rsp + 0xd0]
add r15d, edx
mov edx, 0x226
add r15d, dword [rsp + 0xa0]
add r15d, ebx
add r15d, dword [rsp + 0xa8]
sub r15d, ecx
xor ecx, ecx
lea r8d, [rcx + 0xb]
sub r15d, 0xa
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rsi, rax
mov qword [rsp + 0xa8], rax
mov rax, r14
nop
inc rax
cmp byte [rax + rbp], 0
jne 0x1400a9390
mov rcx, qword [rsp + 0xd0]
add ecx, ecx
sub ecx, eax
movsx eax, byte [rsp + 0x60]
add ecx, ecx
sub ecx, dword [rsp + 0x88]
imul eax, dword [rsp + 0x90]
lea edx, [rax + rcx*8]
movsxd rcx, dword [rsp + 0x64]
movsx rax, cl
mov ecx, dword [rsp + 0x80]
sub edx, eax
sub edx, dword [rsp + 0x6c]
sub edx, ebx
mov ebx, dword [rsp + 0x70]
sub edx, dword [rsp + 0x78]
add ebx, 3
add edx, dword [rsp + 0x84]
add edx, r13d
add ebx, edx
mov dword [rsp + 0x118], ebx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor ecx, ecx
lea r8d, [rcx + 0x19]
mov edx, 0x390
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, dword [rsp + 0x6c]
imul esi, ebx
add esi, 0xfffffffc
mov qword [rsp + 0x130], rax
lea esi, [rsi + r15*4]
mov dword [rsp + 0x88], esi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
movsx edx, byte [rsp + 0x60]
movsx r9d, byte [rsp + 0x64]
xor ecx, ecx
mov rbx, rax
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rcx
movsx ecx, byte [rsp + 0x61]
movsxd rax, esi
lea r8, str.c4a0
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x38], ecx
mov ecx, dword [rsp + 0x6c]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], edx
lea rdx, [0x1400ed4fc]
call qword [sym.imp.USER32.dll_CreateWindowExA]
xor ecx, ecx
mov edx, 0x299
lea r8d, [rcx + 0xe]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea eax, [rbx + rbx*4]
mov rdx, r14
sub eax, esi
sub eax, dword [rsp + 0x7c]
mov dword [rsp + 0x7c], eax
nop word [rax + rax]
inc rdx
cmp byte [rdi + rdx], 0
jne 0x1400a94b0
mov r9d, dword [rsp + 0x84]
mov r10d, dword [rsp + 0x78]
mov r8, qword [rsp + 0xc8]
mov eax, dword [rsp + 0x70]
mov rsi, qword [rsp + 0xa8]
mov ebx, r9d
imul ebx, r8d
imul eax, r10d
sub ebx, eax
mov eax, dword [rsp + 0xf0]
lea ecx, [rax + rax*2]
mov eax, r13d
shl ecx, 2
shl eax, 5
sub ebx, ecx
movsxd rcx, dword [rsp + 0x64]
sub ebx, eax
movsx rax, cl
movsx rcx, byte [rsp + 0x60]
sub ebx, eax
movsx rax, byte [rsp + 0x61]
sub ebx, dword [rsp + 0x130]
sub ebx, r8d
lea r8, str.c4a0
sub ebx, dword [rsp + 0xa0]
add ebx, dword [rsp + 0x80]
add ebx, esi
add ebx, ecx
mov ecx, r13d
add ebx, r15d
add ebx, dword [rsp + 0x6c]
add ebx, dword [rsp + 0xd8]
add ebx, eax
xor eax, eax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], 0x10
mov dword [rsp + 0x38], r9d
sub ebx, edx
mov dword [rsp + 0x30], 0x20
mov dword [rsp + 0x28], r10d
mov r9d, r13d
mov rdx, rdi
mov dword [rsp + 0x20], r13d
sub ebx, 0xc
call qword [sym.imp.USER32.dll_CreateWindowExA]
cmp r13d, 0x10
jne 0x1400a9710
mov rdx, r14
nop word [rax + rax]
inc rdx
cmp byte [rdi + rdx], 0
jne 0x1400a95a0
mov r13d, dword [rsp + 0x7c]
lea eax, [rbx - 5]
add al, byte [rsp + 0x90]
movzx ecx, al
mov eax, dword [rsp + 0x74]
imul ecx, ebx
imul eax, r12d
mov r12, qword [rsp + 0xc8]
imul ecx, r13d
shl eax, 4
sub ecx, eax
mov rax, qword [rsp + 0x98]
lea r8d, [rax + rcx*2]
mov rax, qword [rsp + 0xb8]
movsxd rcx, dword [rsp + 0x64]
imul r8d, r12d
lea eax, [rax + rax*8]
add r8d, eax
movsx rax, cl
movsx rcx, byte [rsp + 0x60]
sub r8d, dword [rsp + 0x80]
sub r8d, dword [rsp + 0x84]
sub r8d, dword [rsp + 0xb0]
sub r8d, dword [rsp + 0x6c]
add r8d, eax
mov rax, r14
add r8d, ecx
add r8d, dword [rsp + 0x70]
sub r8d, edx
inc rax
cmp byte [rax + rbp], 0
jne 0x1400a9632
lea ebx, [r8 - 0x29]
add ebx, eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rcx, rsi
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
nop
inc r14
cmp byte [r14 + rbp], 0
jne 0x1400a9660
mov r8, qword [rsp + 0xb8]
movzx eax, byte [rsp + 0x90]
imul r14b
movzx edx, al
movzx eax, r12b
imul r13b
movzx ecx, al
movzx eax, r8b
inc r8b
imul byte [rsp + 0x74]
shl al, 5
sub cl, al
movzx eax, byte [rsp + 0x88]
shl cl, 2
add dl, cl
imul byte [rsp + 0x118]
movzx ecx, al
movzx eax, r15b
imul cl
movzx ecx, al
movzx eax, sil
imul cl
movzx ecx, al
shl cl, 3
add al, cl
add dl, al
mov rax, qword [rsp + 0xc0]
sub dl, bl
sub dl, byte [rsp + 0x61]
sub dl, dil
sub dl, al
sub dl, r12b
sub dl, byte [rsp + 0x64]
add dl, byte [rsp + 0x60]
add dl, r8b
add dl, byte [rsp + 0x98]
add dl, byte [rsp + 0x68]
movsx ecx, dl
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0x28
xor ecx, ecx
lea r8d, [rdx - 0xb]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rax, str.c10a1
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x278
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret