Function at 0x14008b570
Capabilities:
Copy file
Extract resource via kernel32 functions
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x218
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x200], rax
mov byte [rsp + 0x60], r9b
mov rdi, r8
mov qword [rsp + 0xa8], r8
mov rsi, rdx
mov qword [rsp + 0x88], rdx
mov r12, rcx
mov qword [rsp + 0x98], rcx
call qword [sym.imp.USER32.dll_GetActiveWindow]
or rbp, 0xffffffffffffffff
mov r13, rax
mov qword [rsp + 0x70], rax
mov r14, rbp
inc r14
cmp byte [rsi + r14], 0
jne 0x14008b5d1
imul r14d, edi
mov rbx, rbp
imul r14d, r12d
mov qword [rsp + 0xb0], r14
nop
inc rbx
cmp byte [rsi + rbx], 0
jne 0x14008b5f0
xor ecx, ecx
imul ebx, edi
mov r15d, 0xb
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rcx
add ebx, r12d
lea r8, str.world
lea rdx, str.world
mov eax, ebx
mov ecx, ebx
imul eax, r14d
sub r15d, eax
mov dword [rsp + 0x7c], eax
mov eax, ebx
mov qword [rsp + 0x40], rax
sub r15d, r13d
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], r14d
mov r9d, r15d
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r15d
mov dword [rsp + 0x64], r15d
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [rsp + 0x80], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rbp
mov rdi, rax
mov qword [rsp + 0xa0], rax
movsx rax, byte [rsp + 0x60]
inc rcx
cmp byte [rsi + rcx], 0
jne 0x14008b680
add ecx, r12d
mov edx, 0x2f3
add ecx, r13d
add ecx, eax
lea eax, [r15 + 1]
add eax, ecx
xor ecx, ecx
lea r8d, [rcx + 0x1d]
mov dword [rsp + 0x78], eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov eax, r12d
xor ecx, ecx
lea r8d, [rcx + 9]
mov edx, 0x1b8
imul eax, r15d
lea eax, [rax + rax*2]
add eax, eax
mov dword [rsp + 0x90], eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor ecx, ecx
mov edx, 0x37c
lea r8d, [rcx + 3]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, rbp
nop dword [rax]
inc rcx
cmp byte [rsi + rcx], 0
jne 0x14008b6f0
movzx eax, byte [rsp + 0x60]
movzx r13d, r12b
imul cl
sub r13b, al
add r13b, 5
mov byte [rsp + 0x61], r13b
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [rsp + 0x68], rax
cmp r15d, ebx
jg 0x14008b907
xor ecx, ecx
mov edx, 0x1b0
lea r8d, [rcx + 3]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0xc0]
xor edx, edx
mov r8d, 0x140
mov rsi, rax
call fcn.1400e27d0
lea rdx, [rsp + 0xc0]
lea rcx, [0x1400ed4d4]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rdi, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rbp, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
movsxd r13, r14d
mov r12, rax
xor eax, eax
lea r8, [0x1400ed4d4]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r13
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], eax
lea rdx, [0x1400ed3f4]
xor r9d, r9d
mov ecx, r15d
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov eax, dword [rsp + 0xa8]
movsx r14d, byte [rsp + 0x61]
imul eax, dword [rsp + 0x98]
movsx r15d, byte [rsp + 0x60]
mov ecx, r14d
xor edx, edx
mov r8d, 0x140
imul ecx, dword [rsp + 0x78]
add ecx, eax
lea eax, [rcx + rsi*2]
lea rcx, [rsp + 0xc0]
sub eax, dword [rsp + 0x68]
sub eax, dword [rsp + 0x80]
sub eax, edi
sub eax, dword [rsp + 0x70]
sub eax, dword [rsp + 0x64]
lea edi, [r15 + rax]
add edi, 0xfffffff3
add edi, ebp
add edi, dword [rsp + 0xa0]
add edi, ebx
call fcn.1400e27d0
lea rdx, [rsp + 0xc0]
lea rcx, [0x1400ed3f4]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
xor eax, eax
sub edi, r12d
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r13
mov dword [rsp + 0x38], r15d
mov dword [rsp + 0x30], ebx
lea r9d, [rdi + 0x10]
lea r8, str.rainbow
lea rdx, str.world
mov ecx, ebx
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r15d
call qword [sym.imp.USER32.dll_CreateWindowExA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor ecx, ecx
lea r8d, [rcx + 0x1c]
mov edx, 0x225
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, str.c2ret
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r12, qword [rsp + 0x98]
mov rcx, rax
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_LoadResource]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ecx, ecx
lea r8d, [rcx + 0x18]
mov edx, 0xe7
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r14, qword [rsp + 0xb0]
lea rdx, [0x1400ed3f4]
lea rcx, str.numismatist
mov r8d, r14d
call qword [sym.imp.KERNEL32.dll_CopyFileA]
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x88]
mov r15d, dword [rsp + 0x64]
movzx r13d, byte [rsp + 0x61]
or rbp, 0xffffffffffffffff
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [rsp + 0x88], rax
cmp ebx, r14d
je 0x14008b92f
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, r12
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
movsx r8d, byte [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
mov r9, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x70]
mov r14d, r8d
mov eax, edx
imul r14d, r12d
imul eax, edi
imul r14d, r9d
imul eax, ecx
sub r14d, eax
add r14d, 0x4c
cmp ebx, 0x10
jbe 0x14008b9a3
lea rdx, str.c8a0
lea rcx, str.c8a0
call qword [sym.imp.KERNEL32.dll_CopyFileA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor ecx, ecx
lea r8d, [rcx + 6]
mov edx, 0x307
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
mov r9, qword [rsp + 0x80]
inc rbp
cmp byte [rsi + rbp], 0
jne 0x14008b9a3
imul edi, dword [rsp + 0x90]
lea eax, [r15 + r15*4]
sub edi, eax
lea eax, [rdx + rdx]
sub edi, eax
movsx rax, r13b
sub edi, eax
movsx rax, byte [rsp + 0x60]
sub edi, dword [rsp + 0xa8]
sub edi, r14d
sub edi, dword [rsp + 0x88]
add edi, dword [rsp + 0x7c]
add edi, r12d
add edi, r9d
add edi, ecx
add eax, edi
sub eax, ebp
sub eax, 0x31
mov rcx, qword [rsp + 0x200]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x218
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret