Function at 0x140095a70
Capabilities:
Copy file
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x200
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
mov r14, rcx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0xb0]
mov edx, 0x104
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
imul edi, r14d
movzx ecx, r14b
shl cl, 2
lea esi, [rcx + r14]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
movsx rbx, sil
lea edx, [rbx + 4]
mov rbp, rax
mov qword [rsp + 0x48], rax
add edx, edi
mov qword [rsp + 0x70], rbx
mov dword [rsp + 0x38], edx
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
movzx r13d, ax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0xb0]
mov edx, 0x104
mov r15, rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
movsx ecx, sil
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rcx, [rsp + 0xb0]
xor edx, edx
mov r8d, 0x140
mov qword [rsp + 0x58], rax
call fcn.1400e27d0
lea rdx, [rsp + 0xb0]
lea rcx, str.c0a0
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea ecx, [rbx + rbx]
mov r12d, r14d
sub r12d, ecx
lea rdx, str.bookend
lea rcx, str.bookend
mov r8d, r13d
mov qword [rsp + 0x68], rax
call qword [sym.imp.KERNEL32.dll_CopyFileA]
lea r8, [0x140001b00]
mov r9d, r13d
mov dword [rsp + 0x40], eax
xor eax, eax
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x60], rax
movzx eax, r14b
imul dil
movzx ebx, al
add bl, bl
add bl, r15b
add bl, bl
sub bl, bpl
mov ebp, r13d
sub bl, sil
add bl, r13b
imul ebp, edi
add ebp, r14d
add ebp, r15d
mov dword [rsp + 0x50], ebp
test edi, edi
jne 0x140095c1a
lea r8d, [rdi + 3]
mov edx, 0xc2
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea r8d, [rdi + 0xd]
mov edx, 0x35d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
movzx eax, bl
mov ebx, dword [rsp + 0x38]
mov dword [rsp + 0x30], eax
neg eax
mov ecx, ebx
shl eax, 3
imul ecx, dword [rsp + 0x58]
inc ecx
imul ecx, r15d
sub eax, ecx
movsx ecx, sil
sub eax, ecx
sub eax, dword [rsp + 0x60]
add eax, 0xfffffffe
add eax, r12d
mov dword [rsp + 0x3c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor ecx, ecx
lea r8d, [rcx + 0xc]
mov edx, 0x3b6
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov eax, ebx
add ebx, 0xa
lea edx, [r14 + r14*4]
mov ecx, r14d
imul eax, r13d
mov dword [rsp + 0x58], edx
imul ecx, dword [rsp + 0x30]
inc ecx
imul ecx, r15d
sub ecx, eax
mov eax, edx
mov edx, r15d
imul eax, edi
add eax, dword [rsp + 0x68]
imul edx, r12d
add eax, ecx
mov ecx, dword [rsp + 0x40]
lea r8d, [rcx*4 - 5]
mov ecx, dword [rsp + 0x3c]
add r8d, eax
imul eax, r13d, 7
add ebx, eax
lea eax, [r8 + r8*4]
lea ebx, [rbx + rdx*2]
lea r9d, [rcx + rax*4]
add ebx, r14d
mov dword [rsp + 0x34], r9d
add ebx, edi
test ebp, ebp
jne 0x140095ce5
lea r8d, [rbp + 0x19]
mov edx, 0x10d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r9d, dword [rsp + 0x34]
imul r8d, dword [rsp + 0x48], 7
lea eax, [r14*8]
lea ecx, [rbx + r9*4]
sub r8d, eax
add ecx, r9d
lea eax, [r12*4 + 1]
add ecx, r8d
add eax, ecx
add eax, r15d
mov dword [rsp + 0x48], eax
test sil, sil
js 0x140095d45
lea rcx, [rsp + 0xb0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r9d, dword [rsp + 0x34]
mov r10, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
mov r8d, dword [rsp + 0x30]
imul r8d, dword [rsp + 0x50]
imul ecx, r12d
lea eax, [r10 + r10]
lea esi, [r14 - 6]
mov dword [rsp + 0x30], r8d
sub eax, dword [rsp + 0x38]
lea ecx, [rcx + rax*4]
lea eax, [rbx + rbx*4]
sub ecx, eax
mov eax, dword [rsp + 0x3c]
sub ecx, r9d
lea ebp, [rax + rax*8]
sub ecx, r15d
add esi, ecx
mov ecx, dword [rsp + 0x38]
imul eax, r14d, 0xffffffe2
imul ecx, r13d
inc ecx
imul ecx, r15d
sub eax, ecx
mov ecx, 0xffff
lea edx, [rax + rdi*4]
lea eax, [r10 + 0x17]
sub edx, r8d
sub edx, dword [rsp + 0x70]
add edx, dword [rsp + 0x48]
add edx, ebp
add edx, r9d
add edx, ebx
add eax, edx
mov dword [rsp + 0x90], eax
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
xor ecx, ecx
lea r8d, [rcx + 0xa]
mov edx, 0x32b
call qword [sym.imp.KERNEL32.dll_FindResourceA]
movzx ecx, sil
mov rdi, rax
movzx eax, byte [rsp + 0x90]
add cl, cl
lea ebx, [rcx + rsi]
lea rcx, [rsp + 0x80]
imul dil
shl bl, 3
sub bl, al
add bl, 6
add bl, r15b
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, dword [rsp + 0x48]
lea edx, [r15 + rsi*4]
movzx ecx, bl
lea eax, [rax + rdx*2]
add edx, eax
mov eax, dword [rsp + 0x38]
add edx, r12d
add edx, edx
imul eax, eax
sub edx, eax
mov rax, qword [rsp + 0x60]
imul eax, dword [rsp + 0x40]
add edx, eax
mov eax, dword [rsp + 0x30]
sub edx, r14d
sub edx, edi
add eax, edx
add ecx, eax
lea eax, [r13 - 0x29]
add ecx, dword [rsp + 0x70]
add ecx, ebp
add ecx, dword [rsp + 0x34]
add ecx, dword [rsp + 0x68]
add ecx, r15d
add ecx, dword [rsp + 0x58]
add eax, ecx
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x200]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret