Function at 0x1400c2260
Capabilities:
Copy file
Create thread
Query environment variable

Disassembly:
mov r11, rsp
sub rsp, 0x1e8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov qword [r11 + 0x20], rbx
mov qword [r11 - 8], rbp
mov qword [r11 - 0x10], rsi
mov qword [r11 - 0x18], rdi
mov qword [r11 - 0x20], r12
mov ebp, r8d
mov qword [r11 - 0x28], r13
mov dword [rsp + 0x30], r8d
mov edi, edx
mov dword [rsp + 0x34], edx
mov rsi, rcx
mov qword [rsp + 0x38], rcx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
lea r12d, [rbx + rax]
mov r13, rax
cmp ebp, edi
jg 0x1400c2425
mov qword [rsp + 0x1b8], r14
mov qword [rsp + 0x1b0], r15
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rdx, str.ottoman
lea rcx, str.couch
mov r8d, eax
mov r14, rax
call qword [sym.imp.KERNEL32.dll_CopyFileA]
mov edx, 0xa4
movzx ecx, al
mov esi, eax
add cl, cl
lea edi, [rcx + rax]
xor ecx, ecx
lea r8d, [rcx + 2]
shl dil, 3
call qword [sym.imp.KERNEL32.dll_FindResourceA]
movsx rcx, r12b
movsx rbp, dil
imul r15d, dword [rsp + 0x38], 7
lea eax, [rcx*2 + 4]
sub r15d, eax
mov eax, r14d
imul eax, esi
sub r15d, eax
sub r15d, ebx
sub r15d, r13d
add r15d, ebp
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
lea r8d, [rcx + 0x18]
mov edx, 0x25a
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x90]
mov edx, 0x104
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov rsi, qword [rsp + 0x38]
imul ebp, r15d
mov r9d, dword [rsp + 0x30]
lea ecx, [rbp*4]
lea r8, [0x140001b00]
imul eax, edi
add ecx, ebp
lea edi, [rbx + 2]
xor edx, edx
imul r9d, ebx
sub eax, ecx
lea ecx, [r13*4]
sub eax, ecx
xor ecx, ecx
add eax, esi
add eax, r14d
add edi, eax
movsx eax, r12b
imul eax, r13d
add eax, esi
add r9d, eax
xor eax, eax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
mov edx, 0x1fc
lea r8d, [rcx + 6]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [0x1400ed3f4]
movsxd rbx, r13d
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.c3a0
mov r9, rbx
mov rcx, rax
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edi, dword [rsp + 0x34]
mov r15, qword [rsp + 0x1b0]
mov r14, qword [rsp + 0x1b8]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbp, qword [rsp + 0x1e0]
mov rbx, qword [rsp + 0x208]
cmp r12b, r13b
je 0x1400c246f
lea eax, [rax*4]
imul esi, edi
lea edx, [r13 - 5]
lea ecx, [rsi + rsi*4]
lea r9, str.c1ret
xor r8d, r8d
sub ecx, eax
movsx rax, r12b
sub ecx, eax
add edx, ecx
lea rcx, [rsp + 0x40]
call fcn.1400da6a0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r13, qword [rsp + 0x1c0]
mov rsi, qword [rsp + 0x1d8]
movsx eax, r12b
mov r12, qword [rsp + 0x1c8]
cmp edi, eax
mov rdi, qword [rsp + 0x1d0]
jae 0x1400c24b7
xor ecx, ecx
mov edx, 0x279
lea r8d, [rcx + 0xd]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rax, str.drill
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x1e8
ret