Function at 0x1400b50f0
Capabilities:
Copy file
Create thread
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x238
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x220], rax
mov r12, qword [rsp + 0x2a0]
mov r14, qword [rsp + 0x2a8]
mov r15, rcx
mov qword [rsp + 0x88], rcx
xor ecx, ecx
mov qword [rsp + 0x68], r8
mov esi, r9d
mov rdi, rdx
lea r8d, [rcx + 0xe]
mov edx, 0x1b3
mov dword [rsp + 0x60], esi
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r13d, r15d
sub r13d, esi
mov qword [rsp + 0x70], rax
add r13d, eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea r8, [0x140001b00]
mov qword [rsp + 0x90], rax
mov r9d, esi
xor edx, edx
xor ecx, ecx
imul r13b
movzx ebx, al
xor eax, eax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x80], rax
cmp r13d, esi
jl 0x1400b51b1
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call qword [sym.imp.USER32.dll_GetActiveWindow]
movsx r9d, bl
or rbp, 0xffffffffffffffff
mov dword [rsp + 0x64], r9d
mov rcx, rbp
inc rcx
cmp byte [r14 + rcx], 0
jne 0x1400b51c1
imul ecx, dword [rsp + 0x70]
mov esi, r9d
xor edx, edx
mov r8d, 0x140
imul esi, r13d
lea eax, [r15 + rcx]
lea rcx, [rsp + 0xe0]
add esi, eax
mov dword [rsp + 0x78], esi
call fcn.1400e27d0
lea rdx, [rsp + 0xe0]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0xe0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor ecx, ecx
mov edx, 0x1f9
lea r8d, [rcx + 0xb]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
movsx r8, bl
mov rcx, rbp
mov qword [rsp + 0x98], r8
inc rcx
cmp byte [r12 + rcx], 0
jne 0x1400b5240
mov eax, dword [rsp + 0x68]
mov rbx, qword [rsp + 0x80]
mov edx, r15d
imul eax, dword [rsp + 0x60]
sub edx, eax
mov rax, rbp
sub edx, r8d
sub edx, ebx
sub edx, ecx
nop word [rax + rax]
inc rax
cmp byte [r14 + rax], 0
jne 0x1400b5270
add edx, 0xfffffff0
lea rcx, [0x1400ed7c8]
add eax, edx
mov dword [rsp + 0x7c], eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, qword [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rbp
mov qword [rsp + 0xd8], rax
nop dword [rax]
inc rcx
cmp byte [r14 + rcx], 0
jne 0x1400b52b0
mov eax, ebx
mov rbx, qword [rsp + 0x88]
imul eax, r13d
lea r15d, [rax + rax*4]
shl r15d, 5
add r15d, ebx
add r15d, dword [rsp + 0x70]
sub r15d, ecx
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov r10d, dword [rsp + 0x64]
mov r9, rax
mov qword [rsp + 0xa0], rax
cmp r13d, r10d
jl 0x1400b53ea
xor eax, eax
movsxd rcx, r15d
lea r8, [0x1400ed7c8]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x60]
mov qword [rsp + 0x40], rcx
mov r9d, esi
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], r10d
mov rdx, r14
mov ecx, r10d
mov dword [rsp + 0x20], esi
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov edx, 0x14
mov r8d, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rdx, [0x1400edd8c]
lea rcx, str.help
mov r8d, r15d
call qword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r9d, dword [rsp + 0x64]
imul ebx, esi
xor edx, edx
sub ebx, 8
lea r8, str.queen
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rdx
imul ecx, ebx, 7
movsxd rax, ecx
lea rdx, [0x1400edd8c]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x38], r9d
mov dword [rsp + 0x30], ecx
mov ecx, r13d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExA]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
mov esi, dword [rsp + 0x78]
mov r9, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0x88]
mov r10d, dword [rsp + 0x64]
mov rdx, rbp
nop dword [rax]
inc rdx
cmp byte [r12 + rdx], 0
jne 0x1400b53f0
mov r12, qword [rsp + 0x90]
mov r8d, edi
mov ecx, r12d
imul r8d, ebx
lea eax, [r8 + r9]
imul ecx, r13d
lea eax, [rax + r9*8]
lea r11d, [rcx*4 + 2]
add r11d, eax
add r11d, edx
add r11d, r15d
add r11d, esi
nop dword [rax]
inc rbp
cmp byte [r14 + rbp], 0
jne 0x1400b5430
mov r14, qword [rsp + 0x80]
mov eax, dword [rsp + 0xd8]
imul r10d, r12d
lea ecx, [r9 - 1]
imul r12d, r13d
imul eax, r15d
imul ecx, r14d
sub ecx, eax
sub ecx, r10d
mov r10, qword [rsp + 0x70]
lea eax, [rcx + r11*4]
mov r11, qword [rsp + 0x68]
sub eax, r11d
sub eax, edx
sub eax, r10d
sub eax, r13d
add eax, 0xfffffed1
add eax, r8d
add eax, ebp
add eax, dword [rsp + 0x60]
add eax, esi
mov dword [rsp + 0x68], eax
mov eax, 0x9e
imul ebp, edx
sub eax, dword [rsp + 0x98]
add ebp, r12d
lea ecx, [rax*2]
add ecx, ebp
imul eax, r14d, 0xb
add ecx, eax
sub ecx, r11d
sub ecx, r15d
sub ecx, r10d
add ecx, edi
add ecx, ebx
add ecx, dword [rsp + 0x60]
add ecx, r9d
add ecx, dword [rsp + 0x7c]
add ecx, esi
mov dword [rsp + 0x6c], ecx
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x238
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret