Function at 0x1400847d0
Capabilities:
Copy file
Create thread
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x208
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
mov rax, qword [rsp + 0x280]
mov r14, qword [rsp + 0x270]
mov r15d, dword [rsp + 0x278]
mov rbx, rcx
mov r13d, r8d
mov dword [rsp + 0x68], r8d
movsx r12d, dl
lea rcx, [rsp + 0xb0]
xor edx, edx
mov r8d, 0x140
mov qword [rsp + 0x80], rax
mov ebp, r9d
mov dword [rsp + 0x64], r9d
call fcn.1400e27d0
lea rdx, [rsp + 0xb0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
or rdi, 0xffffffffffffffff
mov rdx, rax
mov qword [rsp + 0x88], rax
mov eax, r12d
mov dword [rsp + 0x78], eax
mov rsi, rdi
nop dword [rax]
inc rsi
cmp byte [rbx + rsi], 0
jne 0x140084870
imul eax, r13d
mov rcx, rdi
sub eax, r15d
add esi, eax
inc rcx
cmp byte [r14 + rcx], 0
jne 0x140084885
movzx eax, r15b
imul cl
movzx ecx, al
movzx eax, r13b
imul cl
movzx ecx, al
movzx eax, bpl
imul cl
mov rcx, rdi
movzx ebp, al
nop dword [rax]
inc rcx
cmp byte [rbx + rcx], 0
jne 0x1400848b0
add bpl, cl
mov rax, rdi
nop
inc rax
cmp byte [r14 + rax], 0
jne 0x1400848c0
imul eax, r15d
lea ecx, [rsi + rsi*4]
sub ecx, eax
movsx rax, r12b
sub ecx, eax
mov rax, rdi
sub ecx, dword [rsp + 0x80]
sub ecx, r13d
sub ecx, edx
nop dword [rax + rax]
inc rax
cmp byte [rbx + rax], 0
jne 0x1400848f0
lea r13d, [rcx + 0x1f]
xor ecx, ecx
mov edx, 0x23d
add r13d, eax
lea r8d, [rcx + 0x16]
mov dword [rsp + 0x60], r13d
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, 0xffff
mov qword [rsp + 0x90], rax
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
lea r8, [0x140001b00]
mov r12d, eax
mov dword [rsp + 0x6c], eax
xor eax, eax
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov r9d, r12d
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [rsp + 0x6c], 0x10
mov qword [rsp + 0x98], rax
jbe 0x1400849f8
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, dword [rsp + 0x68]
xor eax, eax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r15
movzx r9d, bpl
lea r8, str.aftershave
mov dword [rsp + 0x38], r9d
mov dword [rsp + 0x30], ecx
lea rdx, str.aftershave
mov ecx, r15d
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.USER32.dll_CreateWindowExA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [0x1400ee310]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
xor ecx, ecx
mov edx, 0x1a5
lea r8d, [rcx + 0xd]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor ecx, ecx
lea r8d, [rcx + 0x1b]
mov edx, 0xe5
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
cmp r15d, r13d
je 0x140084a37
mov r9d, dword [rsp + 0x64]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], r8
mov dword [rsp + 0x20], r8d
lea r8, [0x140001b00]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
mov edx, 0x397
lea r8d, [rcx + 0x16]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov edx, 0x16
xor ecx, ecx
lea r8d, [rdx + 7]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r13, rax
mov qword [rsp + 0xa0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor ecx, ecx
mov edx, 0x3ae
lea r8d, [rcx + 0xd]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, dword [rsp + 0x80]
mov r9d, dword [rsp + 0x78]
imul ecx, eax
sub r13d, ecx
xor ecx, ecx
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rcx
mov ecx, dword [rsp + 0x6c]
mov qword [rsp + 0x40], r12
movzx eax, bpl
mov dword [rsp + 0x38], ecx
mov ecx, dword [rsp + 0x60]
add r13d, 4
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], r9d
mov dword [rsp + 0x20], ecx
lea r8, [0x1400ee310]
lea rdx, [0x1400ee310]
mov ecx, eax
mov dword [rsp + 0x74], eax
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov r12, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rbp, rdi
inc rbp
cmp byte [rbx + rbp], 0
jne 0x140084ae2
mov rcx, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x88]
mov eax, dword [rsp + 0x98]
imul eax, ecx
shl eax, 4
mov ecx, edx
imul ecx, esi
sub ecx, eax
lea eax, [r15 + r15*2]
sub ecx, eax
lea eax, [rdx - 8]
sub ecx, dword [rsp + 0x68]
add eax, r12d
sub ecx, 4
mov dword [rsp + 0x70], eax
add ebp, ecx
call qword [sym.imp.USER32.dll_GetActiveWindow]
movsxd rcx, dword [rsp + 0x60]
mov eax, dword [rsp + 0x74]
mov r9d, dword [rsp + 0x64]
xor r8d, r8d
mov qword [rsp + 0x58], r8
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
mov ecx, dword [rsp + 0x68]
lea r8, str.hall
mov rdx, rbx
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea ecx, [rax*4]
mov edx, 0xffffffc9
mov rsi, rdi
sub edx, ecx
nop dword [rax]
inc rsi
cmp byte [rbx + rsi], 0
jne 0x140084b90
mov ecx, dword [rsp + 0x60]
mov r8, qword [rsp + 0x80]
mov r10, qword [rsp + 0x88]
add ecx, ecx
mov eax, r8d
imul eax, r15d
mov r15d, dword [rsp + 0x74]
lea eax, [rax + rax*2]
sub ecx, eax
imul ecx, r10d
sub ecx, r15d
sub ecx, edx
mov edx, dword [rsp + 0x70]
sub ecx, dword [rsp + 0xa8]
sub ecx, r13d
lea eax, [r12 + rcx]
mov rcx, rdi
add eax, 0xffffff2c
add eax, edx
add eax, ebp
add esi, eax
nop dword [rax]
inc rcx
cmp byte [r14 + rcx], 0
jne 0x140084bf0
mov r9d, dword [rsp + 0x64]
inc ecx
mov eax, r12d
imul eax, edx
imul ecx, r8d
mov rdx, rdi
imul eax, r13d
sub ecx, eax
mov eax, dword [rsp + 0x78]
imul eax, r9d
add ecx, eax
lea eax, [r15 + r15*4]
lea r8d, [rcx + rax*2]
sub r8d, dword [rsp + 0xa0]
sub r8d, dword [rsp + 0x90]
inc rdx
cmp byte [rbx + rdx], 0
jne 0x140084c36
lea ebp, [r10 + 3]
lea rcx, str.hall
add ebp, r8d
mov r8d, r9d
add ebp, edx
lea rdx, str.c10a1
call qword [sym.imp.KERNEL32.dll_CopyFileA]
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
nop dword [rax + rax]
inc rdi
cmp byte [rbx + rdi], 0
jne 0x140084c70
mov rcx, qword [rsp + 0x90]
mov eax, dword [rsp + 0x6c]
mov ebx, dword [rsp + 0x68]
imul r12d, r13d
imul ebx, edi
add ecx, 3
shl r12d, 2
add eax, ecx
imul eax, dword [rsp + 0x88]
sub eax, r12d
add ebx, eax
imul eax, dword [rsp + 0x70], 0x4b
add ebx, eax
mov rax, qword [rsp + 0x98]
sub ebx, dword [rsp + 0x64]
sub ebx, ebp
sub ebx, dword [rsp + 0xa0]
sub ebx, dword [rsp + 0x60]
add ebx, r15d
add ebx, dword [rsp + 0x80]
add ebx, r14d
add ebx, esi
add ebx, eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea ecx, [rbx + 6]
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea ecx, [rbx + 6]
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0xb0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea rax, [0x1400ed3b4]
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x208
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret