Function at 0x140061240
Capabilities:
Copy file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x348
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x330], rax
movzx edi, byte [rsp + 0x3b0]
mov rsi, qword [rsp + 0x3b8]
movsxd r12, edx
mov rbp, r9
mov qword [rsp + 0x58], r9
mov rbx, r8
mov r13, rcx
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x50], rsi
mov r15d, edi
cmp r12d, edi
je 0x1400612d1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0xb0]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0xb0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov r14d, ebp
lea rcx, [rsp + 0xb0]
mov edx, 0x104
sub r14d, esi
add r14d, r13d
add r14d, r15d
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov qword [rsp + 0x68], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, r13
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
lea rdx, str.tooth
mov r8d, r14d
mov rcx, rbx
mov dword [rsp + 0x44], eax
call qword [sym.imp.KERNEL32.dll_CopyFileA]
mov edx, eax
mov dword [rsp + 0x48], eax
movzx eax, dil
imul bpl
or rsi, 0xffffffffffffffff
movzx r8d, al
mov byte [rsp + 0x40], al
mov rcx, rsi
inc rcx
cmp byte [rbx + rcx], 0
jne 0x140061343
movzx eax, r13b
mov rdi, rsi
imul cl
mov rcx, qword [rsp + 0x50]
movzx ebp, al
movzx eax, r14b
imul cl
add bpl, al
sub bpl, dl
sub bpl, byte [rsp + 0x58]
add bpl, 7
add bpl, r8b
inc rdi
cmp byte [rbx + rdi], 0
jne 0x140061375
mov eax, dword [rsp + 0x44]
imul edi, r13d
mov edx, 0x50
lea eax, [rax + rax*4]
lea r8d, [rdx - 0x4a]
sub edi, eax
sub edi, ecx
xor ecx, ecx
sub edi, r15d
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0xb0]
mov edx, 0x104
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov r13, rax
cmp dword [rsp + 0x44], r14d
jg 0x140061438
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
mov edx, 0x187
lea r8d, [rcx + 9]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x1f0]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x1f0]
lea rcx, str.c5a0
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
xor ecx, ecx
mov edx, 0x314
lea r8d, [rcx + 1]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
movsxd r9, dword [rsp + 0x44]
lea rdx, str.hard_hat
mov r8, r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
lea rcx, [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rdx, rsi
nop dword [rax]
inc rdx
cmp byte [rbx + rdx], 0
jne 0x140061450
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x60]
imul edx, r12d
inc eax
imul eax, dword [rsp + 0x58]
sub ecx, eax
sub ecx, edx
sub ecx, r15d
mov r15, qword [rsp + 0x50]
lea eax, [r15 - 0x12]
sub ecx, r14d
add eax, ecx
mov dword [rsp + 0x90], eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [rsp + 0x80], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rdx, rax
mov qword [rsp + 0x50], rax
cmp byte [rsp + 0x3b0], r14b
jae 0x140061500
xor ecx, ecx
mov edx, 0x161
lea r8d, [rcx + 9]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, dword [rsp + 0x44]
movzx eax, bpl
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], eax
xor r9d, r9d
mov rcx, r13
mov r8, r13
mov rdx, r13
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rdx, qword [rsp + 0x50]
nop
inc rsi
cmp byte [rbx + rsi], 0
jne 0x140061500
shl bpl, 2
movzx eax, r12b
sub bpl, r13b
add bpl, 0xe
imul sil
movzx ecx, al
add bpl, bpl
movzx eax, r14b
imul byte [rsp + 0x58]
sub bpl, al
sub bpl, cl
sub bpl, byte [rsp + 0x68]
sub bpl, byte [rsp + 0x44]
sub bpl, dil
sub bpl, r15b
sub bpl, dl
sub bpl, byte [rsp + 0x80]
sub bpl, byte [rsp + 0x40]
sub bpl, byte [rsp + 0x78]
add bpl, byte [rsp + 0x90]
add bpl, byte [rsp + 0x48]
add bpl, byte [rsp + 0x60]
add bpl, byte [rsp + 0x70]
movzx eax, bpl
mov rcx, qword [rsp + 0x330]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x348
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret