Function at 0x14009bfd0
Capabilities:
Copy file
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov rsi, rcx
mov ecx, edx
mov r15, r9
mov rbp, r8
mov r12d, edx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor ecx, ecx
mov edx, 0x355
mov qword [rsp + 0x30], rax
lea r8d, [rcx + 0x14]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
or rbx, 0xffffffffffffffff
mov r14, rax
mov qword [rsp + 0x40], rax
mov rdi, rbx
inc rdi
cmp byte [rsi + rdi], 0
jne 0x14009c022
mov r13, qword [rsp + 0xd0]
imul edi, ebp
add edi, r13d
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0x58], rax
cmp edi, r12d
jne 0x14009c095
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rcx, [0x1400ed4d4]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rdx, [0x1400ed4d4]
mov r8d, 0x10
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
mov edx, 0x132
lea r8d, [rcx + 0xd]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rbp, rbx
mov qword [rsp + 0x48], rax
nop
inc rbp
cmp byte [rsi + rbp], 0
jne 0x14009c0b0
imul ebp, r13d
mov eax, r14d
imul eax, edi
shl eax, 4
sub ebp, eax
sub ebp, dword [rsp + 0xd8]
add ebp, 7
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea r8, [0x140001b00]
mov qword [rsp + 0xd0], rax
xor eax, eax
xor edx, edx
mov qword [rsp + 0x28], rax
lea r9d, [rax + 8]
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, str.c0ret
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, r14
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
xor ecx, ecx
mov edx, 0x2e2
lea r8d, [rcx + 6]
mov dword [rsp + 0xb8], eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0x38], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov r14, rbx
mov rdx, rax
mov qword [rsp + 0x60], rax
nop dword [rax]
inc r14
cmp byte [rsi + r14], 0
jne 0x14009c150
mov rax, rbx
nop dword [rax]
inc rax
cmp byte [r15 + rax], 0
jne 0x14009c160
add r14b, al
mov rax, qword [rsp + 0xe0]
movzx ecx, bpl
movzx eax, byte [rax]
mov r8d, r12d
imul byte [rsp + 0xd8]
sub cl, al
movzx eax, byte [rsp + 0x30]
sub cl, byte [rsp + 0x38]
add cl, dl
mov rdx, rsi
imul cl
lea rcx, [0x1400ed4d4]
sub al, byte [rsp + 0xd0]
sub al, byte [rsp + 0x40]
sub al, 0xa
add al, r12b
add al, byte [rsp + 0x48]
add al, r13b
add al, byte [rsp + 0xc0]
add r14b, al
call qword [sym.imp.KERNEL32.dll_CopyFileA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r10, qword [rsp + 0x30]
movzx ecx, r14b
mov r8, rbx
mov r9d, ecx
imul r9d, r10d
add r9d, 0xfffffffa
inc r8
cmp byte [rsi + r8], 0
jne 0x14009c1e3
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
imul r8d, r12d
neg eax
imul ecx, r10d
shl eax, 2
imul edx, dword [rsp + 0xd0]
sub eax, edx
lea edx, [rax*4 + 0x10]
lea eax, [rcx*4 + 1]
mov rcx, qword [rsp + 0x60]
imul eax, r10d
lea ecx, [rcx + rax*2]
mov rax, qword [rsp + 0x40]
add ecx, 2
add ecx, dword [rsp + 0x38]
imul eax, edi
imul ecx, r10d
sub edx, ecx
sub edx, eax
mov rax, qword [rsp + 0xe0]
add r8d, edx
add r8d, dword [rax + 0x18]
movsx rax, byte [rsp + 0xb8]
sub r8d, eax
sub r8d, dword [rsp + 0xd8]
add r8d, r9d
add r8d, dword [rsp + 0x48]
add r8d, ebp
add r8d, r13d
add r8d, dword [rsp + 0xc0]
nop dword [rax + rax]
inc rbx
cmp byte [r15 + rbx], 0
jne 0x14009c280
sub r8d, ebx
mov rbx, qword [rsp + 0xb0]
mov eax, r8d
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret