Function at 0x140065350
Capabilities:
Copy file
Create thread
Extract resource via kernel32 functions
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4a0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x490], rax
mov r15, qword [rsp + 0x500]
imul r14d, edx, 7
mov r12d, r8d
mov dword [rsp + 0x38], r8d
mov rbp, rdx
mov qword [rsp + 0xd8], rdx
mov qword [rsp + 0xe0], r15
mov qword [rsp + 0x88], rcx
mov dword [rsp + 0xb8], r14d
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbx, rax
mov qword [rsp + 0x48], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, r15d
mov esi, ebp
mov rdi, rax
sub ecx, ebx
mov qword [rsp + 0x98], rax
imul esi, r12d
sub ecx, r14d
lea r13d, [rsi - 9]
add r13d, ecx
lea rcx, str.ashtray
mov dword [rsp + 0x34], r13d
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, rbp
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, edi
mov edx, 0x15b
mov r12d, eax
imul ecx, r13d
sub ebx, ecx
xor ecx, ecx
sub ebx, eax
lea r8d, [rcx + 0x14]
add ebx, 2
mov dword [rsp + 0x6c], ebx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
lea r8d, [rcx + 0x15]
mov edx, 0x2f0
mov qword [rsp + 0x80], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r13, rax
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
mov dword [rsp + 0x3c], eax
xor eax, eax
lea r8, [0x140001b00]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
sub r13b, 4
mov qword [rsp + 0xa8], rax
movzx eax, bl
imul r12b
movzx ecx, al
mov al, 0xf9
add cl, cl
imul r15b
movzx ebx, al
sub bl, cl
sub bl, dil
add bl, byte [rsp + 0x38]
add bl, bpl
add bl, r13b
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0x60], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x270]
mov edx, 0x104
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
movsxd r9, dword [rsp + 0x34]
movzx edi, ax
xor eax, eax
lea r8, [0x140001b00]
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
mov edx, 0x30f
lea r8d, [rcx + 0xc]
mov qword [rsp + 0x108], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov eax, dword [rsp + 0x80]
mov ecx, r15d
movzx r13d, bl
xor edx, edx
mov r8d, 0x140
imul eax, dword [rsp + 0x3c]
sub ecx, eax
lea eax, [rbp - 4]
mov dword [rsp + 0x68], r13d
sub ecx, r13d
sub ecx, dword [rsp + 0x58]
sub ecx, dword [rsp + 0x48]
add eax, ecx
lea rcx, [rsp + 0x130]
mov dword [rsp + 0xb4], eax
call fcn.1400e27d0
lea rdx, [rsp + 0x130]
lea rcx, [0x1400ed4fc]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea rcx, [0x1400ed4fc]
mov qword [rsp + 0x128], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, qword [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
movsxd r9, dword [rsp + 0x3c]
mov ecx, r15d
imul ecx, dword [rsp + 0x48]
mov dword [rsp + 0xb0], ecx
mov qword [rsp + 0x78], rax
mov edx, r13d
movzx r8d, bl
imul edx, dword [rsp + 0xa8]
sub ecx, edx
mov dword [rsp + 0xe8], edx
lea rdx, [0x1400ed4fc]
sub ecx, eax
mov eax, dword [rsp + 0x34]
add ecx, r15d
add eax, 0xfffffff0
add ecx, esi
add ecx, dword [rsp + 0x60]
add ecx, dword [rsp + 0x70]
add eax, ecx
xor ecx, ecx
mov dword [rsp + 0x40], eax
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
mov r10, qword [rsp + 0x70]
mov r8, qword [rsp + 0x48]
mov r9, qword [rsp + 0x98]
mov ecx, r10d
imul ecx, dword [rsp + 0x3c]
mov edx, 1
add edi, 0xfffffffc
sub edx, ecx
mov ecx, r13d
mov r13, qword [rsp + 0x50]
imul ecx, dword [rsp + 0x58]
imul edx, r15d
imul ecx, r8d
add edx, ecx
lea ecx, [r13*4]
sub edx, dword [rsp + 0x38]
sub edx, r9d
sub edx, dword [rsp + 0x80]
sub edx, r12d
add edx, ebp
add edx, ecx
add edi, edx
mov ecx, dword [rsp + 0x60]
movzx eax, al
mov edx, 0x27f
mov dword [rsp + 0xa0], eax
mov dword [rsp + 0x44], edi
imul r13d, eax, 0x64
imul ecx, dword [rsp + 0xa8]
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0xec], r13d
imul eax, dword [rsp + 0x40]
sub ecx, eax
lea eax, [rcx + r8*8]
mov ecx, 0x2e
sub eax, r13d
lea r13d, [rsi + rax]
mov rsi, qword [rsp + 0x58]
mov eax, r15d
imul eax, r9d
sub ecx, eax
mov eax, dword [rsp + 0xa8]
add r13d, 0xb
add r13d, dword [rsp + 0x128]
imul eax, r10d
add r13d, edi
imul eax, r8d
mov r8, qword [rsp + 0x50]
lea ecx, [rax + rcx*2]
mov eax, dword [rsp + 0x60]
imul eax, esi
sub ecx, eax
lea eax, [r8*4]
sub ecx, dword [rsp + 0x6c]
sub ecx, edi
sub ecx, r12d
add ecx, ebp
add ecx, dword [rsp + 0x38]
add ecx, eax
add ecx, dword [rsp + 0x40]
mov dword [rsp + 0x90], ecx
xor ecx, ecx
lea r8d, [rcx + 0x17]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, r15d
mov rdx, rax
mov qword [rsp + 0xc0], rax
mov eax, dword [rsp + 0xb0]
sub eax, dword [rsp + 0x38]
sub eax, edi
movzx edi, bl
mov ebx, dword [rsp + 0xa0]
sub eax, esi
lea r8d, [rbx + rbx*4]
imul ecx, edi
imul ecx, dword [rsp + 0x50]
add eax, 0x16
add r8d, r8d
add eax, edi
imul ecx, esi
mov dword [rsp + 0xa4], r8d
imul ecx, dword [rsp + 0x3c]
add eax, ebp
add eax, r13d
mov dword [rsp + 0xc8], eax
or eax, 0xffffffff
sub eax, r13d
lea r15d, [rax + rax*4]
sub r15d, ecx
add r15d, ebp
add r15d, r8d
add r15d, dword [rsp + 0x70]
add r15d, dword [rsp + 0x48]
add r15d, dword [rsp + 0x34]
lea esi, [r15 + 4]
add sil, dl
mov byte [rsp + 0x30], sil
cmp dword [rsp + 0x40], r13d
jb 0x14006578f
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
mov edx, 0x34f
lea r8d, [rcx + 8]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea ecx, [rdi*4]
movzx edx, sil
imul ebx, dword [rsp + 0x44]
mov rsi, qword [rsp + 0xe0]
lea r9d, [r13*8]
movzx edi, al
add r9d, r13d
mov r8d, esi
mov qword [rsp + 0xf0], rax
sub r8d, ecx
lea ecx, [rdx + 6]
sub r8d, ebx
sub r8d, r9d
sub r8d, dword [rsp + 0xc0]
sub r8d, dword [rsp + 0x78]
sub r8d, dword [rsp + 0x40]
sub r8d, r12d
sub r8d, r14d
add r8d, ebp
add ecx, r8d
sub dil, cl
mov dword [rsp + 0xd4], ecx
cmp r12d, r15d
jl 0x140065840
lea rcx, [rsp + 0x380]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea rdx, [0x1400ed4fc]
lea rcx, str.c5ret
mov r8d, r14d
call qword [sym.imp.KERNEL32.dll_CopyFileA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov r14, qword [rsp + 0x88]
lea rax, str.mambo
lea r8, [0x140001b00]
mov qword [r14], rax
xor eax, eax
movsxd r9, r13d
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
movzx ecx, byte [rsp + 0x30]
mov r8, qword [rsp + 0x48]
mov r9d, dword [rsp + 0xf0]
mov r10, qword [rsp + 0x50]
imul r9d, ecx
mov ebp, dword [rsp + 0x70]
mov r11d, dword [rsp + 0xa8]
mov qword [r14 + 8], rax
imul ebp, dword [rsp + 0x3c]
movzx r14d, dil
lea edi, [r8 + r8]
imul r11d, r8d
lea eax, [r14 + r14]
lea edx, [r12 + r12]
sub eax, dword [rsp + 0x6c]
lea ecx, [rax*8 + 0x18]
mov eax, r15d
imul eax, r9d
sub ecx, eax
lea eax, [r10*4]
imul eax, dword [rsp + 0x60]
imul eax, dword [rsp + 0x58]
add ecx, eax
mov eax, edx
imul eax, dword [rsp + 0x34]
add ecx, eax
mov eax, edi
imul eax, r8d
mov r8d, dword [rsp + 0x90]
add ecx, eax
mov eax, dword [rsp + 0x78]
imul eax, dword [rsp + 0xb4]
add ecx, eax
imul eax, dword [rsp + 0xc0], 7
sub ecx, eax
lea eax, [r13*8]
sub ecx, dword [rsp + 0x68]
add eax, r13d
sub ecx, dword [rsp + 0x38]
sub ecx, eax
mov rax, qword [rsp + 0x88]
sub ecx, ebp
sub ecx, r8d
lea r8d, [r8*4]
sub ecx, dword [rsp + 0x40]
sub ecx, r11d
add ecx, ebx
lea ebx, [r15 + r15*4]
add ecx, esi
mov esi, dword [rsp + 0xb8]
add ecx, dword [rsp + 0xd8]
add esi, esi
add ecx, dword [rsp + 0x98]
mov dword [rax + 0x10], ecx
mov eax, dword [rsp + 0x68]
mov ecx, dword [rsp + 0xb0]
imul eax, dword [rsp + 0x60]
imul ecx, dword [rsp + 0x3c]
imul eax, dword [rsp + 0xa8]
sub ecx, eax
mov eax, dword [rsp + 0xd4]
imul eax, r14d
sub ecx, eax
mov rax, qword [rsp + 0x48]
add eax, 0xffffffa7
lea eax, [rcx + rax*2]
mov rcx, qword [rsp + 0xe0]
sub eax, ecx
sub eax, dword [rsp + 0x108]
sub eax, dword [rsp + 0xc0]
sub eax, esi
sub eax, r13d
sub eax, r10d
sub eax, dword [rsp + 0x80]
add eax, edx
mov rdx, qword [rsp + 0x98]
add eax, r8d
add eax, dword [rsp + 0xd8]
add eax, dword [rsp + 0x38]
add eax, dword [rsp + 0xec]
add eax, ebx
add eax, r9d
mov r9, qword [rsp + 0x88]
add eax, edx
add eax, dword [rsp + 0x44]
add eax, dword [rsp + 0x78]
add eax, dword [rsp + 0x70]
add eax, dword [rsp + 0x40]
add eax, dword [rsp + 0x58]
add eax, dword [rsp + 0x34]
mov dword [r9 + 0x14], eax
mov r9d, ecx
mov eax, r10d
imul eax, dword [rsp + 0x60]
imul r9d, r11d
mov r11, qword [rsp + 0xc0]
imul eax, dword [rsp + 0x58]
lea eax, [rax + rbx*2]
add eax, eax
sub ecx, eax
mov eax, edx
imul eax, dword [rsp + 0x34]
lea edx, [rax + rcx*4]
mov rcx, qword [rsp + 0x88]
mov eax, r9d
imul eax, dword [rsp + 0x3c]
add edx, edx
sub edx, eax
mov eax, dword [rsp + 0xa4]
imul eax, dword [rsp + 0x44]
add edx, eax
imul eax, r13d, 0x2d
add edx, eax
movzx eax, byte [rsp + 0x30]
sub edx, r11d
add eax, 0x17
sub edx, dword [rsp + 0x48]
add edx, r8d
mov r8, qword [rsp + 0xd8]
add edx, edi
mov rdi, qword [rsp + 0xf0]
add edx, dword [rsp + 0x68]
add edx, r8d
add edx, dword [rsp + 0x38]
add edx, edi
add edx, dword [rsp + 0x78]
add edx, dword [rsp + 0x80]
add edx, r14d
add edx, r12d
add eax, edx
mov dword [rcx + 0x18], eax
mov eax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x58]
lea edx, [rax + rax*8]
imul eax, r11d, 7
mov r11, qword [rsp + 0xe0]
add ecx, eax
mov eax, dword [rsp + 0x6c]
inc eax
lea eax, [rcx + rax*8]
mov ecx, r11d
shl eax, 2
sub ecx, eax
mov eax, dword [rsp + 0xc8]
imul eax, ebx
sub ecx, eax
sub ecx, dword [rsp + 0x68]
sub ecx, dword [rsp + 0x38]
sub ecx, dword [rsp + 0xa4]
sub ecx, dword [rsp + 0x108]
sub ecx, edx
movzx ebx, byte [rsp + 0x30]
sub ecx, edi
imul edi, dword [rsp + 0xd4]
sub ecx, dword [rsp + 0xd4]
sub ecx, dword [rsp + 0x98]
sub ecx, dword [rsp + 0x60]
sub ecx, dword [rsp + 0x80]
sub ecx, r12d
sub ecx, dword [rsp + 0xb8]
add ecx, r8d
add ecx, r9d
mov r9d, ebx
add ecx, dword [rsp + 0x90]
add ecx, r13d
add ecx, r10d
imul r15d, r9d
mov r9, qword [rsp + 0x98]
add ecx, dword [rsp + 0x44]
lea eax, [r15 + r15*4]
add ecx, dword [rsp + 0x78]
add ecx, r14d
add ecx, dword [rsp + 0x34]
add ecx, ebx
mov rbx, qword [rsp + 0x88]
mov dword [rbx + 0x1c], ecx
mov rcx, qword [rsp + 0xc0]
imul ecx, dword [rsp + 0x90]
imul ecx, r13d
lea ecx, [rcx + rax*4]
mov rax, qword [rsp + 0x48]
imul r9d, eax
dec r9d
imul r9d, eax
lea eax, [r9 + rcx*4]
mov ecx, dword [rsp + 0x34]
sub eax, edi
add ecx, 6
sub eax, dword [rsp + 0xa0]
sub eax, dword [rsp + 0x38]
sub eax, edx
sub eax, esi
sub eax, dword [rsp + 0x44]
sub eax, r14d
add eax, dword [rsp + 0xe8]
add eax, r11d
add eax, r8d
add eax, ebp
add eax, r10d
add eax, dword [rsp + 0x60]
add eax, dword [rsp + 0xb4]
add eax, dword [rsp + 0x58]
add eax, r12d
add eax, ecx
mov dword [rbx + 0x20], eax
lea rax, str.c0a2
mov qword [rbx + 0x28], rax
xor eax, eax
mov qword [rbx + 0x30], rax
mov rax, rbx
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x4e0]
add rsp, 0x4a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret