Function at 0x1400be240
Capabilities:
Copy file
Create thread

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r13
sub rsp, 0x1d0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov rdi, qword [rsp + 0x220]
mov rbp, r9
mov rbx, r8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor ecx, ecx
mov r13d, 0x15
mov esi, eax
mov dword [rsp + 0x60], eax
mov eax, edi
lea r8d, [rcx + 4]
mov edx, 0x121
imul eax, ebx
sub r13d, eax
sub r13d, esi
call qword [sym.imp.KERNEL32.dll_FindResourceA]
sub r13d, eax
mov qword [rsp + 0x68], rax
add r13d, 7
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rbx, rax
cmp r13d, esi
jne 0x1400be478
xor ecx, ecx
mov qword [rsp + 0x200], r12
mov edx, 0x1dd
lea r8d, [rcx + 0xb]
mov qword [rsp + 0x1c8], r14
mov qword [rsp + 0x1c0], r15
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
movzx eax, dil
lea rdx, str.brush
lea rcx, str.icebreaker
imul sil
sub bpl, al
sub bpl, bl
sub bpl, 0x2f
add bpl, r12b
movzx r14d, bpl
mov r8d, r14d
call qword [sym.imp.KERNEL32.dll_CopyFileA]
xor ecx, ecx
mov edx, 0x1f1
lea r8d, [rcx + 0x18]
movsxd rbx, eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x16a
lea r8d, [rcx + 8]
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
movsx rcx, bl
movsx edi, bl
xor ebx, ebx
lea r8, str.c6a3
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], esi
lea rdx, str.c3a0
mov r9d, esi
mov ecx, esi
mov dword [rsp + 0x28], edi
mov r15, rax
mov dword [rsp + 0x20], r13d
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea r8d, [rbx + 0x17]
mov edx, 0x199
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, 5
mov edx, 0x336
mov r8d, esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, dword [rsp + 0x60]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbx
movsxd rax, r13d
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], r14d
mov dword [rsp + 0x30], edi
lea r8, str.icebreaker
lea rdx, str.whole
mov r9d, ecx
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r14d
call qword [sym.imp.USER32.dll_CreateWindowExA]
sub sil, r13b
movzx eax, r12b
add sil, sil
imul bpl
add sil, al
sub sil, byte [rsp + 0x68]
add sil, r15b
xor edi, edi
mov qword [rsp + 0x28], rdi
movsx rbx, sil
lea r8, [0x140001b00]
mov r9, rbx
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
movsx ecx, sil
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r8, [0x140001b00]
mov r9, rbx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r15, qword [rsp + 0x1c0]
mov r14, qword [rsp + 0x1c8]
mov r12, qword [rsp + 0x200]
xor ecx, ecx
mov edx, 0x174
lea r8d, [rcx + 0xc]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x70]
lea rcx, [0x1400ee018]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x1d0
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret