Function at 0x1400971e0
Capabilities:
Copy file
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1b0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov qword [rsp + 0x38], r9
movsx r12d, r8b
movzx r15d, dl
mov esi, ecx
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea edi, [rsi + r12]
mov ecx, r12d
mov ebx, r12d
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x30], edi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r14d, dword [rsp + 0x218]
movsx r13d, byte [rsp + 0x210]
sub dil, r14b
mov qword [rsp + 0x58], rax
sub dil, r12b
mov ebp, r13d
sub dil, r15b
sub ebp, r14d
sub dil, r13b
add ebp, esi
sub dil, 0x16
add dil, sil
add dil, al
test r14d, r14d
je 0x140097298
mov edx, 1
xor ecx, ecx
lea r8d, [rdx + 7]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rdx, str.tugboat
lea rcx, str.tugboat
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileA]
xor ecx, ecx
mov edx, 0xad
lea r8d, [rcx + 0x19]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, pe_nt_image_headers64
lea r8d, [rcx + 0x19]
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
movzx edx, dil
mov qword [rsp + 0x40], rax
cmp esi, edx
jge 0x1400972e3
xor ecx, ecx
mov edx, 0x1c6
lea r8d, [rcx + 2]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
mov edx, 0x1cf
lea r8d, [rcx + 0x11]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x60]
lea rcx, str.c0a4
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
movzx eax, r15b
cmp esi, eax
je 0x1400973d2
lea r8d, [rsi + rbx]
lea rdx, str.intestine
lea rcx, str.pencil
call qword [sym.imp.KERNEL32.dll_CopyFileA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
xor ecx, ecx
lea r8d, [rcx + 5]
mov edx, 0x310
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
mov edx, 0x126
lea r8d, [rcx + 0xb]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x98
lea r8d, [rcx + 0xb]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
movsxd rbx, eax
movsx ecx, bl
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor ecx, ecx
mov edx, 0x244
lea r8d, [rcx + 2]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor eax, eax
lea r8, [0x140001b00]
mov qword [rsp + 0x28], rax
movsx r9, bl
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
movzx eax, byte [rsp + 0x58]
sub dil, 0x40
imul bpl
movzx ecx, al
mov al, 7
imul cl
movzx ecx, al
movzx eax, r13b
imul r14b
add cl, al
mov al, 0x2e
imul byte [rsp + 0x48]
add al, cl
sub al, byte [rsp + 0x38]
sub al, r15b
add al, byte [rsp + 0x30]
add al, sil
add al, r12b
add al, byte [rsp + 0x40]
add al, byte [rsp + 0x50]
add al, dil
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x1f8]
add rsp, 0x1b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret