Function at 0x14008a940
Capabilities:
Copy file
Create thread
Extract resource via kernel32 functions

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x348
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x330], rax
mov rbp, r8
mov qword [rsp + 0x70], r8
mov rsi, rdx
mov qword [rsp + 0x80], rdx
mov r13d, ecx
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
movzx r15d, ax
lea rcx, [rsp + 0x110]
mov edx, 0x104
mov dword [rsp + 0x60], r15d
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
mov edi, dword [rsi]
movzx eax, ax
mov dword [rsp + 0x64], eax
imul edi, ebp
add edi, 5
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x78], rax
lea eax, [rax + rax*4]
xor ecx, ecx
lea eax, [rax*2 + 5]
lea r8d, [rcx + 0x1a]
mov edx, 0x3d7
add eax, r15d
mov dword [rsp + 0x68], eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r12d, dword [rsi]
imul r12d, r13d
add r12d, ebp
cmp r13d, r12d
jae 0x14008acad
lea rcx, [rsp + 0x220]
mov edx, 0x104
mov qword [rsp + 0x398], rbx
mov qword [rsp + 0x340], r14
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
xor ecx, ecx
movzx ebx, ax
movsxd rax, r12d
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], r13d
movzx r14d, bl
mov dword [rsp + 0x30], r14d
lea r8, str.eight
lea rdx, str.eight
mov r9d, r15d
mov ecx, r12d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r14d
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov edx, dword [rsi + 8]
mov r8, rax
lea esi, [rdi + r13]
mov ecx, edx
lea eax, [rbp*2]
imul edx, ebp
imul ecx, r13d
sub ecx, eax
mov eax, 1
sub ecx, r8d
sub eax, r12d
sub r8b, 0x2d
sub eax, r15d
add esi, ecx
mov rcx, qword [rsp + 0x78]
lea r15d, [rax + rax*4]
movzx eax, cl
sub r15d, edx
shl al, 2
mov edx, 0x180
sub r15d, dword [rsp + 0x64]
lea edi, [rax + rcx]
shl dil, 4
add r15d, r13d
sub dil, bpl
sub dil, bl
mov ebx, r15d
add dil, r13b
add dil, r8b
movsx eax, dil
imul ebx, esi
sub ebx, eax
add ebx, ecx
xor ecx, ecx
lea r8d, [rcx + 0x10]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, str.hovercraft
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
lea rax, str.cultivar
xor ecx, ecx
mov qword [rsp + 0x88], rax
lea rax, str.anywhere
lea r8d, [rcx + 0xd]
mov edx, 0x317
mov qword [rsp + 0x90], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdx, qword [rsp + 0x70]
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x80]
mov eax, dword [rax + 0x10]
imul eax, r13d
lea ecx, [rax + rdx*2]
lea eax, [r12 + r12*8]
sub ecx, eax
movups xmm0, xmmword [rsp + 0x88]
lea eax, [rcx + rbp]
mov qword [rsp + 0x30], rdx
add eax, 0xffffffdd
mov qword [rsp + 0xa8], rdx
imul ecx, r14d, 7
add eax, esi
lea r9, [rsp + 0xd0]
lea r8, str.element
movaps xmmword [rsp + 0xd0], xmm0
mov dword [rsp + 0xa0], eax
lea eax, [rdx + rdx]
lea rdx, str.mustard
sub ecx, eax
movsx rax, dil
add ecx, eax
lea eax, [r13 - 0x2d]
sub ecx, ebx
mov rbx, qword [rsp + 0x78]
add eax, ecx
lea rcx, [rsp + 0x88]
mov dword [rsp + 0xa4], eax
lea rax, str.c2ret
mov qword [rsp + 0xb0], rax
lea rax, str.interview
movups xmm1, xmmword [rsp + 0x98]
movups xmm0, xmmword [rsp + 0xa8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
movaps xmmword [rsp + 0xe0], xmm1
movaps xmmword [rsp + 0xf0], xmm0
call fcn.1400dc730
movzx edx, bl
lea r8, [0x140001b00]
movups xmm0, xmmword [rax + 0x10]
movups xmm2, xmmword [rax]
movups xmm1, xmmword [rax + 0x20]
movaps xmmword [rsp + 0xe0], xmm0
movaps xmmword [rsp + 0xf0], xmm1
movups xmm0, xmmword [rax + 0x30]
psrldq xmm2, 8
movzx eax, byte [rsp + 0x60]
imul byte [rsp + 0x68]
movaps xmmword [rsp + 0x100], xmm0
shl al, 2
sub dl, al
mov al, 0x32
movzx ecx, dl
shl cl, 3
add dl, cl
imul bl
lea ecx, [rax - 2]
movzx eax, byte [rsp + 0x70]
imul cl
xor ecx, ecx
add dl, al
movq rax, xmm2
sub dl, r15b
sub dl, al
xor eax, eax
sub dl, bpl
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
sub dl, 9
add dl, r13b
movzx r9d, dl
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
mov edx, 0x151
lea r8d, [rcx + 0xf]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r14, qword [rsp + 0x340]
mov rbx, qword [rsp + 0x398]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
movzx ecx, al
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rdx, str.ticket
lea rcx, str.kazoo
mov r8d, r12d
call qword [sym.imp.KERNEL32.dll_CopyFileA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rax, str.dune_buggy
mov rcx, qword [rsp + 0x330]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x348
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret