Function at 0x140052340
Capabilities:
Copy file
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xf8
xor edx, edx
xor ecx, ecx
call fcn.1400d0eb0
xor ecx, ecx
mov edx, 0x284
lea r8d, [rcx + 0x16]
mov rbx, rax
mov qword [rbp + 0x6f], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov edx, 3
xor ecx, ecx
lea r8d, [rdx + 0x13]
mov rdi, rax
mov qword [rbp + 0x77], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, rdi
mov rdx, rax
mov qword [rbp + 0x67], rax
call fcn.1400a0720
xor ecx, ecx
mov edx, 0x25b
lea r8d, [rcx + 0xc]
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [rbp - 0x69], 0
mov rdi, rax
mov qword [rbp - 0x79], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rsi, str.c1ret
mov ecx, 0xffff
mov qword [rbp - 0x61], rax
mov qword [rbp - 0x59], rsi
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
xor ecx, ecx
lea r8d, [rcx + 1]
mov edx, 0x38e
mov qword [rbp - 0x49], rsi
mov dword [rbp - 0x51], eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rbp - 0x41], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor r8d, r8d
mov rdx, rbx
mov rcx, rbx
mov qword [rbp - 0x39], rax
call qword [sym.imp.KERNEL32.dll_CopyFileA]
lea r8, [rbp - 0x29]
lea rcx, [rbp - 0x69]
movaps xmm0, xmmword [rbp - 0x69]
movaps xmm1, xmmword [rbp - 0x59]
mov dword [rbp - 0x31], eax
mov rdx, rdi
movaps xmmword [rbp - 0x29], xmm0
movaps xmm0, xmmword [rbp - 0x49]
movaps xmmword [rbp - 0x19], xmm1
movaps xmm1, xmmword [rbp - 0x39]
movaps xmmword [rbp - 9], xmm0
movaps xmmword [rbp + 7], xmm1
call fcn.140084280
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x29], xmm0
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rbp - 0x19], xmm1
movups xmmword [rbp - 9], xmm0
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
mov r8, rax
mov qword [rsp + 0x38], rax
call fcn.140087e30
mov rcx, rax
mov qword [rsp + 0x50], rax
call fcn.1400d7960
mov rcx, rbx
mov qword [rbp + 0x7f], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
mov qword [rbp - 0x71], rax
xor ecx, ecx
mov edx, 0x35b
lea r8d, [rcx + 1]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, rbx
mov rdx, rax
mov r15, rax
mov qword [rsp + 0x40], rax
call fcn.1400b7d70
mov rsi, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rdx, rax
mov rbx, rax
call fcn.14008ee80
mov r14, rax
call fcn.1400cf420
call qword [sym.imp.USER32.dll_GetActiveWindow]
or rdi, 0xffffffffffffffff
mov r13, rax
mov rcx, rdi
nop
inc rcx
cmp byte [r14 + rcx], 0
jne 0x140052500
mov rax, rdi
nop dword [rax]
inc rax
cmp byte [rsi + rax], 0
jne 0x140052510
imul cl
movzx r12d, r15b
lea r9, str.toad
movzx ecx, al
movzx eax, bl
lea r8, str.c6ret
mov rdx, r13
imul cl
sub r12b, al
xor ecx, ecx
add r12b, 0xa
mov byte [rsp + 0x20], r12b
call fcn.1400a8eb0
mov r15, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rcx, rax
mov qword [rsp + 0x30], rax
call fcn.1400d6f50
mov qword [rsp + 0x48], rax
call fcn.140092f90
mov rcx, rdi
mov r8, rax
mov rax, qword [rbp + 0x6f]
inc rcx
cmp byte [rax + rcx], 0
jne 0x140052575
sub r13b, byte [rbp - 0x79]
movzx eax, byte [rbp + 0x67]
imul cl
movzx ecx, al
movzx eax, byte [rbp + 0x77]
imul cl
movzx ecx, al
movzx eax, byte [rbp + 0x7f]
imul byte [rbp - 0x71]
movzx edx, al
movzx eax, byte [rsp + 0x40]
imul dl
mov rdx, qword [rsp + 0x50]
add cl, al
movzx eax, r13b
shl al, 2
add r13b, al
movzx eax, dl
add cl, r13b
imul dl
add cl, al
mov rdx, rdi
inc rdx
cmp byte [r15 + rdx], 0
jne 0x1400525c3
movzx eax, byte [rsp + 0x30]
imul dl
sub cl, al
mov rax, rdi
sub cl, byte [rbp - 0x29]
sub cl, byte [rsp + 0x38]
add cl, byte [rsp + 0x48]
add cl, bl
add cl, r12b
nop dword [rax]
inc rax
cmp byte [rsi + rax], 0
jne 0x1400525f0
sub cl, al
mov rax, rdi
nop
inc rax
cmp byte [r8 + rax], 0
jne 0x140052600
add cl, al
mov rax, rdi
nop
inc rax
cmp byte [r14 + rax], 0
jne 0x140052610
add cl, al
mov rax, qword [rsp + 0x58]
cmp byte [rax + rdi + 1], 0
lea rdi, [rdi + 1]
jne 0x140052621
lea eax, [rdi + rcx]
add al, 0xd
add rsp, 0xf8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret