Function at 0x14009ea00
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2b8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov rax, qword [rsp + 0x328]
mov r13, qword [rsp + 0x320]
mov r14, rcx
mov rcx, r8
mov r15, r9
mov rbp, r8
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x60], rax
mov rsi, rdx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, r13
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
xor ecx, ecx
mov edx, 0x35b
lea r8d, [rcx + 3]
mov r12, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
or rbx, 0xffffffffffffffff
mov rdi, rbx
nop word [rax + rax]
inc rdi
cmp byte [r14 + rdi], 0
jne 0x14009ea90
mov rax, rbx
nop dword [rax]
inc rax
cmp byte [rsi + rax], 0
jne 0x14009eaa0
sub edi, eax
mov rax, rbx
nop
inc rax
cmp byte [rax + rbp], 0
jne 0x14009eab0
sub edi, eax
mov rax, rbx
nop
inc rax
cmp byte [r15 + rax], 0
jne 0x14009eac0
sub edi, eax
mov rax, rbx
nop
inc rax
cmp byte [rsi + rax], 0
jne 0x14009ead0
lea ecx, [r12 + r13]
sub ecx, eax
mov rax, rbx
inc rax
cmp byte [r14 + rax], 0
jne 0x14009eae2
lea esi, [rcx - 5]
add esi, eax
mov rax, rbx
inc rax
cmp byte [rax + rbp], 0
jne 0x14009eaf4
lea rcx, [rsp + 0x80]
mov edx, 0x104
add esi, eax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov r13, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0x78], rax
cmp edi, esi
jle 0x14009eb2a
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rdx, rbx
sub r12d, eax
sub r12d, 0xf
inc rdx
cmp byte [r15 + rdx], 0
jne 0x14009eb43
lea eax, [r12 + 1]
mov esi, edi
neg esi
lea ecx, [rax + rax*2]
mov rax, rbx
shl esi, 4
shl ecx, 2
sub esi, ecx
sub esi, dword [rsp + 0x78]
sub esi, r13d
sub esi, dword [rsp + 0x70]
add esi, dword [rsp + 0x60]
add esi, dword [rsp + 0x68]
sub esi, edx
nop dword [rax]
inc rax
cmp byte [r14 + rax], 0
jne 0x14009eb80
add esi, eax
nop dword [rax]
inc rbx
cmp byte [rbx + rbp], 0
jne 0x14009eb90
add esi, ebx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
movzx ebp, al
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbx, rax
imul ebx, ebp
add ebx, 3
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
xor r15d, r15d
cmp edi, r12d
jne 0x14009ec22
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x48], r15
movzx ecx, r14b
lea r8, str.lion
lea rdx, str.lion
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebp
mov r9d, esi
mov ecx, esi
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], edi
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea rcx, [rsp + 0x190]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea r8, [0x140001b00]
movsxd r9, esi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x2b8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret