Function at 0x140098530
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2c0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov r15, rcx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x1a0]
mov edx, 0x104
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov r13, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea ecx, [rbx*8]
mov esi, r15d
mov r12d, eax
sub esi, ecx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
or edi, 0xffffffff
sub edi, esi
sub edi, r12d
test r12d, r12d
jne 0x140098625
lea rcx, [rsp + 0x60]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea r8d, [r12 + 6]
mov edx, 0x3c7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea r8d, [r12 + 6]
mov edx, 0x1b1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov eax, r15d
lea ebx, [rsi - 0x22]
sub eax, ebp
sub eax, r13d
add ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x60]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor eax, eax
lea r8, [0x140001b00]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
movzx r14d, ax
movzx eax, bl
imul r14b
movzx ebp, al
shl bpl, 2
cmp r14d, 0x20
jbe 0x140098754
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x60]
lea rcx, str.c1a0
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ecx, r14d
xor r14d, r14d
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], esi
lea r8, str.virgo
lea rdx, str.virgo
movzx r9d, bpl
xor ecx, ecx
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, str.virgo
mov rdx, rax
movzx eax, bpl
imul dil
movzx edi, al
movzx eax, r13b
imul r15b
add al, 0x25
add dil, al
add dil, sil
add dil, dl
add dil, bl
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
lea ecx, [r14 + 0x20]
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r8, [0x140001b00]
movsx r9, dil
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea r8d, [r14 + 0x1b]
mov edx, 0x2d0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rax, str.c9a0
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret