Function at 0x140099150
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push r14
push r15
sub rsp, 0x180
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x170], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor r15d, r15d
lea ebx, [rax - 0x44]
mov rbp, rax
cmp bl, 8
jbe 0x1400991ef
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea r9d, [r15 + 4]
lea r8, [0x140001b00]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x60]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor r8d, r8d
mov edx, 0x1d8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r14, rax
cmp bl, 2
jae 0x1400993b7
mov qword [rsp + 0x1a0], rsi
movzx ecx, bpl
movzx esi, bl
add cl, cl
mov edx, 0x3c8
mov qword [rsp + 0x1a8], rdi
sub sil, cl
movzx ecx, bl
lea edi, [rax - 3]
lea ebx, [rcx + rcx*8]
xor ecx, ecx
shl sil, 2
lea r8d, [rcx + 0xe]
add sil, 0x11
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, str.c0a2
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
lea r8, [0x140001b00]
mov r9d, 4
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
lea r8d, [rcx + 0x15]
mov edx, 0x2c1
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x1aa
lea r8d, [rcx + 0x1c]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, 4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rcx, [rsp + 0x60]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov eax, 5
lea r8, [0x140001b00]
sub eax, ebp
mov r9d, 8
xor edx, edx
lea ebx, [rax + rax*2]
xor ecx, ecx
mov qword [rsp + 0x28], r15
add ebx, ebx
mov dword [rsp + 0x20], r15d
sub ebx, r14d
add ebx, edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
lea r8d, [rcx + 0x1d]
mov edx, 0x2cd
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x253
lea r8d, [rcx + 1]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
mov edx, 0x3e6
lea r8d, [rcx + 3]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x48], r15
movzx eax, sil
movzx ecx, sil
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ecx
mov r9d, 4
lea r8, str.c4a0
lea rdx, str.planter
lea ecx, [r9 - 2]
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 0x20
call qword [sym.imp.USER32.dll_CreateWindowExA]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdi, qword [rsp + 0x1a8]
mov rsi, qword [rsp + 0x1a0]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x1b0]
add rsp, 0x180
pop r15
pop r14
pop rbp
ret