Function at 0x1400bea20
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1a0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x190], rax
movsxd r13, dword [rsp + 0x1f8]
mov qword [rsp + 0x38], rcx
mov ecx, 0xffff
mov rdi, r8
mov qword [rsp + 0x50], r8
mov rsi, rdx
mov dword [rsp + 0x48], r13d
mov qword [rsp + 0x58], rdx
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
mov ebp, esi
mov rdx, rsi
xor ecx, ecx
sub ebp, r13d
mov ebx, eax
add ebp, dword [rsp + 0x1f0]
add ebp, edi
mov edi, esi
imul edi, r13d
call qword [sym.imp.KERNEL32.dll_LoadResource]
lea r8, [0x140001b00]
mov r12, rax
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x28], rax
mov r9, r13
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r14, rax
mov qword [rsp + 0x60], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r15, rax
mov eax, esi
lea rcx, [rsp + 0x80]
mov edx, 0x104
imul eax, r13d
add eax, eax
mov dword [rsp + 0x30], eax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor ecx, ecx
lea r8d, [rcx + 9]
mov edx, 0x39b
mov rsi, rax
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, r15d
imul r13d, dword [rsp + 0x1f0]
mov edx, r13d
mov qword [rsp + 0x68], rax
imul ecx, r12d
sub edx, ecx
mov rcx, qword [rsp + 0x58]
lea r12d, [rdi*2 + 8]
add edx, ecx
add edx, esi
mov esi, ecx
add edx, dword [rsp + 0x30]
add r12d, edx
imul esi, r14d
mov r14, qword [rsp + 0x38]
imul esi, ebx
mov rbx, qword [rsp + 0x50]
sub esi, ebx
mov qword [r14], r15
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov r10d, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
mov qword [r14 + 8], rax
mov rax, qword [rsp + 0x70]
imul r10d, ebx
mov r11d, esi
lea edx, [rax + rax]
mov rax, qword [rsp + 0x40]
shl r11d, 5
mov r14d, r10d
mov r9d, ecx
imul eax, edi
sub r14d, r11d
imul r9d, dword [rsp + 0x30]
sub eax, r13d
mov r8, qword [rsp + 0x38]
sub eax, ecx
mov rcx, qword [rsp + 0x68]
sub eax, r15d
sub eax, r9d
add eax, 6
add eax, ecx
add eax, r12d
add eax, edx
add eax, r14d
add eax, ebx
mov dword [r8 + 0x10], eax
mov eax, ecx
mov rcx, qword [rsp + 0x40]
imul ebx, ebx, 0xe
imul eax, r12d
imul ecx, ebp
mov rbp, qword [rsp + 0x60]
sub ecx, eax
sub ecx, r13d
sub ecx, ebp
sub ecx, r15d
sub ecx, edx
mov edx, 0x272
lea eax, [r10 + rcx]
mov rcx, r8
add eax, 4
add eax, ebx
add eax, r9d
add eax, r11d
mov dword [rcx + 0x14], eax
xor ecx, ecx
lea r8d, [rcx + 9]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, qword [rsp + 0x38]
mov edx, 0x2a1
mov qword [rcx + 0x18], rax
mov rax, qword [rsp + 0x50]
mov qword [rcx + 0x20], rax
xor ecx, ecx
lea r8d, [rcx + 0x1b]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, qword [rsp + 0x38]
mov r10, qword [rsp + 0x70]
mov r9, qword [rsp + 0x68]
mov qword [rcx + 0x28], rax
inc esi
lea edx, [r15 + rsi*4]
mov rsi, qword [rsp + 0x50]
mov eax, ebp
imul eax, dword [rsp + 0x30]
lea r8d, [rdi + rdi]
imul ecx, eax, 7
add ecx, esi
lea eax, [rcx + rdx*2]
mov ecx, 4
add eax, eax
sub r13d, eax
mov rax, qword [rsp + 0x40]
sub r13d, r10d
sub ecx, eax
sub r13d, eax
mov eax, 3
add r13d, dword [rsp + 0x58]
sub eax, r12d
imul ecx, ebp
add r13d, r9d
lea edx, [rcx + rax*4]
sub edx, ebx
add r13d, ebp
sub edx, r8d
add r13d, r12d
sub edx, dword [rsp + 0x1f0]
lea r13d, [r13 + rdi*2]
mov rdi, qword [rsp + 0x38]
add edx, dword [rsp + 0x48]
add r13d, esi
add edx, r9d
mov dword [rdi + 0x30], r13d
add edx, r10d
add edx, r14d
add edx, dword [rsp + 0x30]
lea rax, [0x1400ed4fc]
mov qword [rdi + 0x38], rax
mov dword [rdi + 0x34], edx
mov rax, rdi
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret