Function at 0x1400ce7b0
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2c0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov rbx, r8
mov r13d, edx
mov r15, rcx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov ebp, 4
mov r9d, ebp
mov edx, 0x2417
xor ecx, ecx
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
xor edx, edx
mov r8d, 0x8000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea rcx, [rsp + 0x170]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
or rdi, 0xffffffffffffffff
mov qword [rsp + 0xe8], rax
mov rax, rdi
inc rax
cmp byte [rbx + rax], 0
jne 0x1400ce842
movzx r12d, r15b
sub r12b, r13b
sub r12b, al
mov rax, rdi
nop dword [rax + rax]
inc rax
cmp byte [rbx + rax], 0
jne 0x1400ce860
movzx r14d, r15b
xor edx, edx
xor ecx, ecx
sub r14b, r13b
sub r14b, al
sub r14b, 2
mov byte [rsp + 0x60], r14b
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0xf8], rax
lea eax, [r15 + 8]
mov dword [rsp + 0x100], eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
movzx ecx, r12b
mov qword [rsp + 0xa0], rax
mov eax, r15d
mov esi, r15d
sub eax, ecx
add eax, 2
mov dword [rsp + 0x6c], eax
lea eax, [rcx*2 + 8]
sub esi, eax
add esi, r13d
mov dword [rsp + 0xe0], esi
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r9d, dword [rsp + 0x6c]
mov qword [rsp + 0x98], rax
xor eax, eax
lea r8, [0x140001b00]
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x80], rax
movsxd rax, esi
movzx r14d, r14b
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], r14d
mov dword [rsp + 0x30], r13d
lea r8, [0x1400ed4fc]
mov r9d, esi
mov rdx, rbx
mov ecx, r13d
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], esi
call qword [sym.imp.USER32.dll_CreateWindowExA]
xor ecx, ecx
mov edx, 0xbf
lea r8d, [rcx + 0x1c]
mov qword [rsp + 0xa8], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0x88], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rdx, rdi
lea r8d, [rax + rax*8]
mov qword [rsp + 0x90], rax
inc rdx
cmp byte [rbx + rdx], 0
jne 0x1400ce980
mov r9, qword [rsp + 0x98]
imul edx, r13d
lea eax, [r14*4]
mov r14, qword [rsp + 0xa8]
mov ecx, 1
add r9d, 6
sub ecx, eax
imul ecx, r15d
add edx, ecx
sub edx, r8d
sub edx, dword [rsp + 0x88]
add edx, r14d
add r9d, edx
mov dword [rsp + 0x68], r9d
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov r9, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x80]
mov r8, qword [rsp + 0xa0]
mov r10, rax
mov qword [rsp + 0xc8], rax
lea ecx, [r9 + r9*8]
mov eax, r15d
sub eax, ecx
movzx ecx, byte [rsp + 0x6c]
lea r11d, [r13 + 3]
sub eax, edx
inc cl
sub eax, r8d
sub eax, r14d
sub eax, esi
add r11d, eax
movzx eax, r15b
mov dword [rsp + 0x64], r11d
imul cl
movzx r14d, al
movzx eax, r10b
imul r11b
movzx ecx, al
add al, al
add cl, al
movzx eax, byte [rsp + 0xa8]
shl cl, 3
sub r14b, cl
imul r9b
add r14b, al
sub r14b, byte [rsp + 0x100]
sub r14b, r8b
sub r14b, byte [rsp + 0x98]
add r14b, 5
add r14b, dl
add r14b, byte [rsp + 0x60]
add r14b, r12b
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
mov qword [rsp + 0xc0], rax
mov rax, rdi
nop dword [rax]
inc rax
cmp byte [rbx + rax], 0
jne 0x1400cea80
movzx edx, r12b
imul eax, edx
lea edx, [rax + rax*2]
mov eax, dword [rsp + 0xf8]
sub edx, dword [rsp + 0x80]
lea eax, [rax*4]
add edx, ecx
mov ecx, dword [rsp + 0xa8]
sub ecx, eax
mov eax, dword [rsp + 0xc8]
imul ecx, dword [rsp + 0xa0]
imul eax, dword [rsp + 0x64]
lea edx, [rcx + rdx*2]
xor ecx, ecx
add edx, eax
lea eax, [r15 - 7]
sub edx, r13d
add eax, edx
mov rdx, qword [rsp + 0x88]
mov dword [rsp + 0x74], eax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x78], eax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r9d, dword [rsp + 0x78]
mov r10, qword [rsp + 0x80]
mov ecx, dword [rsp + 0x74]
movzx r8d, byte [rsp + 0x60]
mov dword [rsp + 0xb8], eax
imul eax, r9d
shl eax, 2
mov dword [rsp + 0x30], r9d
mov rdx, r10
sub ecx, eax
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x28], esi
lea r11d, [rax + rax*8]
add ecx, 2
mov eax, r13d
mov dword [rsp + 0x70], ecx
imul eax, r8d
mov r8, r10
imul ecx, dword [rsp + 0xc0], 0xf
sub ecx, r10d
add ecx, r15d
add ecx, dword [rsp + 0x64]
lea eax, [rax + rcx*2]
mov rcx, qword [rsp + 0x98]
sub eax, r11d
sub eax, esi
add eax, r9d
xor r9d, r9d
add eax, dword [rsp + 0x90]
mov dword [rsp + 0xb0], eax
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov dword [rsp + 0xbc], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0xb4], eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov r8, rax
mov qword [rsp + 0xf0], rax
test r14b, r14b
js 0x1400cef19
mov r11, qword [rsp + 0xc0]
mov rdx, rdi
mov r8d, r11d
imul r8d, dword [rsp + 0x74]
mov dword [rsp + 0xd0], r8d
inc rdx
cmp byte [rbx + rdx], 0
jne 0x1400cebd1
mov rcx, qword [rsp + 0x98]
mov rax, qword [rsp + 0x90]
mov r9, qword [rsp + 0xa0]
add eax, dword [rsp + 0x78]
mov r10d, dword [rsp + 0x70]
add edx, edx
add eax, eax
sub eax, ecx
lea ecx, [rax + rax*2]
mov eax, r9d
imul eax, esi
mov rsi, qword [rsp + 0x88]
sub ecx, eax
sub ecx, edx
lea eax, [rsi - 0x2d]
mov rdx, rdi
sub ecx, dword [rsp + 0xb0]
sub ecx, dword [rsp + 0x100]
add ecx, r8d
movsx r8d, r14b
add ecx, r10d
add ecx, dword [rsp + 0xc8]
add eax, ecx
mov dword [rsp + 0xd8], eax
imul r8d, r11d
mov dword [rsp + 0x88], r8d
inc rdx
cmp byte [rbx + rdx], 0
jne 0x1400cec50
mov rax, qword [rsp + 0xc8]
lea eax, [rax + rax*2]
sub ebp, eax
movzx eax, r12b
sub ebp, dword [rsp + 0x78]
lea eax, [rax*4 + 2]
imul eax, r15d
lea ecx, [rax + rbp*4]
mov eax, r11d
imul eax, dword [rsp + 0x80]
sub ecx, eax
sub ecx, dword [rsp + 0xb4]
sub ecx, r10d
sub ecx, r9d
sub ecx, esi
sub ecx, dword [rsp + 0x6c]
add ecx, r8d
add ecx, dword [rsp + 0x98]
sub ecx, edx
mov dword [rsp + 0x138], ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x170]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x170]
lea rcx, str.c5a1
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
xor ecx, ecx
mov edx, 0x34f
lea r8d, [rcx + 0xf]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, rdi
mov r8, rax
nop dword [rax]
inc rcx
cmp byte [rbx + rcx], 0
jne 0x1400ced00
mov rdx, qword [rsp + 0x80]
mov r11d, dword [rsp + 0x68]
mov r9, qword [rsp + 0xa0]
mov r10d, dword [rsp + 0xd8]
movzx eax, r15b
imul cl
movzx ebp, al
movzx ecx, r11b
sub cl, byte [rsp + 0x64]
movzx eax, cl
add al, al
add cl, al
movzx eax, r8b
add cl, cl
imul byte [rsp + 0x138]
sub cl, al
movzx eax, dl
add bpl, cl
imul r9b
add bpl, al
movzx eax, byte [rsp + 0xe8]
shl al, 3
sub bpl, al
sub bpl, r10b
sub bpl, sil
mov rsi, rdi
add bpl, 2
add bpl, r15b
add bpl, dl
add bpl, r14b
nop dword [rax]
inc rsi
cmp byte [rbx + rsi], 0
jne 0x1400ced80
mov rax, qword [rsp + 0xf0]
mov ecx, 2
sub ecx, eax
imul eax, r10d
imul ecx, r15d
shl eax, 5
sub ecx, eax
lea eax, [r9 + 1]
imul eax, edx
mov edx, 0x384
add ecx, eax
movsx rax, byte [rsp + 0xbc]
add ecx, eax
movzx eax, r12b
sub ecx, dword [rsp + 0xd0]
sub ecx, r13d
sub ecx, eax
lea eax, [r11 + r11*8]
sub ecx, dword [rsp + 0x70]
sub ecx, dword [rsp + 0xb8]
add ecx, eax
mov rax, qword [rsp + 0x90]
add ecx, dword [rsp + 0x88]
add eax, 0xfffffffb
add ecx, r8d
add eax, ecx
xor ecx, ecx
add esi, eax
lea r8d, [rcx + 6]
lea eax, [rsi + 1]
add al, bpl
mov byte [rsp + 0x61], al
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0xd0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov ecx, 0xffff
mov qword [rsp + 0xd8], rax
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
mov dword [rsp + 0x88], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, rdi
mov r8d, eax
nop dword [rax + rax]
inc rcx
cmp byte [rbx + rcx], 0
jne 0x1400cee50
movzx eax, byte [rsp + 0xe8]
mov edx, dword [rsp + 0x68]
lea r9, str.lentil
imul cl
movzx ecx, byte [rsp + 0x70]
add dl, dl
sub dl, al
add cl, cl
add cl, byte [rsp + 0x80]
add dl, dl
movzx eax, cl
add al, al
add cl, al
movzx eax, bpl
mov rbp, qword [rsp + 0x80]
sub dl, cl
lea ecx, [rbp - 1]
imul sil
sub dl, al
movzx eax, byte [rsp + 0xc0]
imul cl
lea rcx, [rsp + 0x110]
add dl, al
movzx eax, r15b
imul r13b
add dl, al
sub dl, byte [rsp + 0x74]
sub dl, byte [rsp + 0xd0]
add dl, 0xb
add dl, byte [rsp + 0xd8]
add dl, byte [rsp + 0xf8]
add dl, byte [rsp + 0x61]
add dl, byte [rsp + 0x90]
add dl, byte [rsp + 0xa8]
mov byte [rsp + 0x28], dl
mov dword [rsp + 0x20], r8d
movzx r8d, byte [rsp + 0x88]
lea rdx, str.c3a0
call fcn.1400da4a0
mov esi, dword [rsp + 0xe0]
mov r8, qword [rsp + 0xf0]
jmp 0x1400cef21
mov rbp, qword [rsp + 0x80]
inc rdi
cmp byte [rbx + rdi], 0
jne 0x1400cef21
movzx eax, r13b
imul dil
movzx ecx, al
movzx eax, r12b
imul cl
movzx ecx, al
movzx eax, r14b
imul byte [rsp + 0xc0]
movzx edx, al
shl al, 2
add dl, al
movzx eax, byte [rsp + 0x98]
sub dl, cl
mov ecx, dword [rsp + 0x68]
sub dl, byte [rsp + 0x74]
imul bpl
add dl, dl
sub dl, al
movzx eax, cl
add al, al
add cl, al
add dl, cl
movzx eax, dl
add al, al
add dl, al
movzx eax, byte [rsp + 0xb8]
imul byte [rsp + 0xb0]
movzx ecx, al
movzx eax, byte [rsp + 0x70]
imul cl
movzx ecx, al
mov al, 7
add cl, byte [rsp + 0xbc]
imul cl
sub dl, al
movzx eax, r8b
imul r8b
lea ecx, [rax + 1]
movzx eax, r15b
imul cl
add dl, al
mov rax, qword [rsp + 0xa0]
add al, 4
add al, al
add al, dl
sub al, sil
sub al, byte [rsp + 0xb4]
sub al, byte [rsp + 0x100]
sub al, byte [rsp + 0x6c]
sub al, byte [rsp + 0xa8]
add al, byte [rsp + 0x78]
add al, byte [rsp + 0x64]
add al, byte [rsp + 0xc8]
add al, byte [rsp + 0x90]
add al, bpl
add al, byte [rsp + 0x60]
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x318]
add rsp, 0x2c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret