Function at 0x14009a8a0
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
push rbx
push r15
sub rsp, 0x1d8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov rbx, r9
mov r15d, 4
sub r15d, r9d
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x30], r15d
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0x60], rax
cmp r15d, 4
jg 0x14009ab64
mov qword [rsp + 0x1f0], rbp
mov qword [rsp + 0x1f8], rsi
mov qword [rsp + 0x200], rdi
mov qword [rsp + 0x1d0], r12
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x1c8], r13
mov qword [rsp + 0x1c0], r14
lea r14d, [r15 + 4]
call qword [sym.imp.KERNEL32.dll_LoadResource]
lea r8, [0x140001b00]
xor edx, edx
mov r12, rax
xor eax, eax
xor ecx, ecx
mov qword [rsp + 0x28], rax
lea r9d, [rax + 4]
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
mov qword [rsp + 0x38], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8d, 0x140
mov rsi, rax
mov qword [rsp + 0x40], rax
call fcn.1400e27d0
lea rdx, [rsp + 0x70]
lea rcx, [0x1400ed4fc]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbp, rax
mov qword [rsp + 0x58], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov r13d, ebp
xor edx, edx
xor ecx, ecx
mov rdi, rax
mov qword [rsp + 0x50], rax
imul r13d, ebx
imul r13d, r12d
add r13d, r13d
sub r13d, r15d
add r13d, r14d
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, r15d
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, qword [rsp + 0x38]
mov r15, rax
movzx eax, cl
lea r8, [0x140001b00]
sub r14b, 0x1e
mov r9d, ebx
xor edx, edx
imul sil
movzx esi, al
movzx eax, cl
imul bl
movzx ecx, al
mov al, 0xfc
imul dil
movzx edi, al
xor eax, eax
sub dil, cl
mov qword [rsp + 0x28], rax
xor ecx, ecx
sub dil, bpl
mov dword [rsp + 0x20], eax
sub dil, sil
add dil, r14b
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor ecx, ecx
lea r8d, [rcx + 7]
mov edx, 0x2f1
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
movzx eax, byte [rsp + 0x50]
imul r14b
mov r8d, dword [rsp + 0x30]
movzx ecx, al
movzx eax, dil
lea edx, [r8 + 4]
sub sil, 0x5a
imul cl
movzx ebp, dl
sub bpl, al
mov eax, dword [rsp + 0x40]
sub bpl, r8b
add bpl, sil
movzx esi, dil
lea edi, [r8 - 0x18]
imul eax, dword [rsp + 0x58]
imul eax, r12d
mov r12, qword [rsp + 0x50]
add eax, r15d
imul ecx, esi, 0xfffffffb
imul eax, dword [rsp + 0x38]
sub ecx, eax
lea eax, [rbx + rbx*8]
add ecx, eax
lea eax, [rcx + r13*4]
lea rcx, str.observatory
sub eax, r12d
add eax, edx
add edi, eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, qword [rsp + 0x48]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, qword [rsp + 0x40]
lea eax, [r15 + 1]
imul r12d, esi
imul eax, dword [rsp + 0x38]
mov r15d, dword [rsp + 0x30]
imul ecx, dword [rsp + 0x58]
imul ecx, r13d
add ecx, ebx
add ecx, ecx
sub ecx, r14d
lea ebx, [rax + rcx*2]
movzx eax, bpl
sub ebx, r12d
imul edx, eax, 0x2d
add ebx, edx
sub ebx, edi
sub ebx, r15d
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea ecx, [rbx - 0x26]
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea ecx, [rbx - 0x26]
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x70]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov rbx, qword [rsp + 0x48]
mov r14, qword [rsp + 0x1c0]
mov r13, qword [rsp + 0x1c8]
mov r12, qword [rsp + 0x1d0]
mov rdi, qword [rsp + 0x200]
mov rsi, qword [rsp + 0x1f8]
mov rbp, qword [rsp + 0x1f0]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
movzx ecx, bl
shl cl, 2
movsxd r8, eax
lea eax, [r15 + 2]
add bl, cl
movzx ecx, r8b
sub cl, bl
sub cl, byte [rsp + 0x60]
sub cl, 7
movsx rcx, cl
imul edx, ecx, 0x4d
lea ecx, [rax + rax*2]
sub edx, ecx
movsx rcx, r8b
lea eax, [rdx + r15*2]
sub eax, ecx
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x1d8
pop r15
pop rbx
ret