Function at 0x1400392d0
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x288]
sub rsp, 0x360
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x240], rax
mov dword [rbp - 0x80], 8
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor esi, esi
mov qword [rbp - 0x78], rax
lea rax, str.vein
mov dword [rbp - 0x68], 0x10
mov qword [rbp - 0x70], rax
lea rax, str.satire
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x60], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [rbp - 0x48], esi
movaps xmm0, xmmword [rbp - 0x80]
movaps xmm1, xmmword [rbp - 0x70]
mov qword [rbp - 0x50], rax
lea r8, [rbp + 0x40]
lea rcx, [rbp + 0xd0]
movaps xmmword [rbp + 0x40], xmm0
movaps xmm0, xmmword [rbp - 0x60]
movaps xmmword [rbp + 0x50], xmm1
xor edx, edx
movaps xmm1, xmmword [rbp - 0x50]
movaps xmmword [rbp + 0x60], xmm0
movaps xmmword [rbp + 0x70], xmm1
call fcn.140084280
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x40], xmm0
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rbp + 0x50], xmm1
movups xmm6, xmm0
movups xmmword [rbp + 0x60], xmm0
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
mov r9d, r15d
movzx r14d, ax
psrldq xmm6, 8
xor ecx, ecx
movd dword [rsp + 0x78], xmm6
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x28], rsi
movd dword [rsp + 0x20], xmm6
call fcn.14006b650
mov r13, rax
test r14d, r14d
jg 0x140039538
lea rcx, str.plant
lea ebx, [r15 + rax]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
lea rcx, [0x1400ed51c]
lea r8d, [rbx + 5]
mov qword [rsp + 0x28], rcx
lea rcx, str.c1a1
lea rdx, str.latency
mov r9, rax
mov qword [rsp + 0x20], rcx
call fcn.14008ba20
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
mov ecx, eax
lea r8, str.latency
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], r14d
lea rdx, str.c1a1
mov r9d, eax
mov ecx, eax
mov dword [rsp + 0x28], r14d
movd dword [rsp + 0x20], xmm6
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea r8d, [rsi + 0x19]
mov edx, 0x19e
xor ecx, ecx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rbp - 0x80], r12
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x78], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea r8d, [rsi + 9]
mov edx, 0x33b
xor ecx, ecx
mov qword [rbp - 0x68], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov dword [rbp - 0x58], 0x40
mov qword [rbp - 0x60], rax
call qword [sym.imp.KERNEL32.dll_LockResource]
lea rcx, [rbp + 0x100]
xor edx, edx
mov r8d, 0x140
mov dword [rbp - 0x54], eax
call fcn.1400e27d0
lea rdx, [rbp + 0x100]
lea rcx, str.c1a1
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rbp - 0x48], rsi
lea r9, [rbp - 0x20]
movaps xmm0, xmmword [rbp - 0x80]
movaps xmm1, xmmword [rbp - 0x70]
mov qword [rbp - 0x50], rax
lea rax, str.c2a5
lea rcx, [rbp - 0x80]
movaps xmmword [rbp - 0x20], xmm0
movaps xmm0, xmmword [rbp - 0x60]
movaps xmmword [rbp - 0x10], xmm1
mov r8, rbx
mov rdx, rdi
mov qword [rsp + 0x20], rax
movaps xmm1, xmmword [rbp - 0x50]
movaps xmmword [rbp], xmm0
movaps xmmword [rbp + 0x10], xmm1
call fcn.1400ab340
mov edi, 5
lea r8, str.page
lea rcx, str.whirlpool
sub edi, dword [rbp + 0x40]
mov r9d, r14d
mov edx, edi
mov dword [rsp + 0x68], edi
call fcn.140077850
movzx ecx, r15b
movzx ebx, al
shl cl, 2
movzx eax, r14b
lea esi, [rcx + r15]
mov ecx, dword [rbp + 0x60]
mov edx, ebx
imul dil
lea edi, [rsi + rax]
imul edx, r14d
mov dword [rsp + 0x64], ebx
imul ecx, r15d
lea eax, [rcx + rdx*4]
add dil, bl
sub eax, dword [rsp + 0x68]
neg dil
add eax, 9
mov dword [rsp + 0x74], eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov r9d, dword [rsp + 0x68]
xor ecx, ecx
lea r8, str.page
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x38], r14d
mov dword [rsp + 0x30], ecx
lea rdx, str.whirlpool
mov ecx, ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea r8, [0x140001b00]
mov qword [rbp + 0xb0], rax
xor eax, eax
mov r9d, ebx
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [rbp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
add sil, bl
neg sil
mov dword [rsp + 0x6c], eax
mov byte [rsp + 0x60], sil
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
lea rcx, [rbp + 0x100]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rbp + 0x100]
lea rcx, str.c1a1
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
mov edx, 0x1ec
lea r8d, [rcx + 0x12]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rbx, rax
mov qword [rbp + 0x38], rax
cmp dil, r14b
jae 0x1400396a6
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov r9, rbx
mov r8, r12
mov rdx, rax
mov rcx, r12
call fcn.1400d7200
lea rcx, str.cleric
call fcn.1400a2100
movzx edi, dil
mov esi, eax
cmp r14d, edi
je 0x140039885
call fcn.1400d9ee0
mov r10d, dword [rsp + 0x64]
lea r8, str.page
movsx r9d, al
xor eax, eax
lea rdx, str.cleric
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x38], r10d
mov dword [rsp + 0x30], r9d
mov r9d, edi
mov ecx, edi
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r14d
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov ecx, dword [rsp + 0x6c]
mov rbx, rax
shl ecx, 6
lea rax, str.c4a2
mov qword [rbp - 0x20], rax
mov eax, dword [rsp + 0x68]
lea edx, [rsi + rsi*2]
add edx, edx
add eax, 3
xor r8d, r8d
sub edx, ecx
xor ecx, ecx
add edx, edi
add edx, dword [rsp + 0x64]
add edx, r12d
add eax, edx
mov edx, 0x270
mov dword [rbp - 0x18], eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rbp - 8], r12
mov qword [rbp - 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor r12d, r12d
mov qword [rbp + 8], r13
mov qword [rbp + 0x10], r12
mov qword [rbp], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rbp + 0x20], r12
lea r8, [rbp - 0x80]
movaps xmm0, xmmword [rbp - 0x20]
movaps xmm1, xmmword [rbp - 0x10]
mov qword [rbp + 0x18], rax
lea rdx, str.c4a0
mov rcx, rbx
movaps xmmword [rbp - 0x80], xmm0
movaps xmm0, xmmword [rbp]
movaps xmmword [rbp - 0x70], xmm1
movaps xmm1, xmmword [rbp + 0x10]
movaps xmmword [rbp - 0x60], xmm0
movsd xmm0, qword [rbp + 0x20]
movsd qword [rbp - 0x40], xmm0
movaps xmmword [rbp - 0x50], xmm1
call fcn.140064c00
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
movzx eax, ax
mov dword [rsp + 0x7c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x70], eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rdx, qword [rbp + 0x50]
mov qword [rbp - 0x30], rax
or rcx, 0xffffffffffffffff
inc rcx
cmp byte [rdx + rcx], r12b
jne 0x1400397e4
movsx r12, byte [rsp + 0x60]
mov edx, dword [rsp + 0x78]
mov rbx, qword [rbp + 0x38]
imul edx, r15d
mov eax, r12d
lea r9, [rbp - 0x30]
imul eax, dword [rbp + 0x30]
imul eax, edi
imul eax, dword [rsp + 0x64]
shl eax, 6
sub eax, edx
mov edx, dword [rsp + 0x7c]
add eax, dword [rbp]
sub eax, ecx
mov ecx, dword [rbp + 0xb0]
add eax, 9
dec ecx
mov dword [rbp - 0x28], eax
lea eax, [rbx + rbx*2]
imul ecx, r14d
lea r8d, [rcx + rax*2]
lea eax, [r13 - 0x10]
lea rcx, str.c4a2
movaps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rbp - 0x30], xmm0
sub r8d, r12d
sub r8d, esi
add r8d, dword [rsp + 0x6c]
add r8d, dword [rbp + 0x40]
add eax, r8d
movzx r8d, byte [rsp + 0x70]
mov dword [rsp + 0x30], eax
lea rax, [0x1400ee168]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
call fcn.1400c9150
jmp 0x14003988b
movzx r12d, byte [rsp + 0x60]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rdx, str.drink
mov r8b, 0x40
mov rcx, rax
call fcn.1400a4770
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea edx, [r15 - 0xf]
imul edi, dword [rsp + 0x64]
imul edi, dword [rsp + 0x74]
mov rcx, rax
movsx rax, r12b
mov r9b, 8
sub esi, eax
imul edi, r14d
lea r8d, [rdi - 0x101]
sub esi, ebx
mov qword [rsp + 0x20], 0
add esi, r13d
imul r8d, r13d
sub r8d, dword [rbp + 0x48]
add edx, esi
sub r8d, dword [rsp + 0x68]
add r8d, 9
add r8d, dword [rsp + 0x6c]
add r8d, r15d
call fcn.1400b1f70
lea rax, str.c11a4
mov rcx, qword [rbp + 0x240]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x360]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret