Function at 0x1400b37f0
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1f8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
movsxd r12, dword [rsp + 0x268]
mov rbx, qword [rsp + 0x260]
mov rdi, qword [rsp + 0x270]
movsxd r13, r8d
xor ebp, ebp
movzx r15d, r9b
mov byte [rsp + 0x60], r9b
mov rsi, rdx
mov r14d, ecx
mov qword [rsp + 0x68], rbx
cmp r12d, r13d
jle 0x1400b38d0
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
movzx ebx, r15b
lea r8, [0x140001b00]
mov r9d, ebx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r8, [0x140001b00]
mov r9d, ebx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r8, [0x140001b00]
mov r9, r12
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, qword [rsp + 0x68]
or rdx, 0xffffffffffffffff
mov rax, rdx
inc rax
cmp byte [rdi + rax], bpl
jne 0x1400b38d7
imul eax, r13d
mov ebp, r14d
sub ebp, eax
mov rax, rdx
nop dword [rax]
inc rax
cmp byte [rsi + rax], 0
jne 0x1400b38f0
add ebp, eax
movsx ecx, bpl
mov dword [rsp + 0x70], ecx
cmp r14d, ecx
jge 0x1400b3ace
movzx eax, r15b
mov r8d, r14d
mov r15d, r13d
mov dword [rsp + 0x64], eax
imul r8d, eax
mov eax, ebx
imul r15d, r14d
imul eax, ecx
mov ecx, r8d
sub ecx, eax
add r15d, 6
mov dword [rsp + 0x68], ecx
inc rdx
cmp byte [rdi + rdx], 0
jne 0x1400b3934
movsx rax, bpl
mov ecx, 1
sub ecx, r14d
imul eax, edx
add eax, ebx
lea ebx, [r8 + 6]
imul ecx, r12d
add ecx, eax
xor edx, edx
add ebx, ecx
lea rcx, [rsp + 0xa0]
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0xa0]
lea rcx, str.friday
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
xor ecx, ecx
mov edx, 0x32b
lea r8d, [rcx + 0x13]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x24f
lea r8d, [rcx + 1]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
movzx r9d, byte [rsp + 0x60]
xor eax, eax
mov qword [rsp + 0x28], rax
lea r8, [0x140001b00]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov edx, 0x14
lea r8d, [rdx - 0x12]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
xor ecx, ecx
mov esi, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
xor ecx, ecx
mov edx, 0x314
lea r8d, [rcx + 0x19]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x2aa
lea r8d, [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdx, r13
xor r13d, r13d
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], rdx
mov dword [rsp + 0x38], ebp
mov ecx, r14d
sub ecx, dword [rsp + 0x70]
mov dword [rsp + 0x30], esi
lea r8, str.tourist
sub ecx, dword [rsp + 0x64]
lea rdx, str.paste
mov r9d, ebx
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea rcx, [rsp + 0x78]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r13
movzx r8d, bl
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x38], r8d
movsx r9d, dil
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x30], ebp
lea r8, [0x1400ee018]
mov dword [rsp + 0x28], eax
lea rdx, str.paste
lea ecx, [r13 + 1]
mov dword [rsp + 0x20], 1
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0xa0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov rbx, rax
cmp r14d, r12d
jg 0x1400b3b27
lea rcx, [rsp + 0xa0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor ecx, ecx
mov edx, 0x26d
lea r8d, [rcx + 0x1a]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rax, rbx
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x1f8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret