Function at 0x1400c1ff0
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x200
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
mov rbp, qword [rsp + 0x260]
movsxd r14, dword [rsp + 0x268]
or rbx, 0xffffffffffffffff
mov rdi, rbx
mov r12d, r9d
mov dword [rsp + 0x68], r9d
mov rsi, r8
mov r15, rcx
nop
inc rdi
cmp byte [r8 + rdi], 0
jne 0x1400c2040
imul edi, r15d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r13d, r15d
movzx ecx, al
imul r13d, r12d
mov dword [rsp + 0x60], eax
add cl, cl
lea r8, str.peer_to_peer
mov r9d, r12d
lea edx, [rcx + rax]
shl dl, 2
sub dl, r13b
movzx ecx, dl
movzx eax, dl
xor edx, edx
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], r13d
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x64], ecx
lea rdx, str.peer_to_peer
mov ecx, r13d
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r14d
call qword [sym.imp.USER32.dll_CreateWindowExA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea r8, [0x140001b00]
mov r9, r14
mov qword [rsp + 0x70], rax
xor eax, eax
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [rsp + 0x64]
xor edx, edx
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x60]
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], eax
lea r8, [0x1400ed3b4]
mov r9d, r13d
mov rdx, rsi
mov dword [rsp + 0x20], r14d
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov rax, rbx
inc rax
cmp byte [rsi + rax], 0
jne 0x1400c2137
mov esi, dword [rsp + 0x60]
imul r12d, dword [rsp + 0x6c]
add esi, 0xfffffffe
lea esi, [r12 + rsi*4]
sub esi, dword [rsp + 0x68]
add esi, r15d
add esi, dword [rsp + 0x64]
add esi, r13d
sub esi, eax
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r12, rax
inc rbx
cmp byte [rbx + rbp], 0
jne 0x1400c2182
imul r14d, dword [rsp + 0x60]
mov rax, qword [rsp + 0x70]
imul ebx, r15d
lea rcx, str.peer_to_peer
imul eax, esi
imul r14d, edi
sub r14d, eax
add ebx, r14d
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, r15
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
lea rdx, str.tourist
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea rax, str.c1a6
mov r9b, 0x20
mov r8, r12
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call fcn.1400dbec0
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetLastError]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rcx, [rsp + 0xb0]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0xb0]
lea rcx, str.resident
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea rax, str.shampoo
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x248]
add rsp, 0x200
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret