Function at 0x14006b930
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2e0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x2d0], rax
movsx r15d, cl
mov r14, r8
mov qword [rsp + 0x48], r8
mov rsi, rdx
mov qword [rsp + 0x50], rdx
mov byte [rsp + 0x30], r15b
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov ecx, r14d
mov r13d, r15d
mov ebx, r15d
lea edi, [r15 + rsi]
mov ebp, r15d
imul r13d, esi
imul ecx, eax
sub r13d, ecx
sub ebx, r14d
mov qword [rsp + 0x40], rax
add ebx, esi
mov byte [rsp + 0x31], dil
sub r13d, ebx
mov dword [rsp + 0x38], ebx
sub r13d, r15d
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [rsp + 0x70], rax
cmp dil, r13b
jb 0x14006b9e0
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x1c0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x1c0]
mov edx, 0x104
mov r15, rax
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov qword [rsp + 0x68], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
lea r8d, [rcx + 8]
mov edx, 0x249
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
movzx edi, dil
mov qword [rsp + 0x78], rax
cmp ebx, edi
jg 0x14006bac5
lea rcx, str.leaver
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov edx, 0x58
xor ecx, ecx
lea r8d, [rdx - 0x57]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x80]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x80]
lea rcx, str.reamer
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
xor ecx, ecx
mov edx, 0x21b
lea r8d, [rcx + 0x14]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
lea r8d, [rcx + 2]
mov edx, 0x2ff
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov edx, 0x11
xor ecx, ecx
lea r8d, [rdx - 2]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x80]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov ecx, r15d
mov edx, r14d
mov r12, rax
mov rax, qword [rsp + 0x40]
lea r15d, [rbp + 0xd]
imul edx, ebp
imul ecx, r13d
lea esi, [rax + 1]
add edx, ecx
imul edi, eax
lea eax, [rbx + rbx*2]
shl sil, 2
mov dword [rsp + 0x34], edi
add eax, eax
sub edx, eax
sub edx, dword [rsp + 0x68]
sub edx, edi
add r15d, edx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x48]
movsx r9d, byte [rsp + 0x30]
mov r14d, eax
movzx eax, dl
movzx ecx, r13b
mov edi, r15d
neg cl
shl cl, 7
imul r8b
movzx ebp, al
sub bpl, cl
mov ecx, r9d
add bpl, 8
add bpl, r9b
add bpl, r12b
add bpl, byte [rsp + 0x58]
add bpl, sil
add bpl, byte [rsp + 0x60]
movsx rax, bpl
sub edi, eax
movzx eax, r14b
sub edi, eax
movsx rax, sil
sub ecx, eax
xor eax, eax
add edi, 0x14
sub ecx, r8d
mov qword [rsp + 0x28], rax
lea r8, [0x140001b00]
sub ecx, dword [rsp + 0x34]
mov dword [rsp + 0x20], eax
sub ecx, ebx
mov rbx, qword [rsp + 0x40]
add ecx, edx
add ebx, 0x18
xor edx, edx
add ebx, ecx
xor ecx, ecx
movsxd r9, ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
movzx ecx, r15b
mov rdx, rax
shl cl, 2
mov al, 7
add r15b, cl
mov rcx, qword [rsp + 0x48]
imul byte [rsp + 0x58]
add r15b, al
movzx eax, byte [rsp + 0x40]
add cl, 0x42
sub r15b, sil
sub r15b, byte [rsp + 0x78]
imul cl
shl r15b, 2
sub r15b, al
movzx eax, dl
imul bl
sub r15b, al
movsx ecx, byte [rsp + 0x30]
sub r15b, dil
sub r14b, 0x17
sub r15b, cl
sub r15b, byte [rsp + 0x50]
sub r15b, r13b
add r15b, byte [rsp + 0x38]
lea eax, [rcx + r15]
add al, byte [rsp + 0x70]
add al, r12b
add al, bpl
add al, r14b
add al, byte [rsp + 0x60]
add al, byte [rsp + 0x31]
mov rcx, qword [rsp + 0x2d0]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x338]
add rsp, 0x2e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret