Function at 0x140031ca0
Capabilities:
Check for time delay via gettickcount
Create thread
Extract resource via kernel32 functions

Disassembly:
mov byte [rsp + 0x20], r9b
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x168]
sub rsp, 0x268
movsx esi, r9b
mov edi, edx
mov r14, rcx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r12d, r14d
lea r9, [0x1400ed4fc]
mov rbx, rax
lea rax, str.route
imul r12d, edi
lea rcx, str.file
mov r8d, r12d
mov rdx, rbx
mov qword [rsp + 0x20], rax
call fcn.1400d2c30
xor edx, edx
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rdx
movsxd rcx, r12d
mov r15, rax
mov qword [rbp - 0x78], rax
mov eax, dword [rbp + 0x1d8]
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], r12d
lea r8, [0x1400ed3f4]
lea rdx, str.file
mov r9d, edi
mov ecx, r12d
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea r8, str.c0a4
lea rcx, str.c0a0
xor r9d, r9d
mov rdx, rax
mov r13, rax
mov qword [rbp - 0x60], rax
call fcn.14006f9c0
mov r8d, dword [rbp + 0x1d8]
movzx edx, al
lea eax, [r14 - 9]
lea ecx, [r8 + r8]
sub r8b, 4
mov dword [rsp + 0x74], edx
sub ecx, edi
add eax, ecx
lea ecx, [rdx - 0x34]
mov dword [rsp + 0x60], eax
mov eax, ebx
imul eax, r12d
mov dword [rsp + 0x6c], eax
lea r13d, [rax + r13*4]
movzx eax, r12b
add r13d, ecx
shl al, 2
add r13d, r15d
lea ecx, [rax + r12]
mov al, 0xfa
shl cl, 4
add r13d, r14d
imul sil
movzx r15d, al
xor eax, eax
add r13d, edi
sub r15b, cl
mov qword [rsp + 0x28], rax
movsxd r9, r13d
sub r15b, dil
xor ecx, ecx
mov dword [rsp + 0x20], eax
sub r15b, dl
xor edx, edx
add r15b, r8b
lea r8, [0x140001b00]
add r15b, r14b
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp r15b, r13b
jle 0x140031e13
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rax, str.c0a0
mov ecx, edi
mov qword [rbp + 0xa0], rax
mov qword [rbp + 0xa8], rax
lea eax, [rbx + rbx*2]
movups xmm0, xmmword [rbp + 0xa0]
sub ecx, eax
mov eax, dword [rbp - 0x60]
movaps xmmword [rbp + 0x20], xmm0
add ecx, ecx
imul eax, dword [rbp - 0x78]
sub ecx, eax
lea eax, [r14 - 1]
add eax, ecx
lea rcx, [rbp + 0x20]
mov dword [rbp + 0xb0], eax
movsd xmm1, qword [rbp + 0xb0]
movsd qword [rbp + 0x30], xmm1
call fcn.14006dd80
mov rsi, rax
mov qword [rbp - 0x58], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
movsx rcx, byte [rbp + 0x1c8]
mov qword [rbp - 0x68], rax
xor r8d, r8d
mov qword [rbp - 0x38], rcx
lea rax, str.deodorant
mov qword [rbp + 0x20], r8
imul ecx, dword [rbp - 0x78]
mov qword [rbp + 0x28], rax
movsx rax, r15b
lea edx, [rcx + rcx*4]
lea eax, [rax*4]
add edx, edx
mov qword [rbp + 0x38], r8
sub edx, eax
mov dword [rsp + 0x78], eax
lea eax, [rdi - 4]
sub edx, r13d
sub edx, dword [rsp + 0x60]
add edx, r14d
add eax, edx
mov dword [rbp + 0x30], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rdx, qword [rbp - 0x78]
mov dword [rbp + 0x1c0], eax
lea ecx, [r12*8]
lea eax, [r14 - 6]
sub ecx, dword [rsp + 0x78]
sub ecx, ebx
add ecx, dword [rsp + 0x74]
add eax, ecx
xor ecx, ecx
mov dword [rsp + 0x64], eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov ecx, r14d
sub ecx, dword [rsp + 0x78]
mov qword [rbp - 0x20], rax
lea eax, [rdi - 0x10]
sub ecx, dword [rbp - 0x60]
add eax, ecx
mov dword [rbp - 0x18], eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov edx, 0x5c
mov qword [rbp - 0x10], rax
lea rax, str.c2a1
lea r8d, [rdx - 0x45]
mov qword [rbp - 8], rax
lea rax, str.scissors
xor ecx, ecx
mov qword [rbp], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
movups xmm0, xmmword [rbp - 0x20]
mov qword [rbp + 8], rax
lea rax, str.c2ret
movups xmmword [rbp + 0x60], xmm0
movups xmm0, xmmword [rbp - 0x10]
mov qword [rbp + 0x10], rax
movaps xmmword [rbp + 0x70], xmm0
movups xmm1, xmmword [rbp]
movaps xmmword [rbp + 0x80], xmm1
movsd xmm0, qword [rbp + 0x10]
mov ecx, dword [rsp + 0x64]
movups xmm1, xmmword [rbp + 0x30]
lea rax, [rbp + 0x60]
lea r9, [rbp + 0x40]
lea r8, str.rambler
mov qword [rsp + 0x30], rax
mov eax, dword [rbp + 0x1c0]
mov dword [rsp + 0x28], ecx
movsd qword [rbp + 0x90], xmm0
movups xmm0, xmmword [rbp + 0x20]
movaps xmmword [rbp + 0x50], xmm1
movaps xmmword [rbp + 0x40], xmm0
mov rcx, qword [rbp - 0x68]
mov rdx, rsi
mov dword [rsp + 0x20], eax
call fcn.1400911c0
mov ecx, dword [rbp + 0xb0]
imul edx, r12d, 0xfffffffc
inc ecx
mov dword [rsp + 0x70], eax
imul ecx, esi
sub edx, ecx
movsx ecx, byte [rbp + 0x1c8]
lea esi, [r14 - 0x13]
imul ecx, dword [rbp + 0x1d8]
sub edx, ecx
sub edx, dword [rbp - 0x78]
add edx, dword [rbp - 0x68]
add edx, dword [rsp + 0x60]
add esi, edx
mov dword [rbp - 0x6c], esi
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [rdi + rdi*2]
shl ecx, 2
mov dword [rbp + 0x1d0], eax
lea eax, [r14 - 0xb]
sub ecx, dword [rsp + 0x6c]
sub ecx, dword [rbp + 0x1c0]
sub ecx, dword [rbp - 0x60]
add eax, ecx
mov dword [rsp + 0x68], eax
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
mov r9d, dword [rbp + 0x1d0]
movzx eax, ax
mov edx, esi
xor ecx, ecx
mov dword [rbp - 0x70], eax
mov dword [rsp + 0x30], eax
call fcn.14007c280
mov ecx, dword [rsp + 0x64]
movsx edx, byte [rbp + 0x1c8]
mov r10, qword [rbp - 0x68]
imul ecx, dword [rbp + 0x1c0]
imul edx, edi
mov r11d, dword [rbp - 0x6c]
sub edx, ecx
mov ecx, dword [rbp - 0x70]
mov rsi, rax
mov rax, qword [rbp - 0x78]
mov r8d, r10d
imul ecx, dword [rbp + 0x1d0]
lea r9d, [rax + rax*4]
add edx, ecx
lea eax, [r14 - 5]
imul r8d, r11d
sub edx, r9d
mov dword [rbp - 0x40], r9d
mov r9d, dword [rbp - 0x20]
sub edx, dword [rsp + 0x78]
mov dword [rsp + 0x6c], r8d
mov dword [rbp - 0x4c], r9d
sub edx, r9d
add edx, r8d
add edx, dword [rsp + 0x70]
add eax, edx
mov dword [rsp + 0x7c], eax
mov eax, r13d
imul eax, dword [rsp + 0x60]
or rdi, 0xffffffffffffffff
mov dword [rbp - 0x80], eax
mov r8, rdi
inc r8
cmp byte [rsi + r8], 0
jne 0x1400320b6
mov edx, r9d
mov eax, r14d
imul eax, dword [rbp + 0x1b8]
imul edx, dword [rbp + 0x1c0]
lea ecx, [rax*2 + 0x1c]
mov eax, dword [rbp + 0x1d0]
imul eax, r10d
imul eax, r11d
sub ecx, eax
mov eax, dword [rbp - 0x80]
add eax, ecx
xor ecx, ecx
add edx, eax
movsx rax, r15b
add edx, eax
lea rax, str.bafflement
sub edx, r8d
mov qword [rbp + 0x68], rax
mov rax, qword [rbp - 0x58]
mov dword [rbp + 0x60], edx
mov rdx, r14
mov qword [rbp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov edx, 0x6d
xor ecx, ecx
lea r8d, [rdx - 0x58]
mov qword [rbp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rbp + 0x80], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rbp + 0x88], eax
mov rax, qword [rbp - 0x58]
mov qword [rbp + 0x90], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
mov dword [rbp + 0xc0], eax
lea rax, str.stepson
mov qword [rbp + 0xc8], rax
mov rax, qword [rbp - 0x68]
mov qword [rbp + 0xd0], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
lea r8d, [rcx + 0x1b]
mov edx, 0x34c
mov dword [rbp + 0xd8], eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r8, rdi
mov qword [rbp + 0xe0], rax
nop dword [rax + rax]
inc r8
cmp byte [rsi + r8], 0
jne 0x1400321a0
mov ecx, dword [rbp - 0x38]
movaps xmm0, xmmword [rbp + 0xc0]
movaps xmm1, xmmword [rbp + 0xd0]
mov eax, ebx
lea r9, [rbp + 0x110]
imul ecx, dword [rbp + 0x1b8]
movaps xmmword [rbp + 0x110], xmm0
movaps xmmword [rbp + 0x120], xmm1
imul eax, r12d
lea eax, [rax + rax*4]
lea edx, [rcx + rax*2]
mov eax, dword [rbp - 0x4c]
imul eax, dword [rsp + 0x70]
imul eax, dword [rsp + 0x64]
imul eax, dword [rbp + 0x1c0]
lea ecx, [rax + rdx*2]
mov eax, dword [rsp + 0x74]
lea rdx, [rbp - 0x20]
imul eax, r13d
add ecx, eax
movsx rax, r15b
sub ecx, eax
lea rax, str.ride
sub ecx, dword [rsp + 0x68]
mov qword [rbp + 0xf0], rax
lea rax, str.c4a2
sub ecx, dword [rbp - 0x58]
mov qword [rbp + 0xf8], rax
mov rax, qword [rbp - 0x68]
movaps xmm1, xmmword [rbp + 0xf0]
movaps xmmword [rbp + 0x140], xmm1
add ecx, dword [rbp + 0x1d0]
movups xmm1, xmmword [rbp + 0x70]
mov qword [rbp + 0x100], rax
movaps xmmword [rbp - 0x10], xmm1
movsd xmm1, qword [rbp + 0x90]
add ecx, r14d
movsd qword [rbp + 0x10], xmm1
sub ecx, r8d
lea r8, str.cirrus
mov dword [rbp + 0xe8], ecx
mov ecx, dword [rsp + 0x7c]
movaps xmm0, xmmword [rbp + 0xe0]
movaps xmmword [rbp + 0x130], xmm0
movsd xmm0, qword [rbp + 0x100]
movsd qword [rbp + 0x150], xmm0
movups xmm0, xmmword [rbp + 0x60]
movaps xmmword [rbp - 0x20], xmm0
movups xmm0, xmmword [rbp + 0x80]
movaps xmmword [rbp], xmm0
call fcn.1400bf9b0
lea rcx, str.cirrus
mov qword [rbp - 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, qword [rbp - 0x78]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
lea r8, str.seaplane
lea rdx, str.c2a1
mov ecx, eax
mov dword [rbp - 0x50], eax
call fcn.14008c440
mov rcx, rdi
mov r14, rax
nop
inc rcx
cmp byte [rax + rcx], 0
jne 0x1400322f0
imul ecx, dword [rbp - 0x48]
mov rdx, qword [rbp + 0x1b0]
mov r10, qword [rbp - 0x68]
mov r9d, dword [rsp + 0x68]
movsx r8d, byte [rbp + 0x1c8]
mov eax, edx
imul ecx, r10d
shl ecx, 3
add r9d, 0xfffffff7
imul r8d, dword [rbp + 0x1d8]
sub eax, ecx
mov rcx, qword [rbp - 0x58]
add eax, eax
sub eax, ecx
add eax, eax
sub eax, dword [rsp + 0x6c]
sub eax, dword [rbp + 0x1c0]
sub eax, dword [rsp + 0x60]
add eax, dword [rsp + 0x7c]
add r9d, eax
mov eax, dword [rsp + 0x7c]
mov dword [rsp + 0x6c], r9d
imul eax, ecx
sub r8d, eax
mov eax, dword [rbp + 0x1d0]
add r8d, dword [rbp - 0x78]
imul eax, ecx
imul eax, dword [rbp - 0x6c]
lea ecx, [rax + r8*4]
movsx rax, r15b
sub ecx, eax
lea eax, [rdx + 5]
mov edx, r9d
sub ecx, r10d
sub ecx, ebx
add ecx, dword [rsp + 0x74]
add ecx, dword [rsp + 0x60]
add eax, ecx
lea rcx, [rbp - 0x20]
mov r8d, eax
mov dword [rsp + 0x70], eax
call fcn.1400d00b0
lea rcx, str.c7a2
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x110], xmm0
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rbp + 0x120], xmm1
movups xmmword [rbp + 0x130], xmm0
call fcn.1400bf790
mov ecx, dword [rsp + 0x68]
mov qword [rbp - 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea edx, [rbx*4]
mov rbx, qword [rbp - 0x28]
mov dword [rbp - 0x30], edx
mov rcx, rdi
mov qword [rbp + 0x40], rax
nop dword [rax]
inc rcx
cmp byte [rbx + rcx], 0
jne 0x1400323f0
imul ecx, dword [rbp + 0x12c]
mov eax, dword [rsp + 0x68]
imul eax, dword [rbp + 0x1d0]
shl ecx, 2
imul eax, dword [rbp - 0x6c]
sub ecx, eax
imul eax, dword [rbp - 0x58], 7
sub ecx, eax
mov eax, dword [rbp - 0x48]
add ecx, dword [rbp - 0x38]
shl ecx, 2
imul eax, dword [rbp + 0xd8]
sub ecx, eax
mov eax, dword [rbp - 0x4c]
imul eax, dword [rsp + 0x64]
sub ecx, eax
mov eax, dword [rsp + 0x70]
imul eax, dword [rsp + 0x6c]
add ecx, eax
mov rax, rdi
sub ecx, dword [rbp - 0x80]
sub ecx, dword [rsp + 0x78]
sub ecx, dword [rbp + 0x1b8]
add ecx, edx
add ecx, dword [rsp + 0x74]
add ecx, dword [rbp + 0x1b0]
nop dword [rax]
inc rax
cmp byte [rsi + rax], 0
jne 0x140032460
sub ecx, eax
mov dword [rbp + 0x48], ecx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
lea r8d, [rcx + 0x11]
mov edx, 0x20b
mov qword [rbp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
movsx r8d, r15b
mov rdx, rdi
mov qword [rbp + 0x58], rax
imul r8d, r13d
mov dword [rbp - 0x80], r8d
nop dword [rax]
inc rdx
cmp byte [r14 + rdx], 0
jne 0x1400324a0
add edx, dword [rbp + 0x1b8]
mov eax, dword [rbp - 0x48]
mov r13, qword [rbp - 0x58]
imul eax, dword [rbp - 0x50]
mov r15, qword [rbp + 0x118]
imul ecx, eax, 0xfffffff9
mov eax, dword [rbp + 0x80]
imul eax, dword [rsp + 0x7c]
sub ecx, eax
lea eax, [rcx + rdx*4]
mov rcx, rdi
sub eax, dword [rbp - 0x70]
sub eax, dword [rsp + 0x68]
sub eax, dword [rbp + 0x1c0]
add eax, 0xfffffffc
add eax, r8d
add eax, r13d
add eax, dword [rbp - 0x60]
add eax, dword [rbp - 0x78]
add eax, dword [rbp + 0x1b0]
nop word [rax + rax]
inc rcx
cmp byte [r15 + rcx], 0
jne 0x140032500
movups xmm0, xmmword [rbp + 0x40]
movups xmm1, xmmword [rbp + 0x50]
add eax, r12d
add eax, ecx
lea rdx, [rbp + 0x110]
lea rcx, str.element
xor r9d, r9d
mov r8d, eax
mov qword [rsp + 0x20], r13
movaps xmmword [rbp + 0x110], xmm0
movaps xmmword [rbp + 0x120], xmm1
mov dword [rbp + 0x1b8], eax
call fcn.140079750
mov edx, dword [rsp + 0x64]
mov r8d, dword [rsp + 0x70]
movzx r10d, al
mov byte [rbp + 0x1c8], al
cmp r8d, edx
jg 0x1400325bb
lea rcx, str.c0a0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, qword [rbp - 0x78]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rdx, qword [rbp - 0x60]
lea rcx, str.payment
mov r8, rbx
mov r9d, eax
mov qword [rsp + 0x20], rcx
lea rcx, str.wetsuit
call fcn.140063d10
mov rbx, qword [rbp - 0x28]
mov edx, dword [rsp + 0x64]
mov r8d, dword [rsp + 0x70]
movzx r10d, byte [rbp + 0x1c8]
mov rcx, rdi
nop
inc rcx
cmp byte [rsi + rcx], 0
jne 0x1400325c0
imul ecx, dword [rsp + 0x7c]
mov r9, qword [rbp - 0x68]
mov eax, r9d
sub eax, ecx
mov rcx, rdi
add eax, 2
imul eax, r13d
cmp byte [r14 + rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x1400325e1
imul edx, dword [rbp + 0x1c0]
lea ecx, [r8 + rcx*8]
shl ecx, 2
sub eax, ecx
mov ecx, dword [rbp - 0x30]
imul ecx, dword [rbp + 0x1d8]
sub eax, ecx
mov rcx, qword [rbp - 0x48]
imul ecx, dword [rbp - 0x50]
add eax, ecx
mov ecx, dword [rsp + 0x68]
imul ecx, dword [rbp + 0x1d0]
add eax, ecx
lea ecx, [rdx + rdx*4]
sub eax, ecx
mov rcx, rdi
nop dword [rax + rax]
inc rcx
cmp byte [rbx + rcx], 0
jne 0x140032630
imul ecx, ecx, 7
sub eax, ecx
movzx ecx, r10b
sub eax, dword [rbp - 0x80]
sub eax, dword [rbp - 0x40]
sub eax, dword [rbp - 0x38]
add eax, ecx
sub eax, dword [rbp + 0x1b8]
sub eax, dword [rbp + 0xc0]
sub eax, dword [rbp - 0x70]
sub eax, r9d
sub eax, dword [rbp + 0x30]
sub eax, dword [rbp - 0x60]
sub eax, r12d
add eax, dword [rsp + 0x74]
add eax, r12d
add eax, dword [rbp + 0x50]
add eax, dword [rsp + 0x6c]
add eax, dword [rbp + 0xb0]
add eax, dword [rsp + 0x60]
inc rdi
cmp byte [r15 + rdi], 0
jne 0x140032680
sub eax, edi
add eax, 7
add rsp, 0x268
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret