Function at 0x140056350
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x4e0]
sub rsp, 0x5e0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x4d0], rax
movsxd r15, ecx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
mov r14, rax
mov qword [rbp - 0x60], rax
call fcn.140095a70
lea r8, [0x140001b00]
mov r9, r15
mov edi, eax
mov dword [rsp + 0x68], eax
xor eax, eax
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r13d, [r15 - 0xd]
mov rbx, rax
mov qword [rbp - 0x68], rax
mov byte [rsp + 0x60], r13b
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, r15d
lea r12d, [r14 - 0xd]
sub ecx, edi
lea r9, str.cupola
mov r8, rbx
add r12d, ecx
xor ecx, ecx
mov rsi, rax
mov dword [rsp + 0x30], r12d
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], r13b
mov dword [rsp + 0x70], r12d
call fcn.140096c90
lea edx, [r15 + r15*4]
mov rdi, rax
mov qword [rbp + 8], rax
movzx r13d, r15b
sub r13b, al
movzx eax, byte [rsp + 0x60]
mov r8d, eax
mov dword [rsp + 0x64], eax
sub r13b, sil
sub r13b, bl
sub r13b, r14b
sub r13b, 0x16
add r13b, al
imul eax, r12d
lea ecx, [rax + rax*2]
add ecx, ecx
sub ecx, edi
add ecx, edx
mov edx, dword [rsp + 0x68]
lea eax, [rdx - 0xd]
add eax, ecx
mov dword [rbp + 0x10], eax
imul eax, r15d, 0xd
mov dword [rsp + 0x74], eax
sub eax, r8d
sub eax, esi
add eax, edi
mov dword [rbp + 0x14], eax
lea eax, [rsi + rsi*2]
lea ecx, [rax + rax]
mov eax, r15d
sub eax, edi
mov dword [rbp - 0x40], ecx
add ecx, 0xd
add eax, ecx
mov dword [rbp + 0x18], eax
mov eax, r14d
imul eax, edx
imul ecx, eax, 0xd
mov eax, r15d
sub eax, ecx
sub eax, ebx
sub eax, 5
mov dword [rsp + 0x7c], eax
mov dword [rbp + 0x1c], eax
lea eax, [r15 + r8]
add eax, esi
movups xmm0, xmmword [rbp + 0x10]
add r12d, 0xffffffee
mov qword [rbp + 0x30], 0
add eax, r12d
mov r12d, r15d
sub r12d, r8d
add eax, edx
sub r12d, edi
mov dword [rbp + 0x20], eax
lea rax, str.cupola
movaps xmmword [rbp - 0x30], xmm0
movsd xmm0, qword [rbp + 0x30]
movsd qword [rbp - 0x10], xmm0
sub r12d, r14d
mov qword [rbp + 0x28], rax
sub r12d, dword [rsp + 0x70]
mov dword [rbp + 0x24], r12d
mov dword [rbp - 0x80], r12d
movups xmm1, xmmword [rbp + 0x20]
movaps xmmword [rbp - 0x20], xmm1
cmp r13b, 0x40
ja 0x14005651f
lea r9, [rbp - 0x30]
lea r8, str.step_son
lea rcx, str.link
movzx edx, r13b
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 0x40
call fcn.1400c8160
jmp 0x140056525
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r8, rax
mov qword [rbp - 0x78], rax
movzx r9d, r13b
mov eax, r9d
mov r10d, r15d
mov ecx, edi
mov edx, esi
mov dword [rsp + 0x28], 4
imul eax, dword [rbp + 0x10]
imul ecx, dword [rsp + 0x70]
shl eax, 2
neg ecx
shl edx, 6
sub r10d, eax
mov eax, dword [rsp + 0x64]
shl ecx, 3
sub r10d, r14d
mov dword [rbp - 0x70], edx
imul eax, edi
imul eax, dword [rsp + 0x70]
sub r10d, dword [rsp + 0x68]
lea r14d, [rax*4 - 8]
mov eax, dword [rsp + 0x64]
add r10d, 0xfffffffe
sub r14d, r8d
add r10d, edx
imul eax, esi
sub ecx, eax
sub r14d, r12d
mov r12, qword [rbp - 0x60]
sub r14d, r9d
lea r9d, [rbx + rbx*8]
add r10d, esi
sub ecx, r9d
sub r14d, esi
add r10d, ebx
sub ecx, dword [rsp + 0x7c]
add r10d, edi
lea eax, [r12 + 0x3b]
add ecx, r15d
mov dword [rbp - 0x7c], r9d
sub r14d, r12d
add ecx, r8d
add r14d, r15d
mov edx, r10d
add eax, ecx
xor r9d, r9d
mov r8d, r14d
mov dword [rsp + 0x78], eax
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x6c], r10d
call fcn.14006f740
mov r8d, dword [rsp + 0x78]
movzx edx, r13b
mov r9, rax
mov qword [rbp - 0x58], rax
cmp r8d, edx
jl 0x1400566ed
movzx ecx, r14b
movzx eax, r12b
mov dword [rbp + 0x48], 8
neg cl
imul bl
movzx ebx, al
shl cl, 7
sub bl, cl
mov ecx, dword [rsp + 0x6c]
lea rax, str.c3a0
sub bl, byte [rsp + 0x60]
mov qword [rbp + 0x40], rax
lea eax, [rdi + rdx*2]
imul ecx, dword [rbp + 0x20]
shl ecx, 6
shl eax, 2
add bl, 0xd
inc ecx
add bl, r9b
add bl, r15b
imul ecx, esi
sub eax, ecx
lea ecx, [r15*4 + 0xb]
sub eax, r8d
add ecx, r15d
sub eax, r14d
sub eax, dword [rsp + 0x70]
add eax, ecx
mov ecx, 0xffff
mov dword [rbp + 0x4c], eax
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
mov ecx, dword [rbp - 0x58]
movups xmm0, xmmword [rbp + 0x40]
imul ecx, dword [rsp + 0x78]
mov dword [rbp + 0x50], eax
mov eax, dword [rsp + 0x64]
movaps xmmword [rbp - 0x30], xmm0
movsd xmm1, qword [rbp + 0x50]
movzx r9d, bl
mov r8, rsi
movsd qword [rbp - 0x20], xmm1
imul eax, esi
imul edx, eax, 0x36
sub edx, ecx
movzx eax, r13b
sub edx, dword [rbp + 0x20]
lea rcx, [rbp + 0x40]
sub edx, eax
lea rax, [rbp - 0x30]
sub edx, dword [rsp + 0x70]
sub edx, dword [rsp + 0x68]
add edx, r15d
add edx, dword [rbp - 0x70]
add edx, dword [rbp - 0x78]
add edx, r14d
add edx, dword [rsp + 0x6c]
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], rax
call fcn.1400ca9a0
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea r9, [0x1400ed988]
lea r8, str.c1a1
mov rcx, rax
mov rdx, rsi
call fcn.140079fc0
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rcx, [0x1400ed3f4]
mov rbx, rax
mov qword [rbp + 0x38], rax
call fcn.1400add60
xor ecx, ecx
mov edx, 0xd1
mov r12, rax
lea r8d, [rcx + 5]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x2b5
lea r8d, [rcx + 0xa]
mov qword [rbp - 0x70], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rax, qword [rbp - 0x78]
mov edx, 0x3c8
lea ecx, [rax*8]
mov eax, dword [rbp - 0x80]
sub eax, ecx
shl eax, 3
imul ecx, ebx, 7
sub eax, ecx
movzx ecx, r13b
sub eax, ecx
xor ecx, ecx
sub eax, dword [rbp - 0x60]
lea r8d, [rcx + 0xb]
lea ebx, [r15 + rax]
add ebx, 0x39
add ebx, dword [rbp - 0x58]
add ebx, dword [rsp + 0x6c]
add ebx, esi
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov eax, dword [rbp - 0x58]
imul ecx, esi, 0x20a
mov edx, 0x104
imul eax, dword [rsp + 0x6c]
lea eax, [rax*4 + 0x14]
sub ecx, eax
add ecx, r15d
add ecx, dword [rsp + 0x64]
mov dword [rsp + 0x64], ecx
lea rcx, [rbp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov qword [rbp], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [rsp + 0x64]
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
mov edx, 0x2de
lea r8d, [rcx + 0xa]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, str.typewriter
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, qword [rbp - 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov edx, 0x29
xor ecx, ecx
lea r8d, [rdx - 0x25]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x1e2
lea r8d, [rcx + 0x16]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
mov edx, 0x276
lea r8d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
lea r8d, [rcx + 7]
mov edx, 0x30a
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov edx, dword [rsp + 0x78]
mov ecx, esi
imul ecx, dword [rsp + 0x70]
mov qword [rbp - 0x50], rax
mov eax, dword [rsp + 0x68]
mov qword [rbp - 0x30], rsi
imul edx, r14d
sub edx, ecx
add eax, 0xfffffffe
xor ecx, ecx
sub edx, dword [rbp - 0x70]
lea r8d, [rcx + 3]
sub edx, dword [rsp + 0x6c]
add edx, dword [rbp - 0x7c]
add edx, dword [rsp + 0x74]
add edx, dword [rbp]
add edx, dword [rsp + 0x64]
add edx, ebx
add edx, dword [rbp - 0x78]
add edx, edi
mov rdi, qword [rbp - 0x60]
add edx, edi
add eax, edx
mov edx, 0x20a
mov dword [rsp + 0x7c], eax
lea rax, str.c7ret
mov qword [rbp - 0x28], rax
lea rax, str.comportment
mov qword [rbp - 0x20], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [rbp + 0x90], 1
mov qword [rbp - 0x18], rax
lea rax, [0x1400ed3f4]
mov qword [rbp - 0x10], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
lea r8d, [rcx + 0x19]
mov edx, 0x1c3
mov qword [rbp + 0x98], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rbp + 0xa0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor ecx, ecx
mov dword [rbp + 0xa8], eax
mov rax, qword [rbp - 0x78]
lea r8d, [rcx + 0x16]
mov edx, 0x2ea
mov qword [rbp + 0xb0], 0
mov dword [rbp + 0xb8], 2
mov qword [rbp + 0xc0], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rbp + 0xc8], rax
mov eax, dword [rbp - 0x70]
imul eax, ebx
imul ecx, eax, 0xfffffff6
mov eax, edi
mov edi, dword [rsp + 0x70]
imul eax, dword [rsp + 0x68]
sub ecx, eax
lea eax, [rdi - 0x10]
sub ecx, dword [rsp + 0x64]
add ecx, dword [rsp + 0x74]
add ecx, r14d
add ecx, dword [rsp + 0x6c]
add ecx, esi
add eax, ecx
lea rcx, [0x1400ed3f4]
mov dword [rbp + 0xd0], eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rbp + 0xd8], rax
movaps xmm0, xmmword [rbp + 0x90]
movaps xmm1, xmmword [rbp + 0xa0]
movaps xmmword [rbp + 0xf0], xmm0
movaps xmm0, xmmword [rbp + 0xb0]
movaps xmmword [rbp + 0x100], xmm1
movaps xmm1, xmmword [rbp + 0xc0]
movaps xmmword [rbp + 0x110], xmm0
movaps xmm0, xmmword [rbp + 0xd0]
mov rbx, qword [rbp - 0x68]
mov edx, dword [rsp + 0x7c]
mov rcx, qword [rbp - 0x50]
movaps xmmword [rbp + 0x130], xmm0
movaps xmmword [rbp + 0x120], xmm1
movups xmm0, xmmword [rbp - 0x30]
movups xmm1, xmmword [rbp - 0x20]
lea rax, [rbp + 0xf0]
lea r9, [rbp + 0x40]
lea r8, str.c6ret
movaps xmmword [rbp + 0x40], xmm0
movaps xmmword [rbp + 0x50], xmm1
movsd xmm0, qword [rbp - 0x10]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rbx
movsd qword [rbp + 0x60], xmm0
call fcn.1400b9600
movsxd rcx, dword [rsp + 0x64]
xor edx, edx
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], eax
lea r9d, [rdx + 4]
lea r8, str.c6ret
lea rdx, str.deodorant
mov ecx, edi
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x74], eax
mov dword [rsp + 0x20], 4
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov rcx, rax
mov qword [rbp + 0xe0], rax
call fcn.140095a70
or rdi, 0xffffffffffffffff
mov dword [rbp - 0x80], eax
cmp eax, 4
jg 0x140056ca2
lea edx, [rdi + 0x20]
lea r8d, [rdi + 0x1b]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rbp + 0x3c0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rbp + 0x280]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rbp + 0x280]
lea rcx, str.method
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea rcx, [rbp + 0x140]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rbp + 0x140]
lea rcx, str.method
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea r9d, [rdi + 5]
lea rdx, [0x1400ed3f4]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
lea r8d, [rdi + 0x14]
mov edx, 0x2e9
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rdx, qword [rbp - 0x78]
mov qword [rbp - 0x48], rax
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x68]
xor r9d, r9d
mov dword [rsp + 0x28], eax
mov r8, rbx
mov rcx, rdx
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rcx, rdi
mov dword [rbp - 0x7c], eax
nop word [rax + rax]
cmp byte [r12 + rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140056b90
lea eax, [rcx + rcx*4]
mov ecx, dword [rsp + 0x74]
mov qword [rbp + 0x40], rsi
add eax, eax
imul ecx, dword [rbp + 0xd0]
imul ecx, esi
imul ecx, esi
sub ecx, eax
movzx eax, r13b
sub ecx, dword [rbp - 0x50]
add ecx, r15d
add ecx, dword [rbp - 0x40]
add ecx, eax
mov eax, dword [rsp + 0x68]
lea ebx, [rax + 4]
add ebx, ecx
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor ecx, ecx
mov edx, 0x1be
mov qword [rbp + 0x48], rax
mov rax, qword [rbp - 0x68]
lea r8d, [rcx + 0x1b]
mov qword [rbp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov qword [rbp + 0x58], rax
lea rax, str.c6ret
lea r8d, [rcx + 0x17]
mov qword [rbp + 0x60], rax
mov rax, qword [rbp - 0x68]
mov edx, 0x1b1
mov qword [rbp + 0x68], rax
mov rax, qword [rbp - 0x48]
mov qword [rbp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rbp + 0x3c0]
mov edx, 0x104
mov qword [rbp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov qword [rbp + 0x80], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov edx, dword [rbp - 0x7c]
movaps xmm0, xmmword [rbp + 0x40]
movaps xmm1, xmmword [rbp + 0x50]
lea r9, [rbp + 0x90]
lea rcx, str.c6a0
mov r8d, ebx
movaps xmmword [rbp + 0x90], xmm0
movaps xmm0, xmmword [rbp + 0x60]
movaps xmmword [rbp + 0xa0], xmm1
mov qword [rsp + 0x20], rax
movaps xmm1, xmmword [rbp + 0x70]
movaps xmmword [rbp + 0xb0], xmm0
movsd xmm0, qword [rbp + 0x80]
movsd qword [rbp + 0xd0], xmm0
movaps xmmword [rbp + 0xc0], xmm1
call fcn.140061e80
mov rcx, rdi
inc rcx
cmp byte [r12 + rcx], 0
jne 0x140056ca5
movzx eax, byte [rbp - 0x70]
movzx ebx, r15b
mov edx, 0x30b
imul cl
add al, r14b
add al, al
sub bl, al
movzx eax, byte [rsp + 0x74]
imul byte [rbp - 0x50]
movzx ecx, al
movzx eax, byte [rbp - 0x68]
imul cl
mov rcx, qword [rbp + 8]
sub bl, al
movzx eax, bl
shl al, 2
add bl, al
movzx eax, cl
shl al, 3
add cl, al
mov al, 7
sub bl, cl
xor ecx, ecx
lea r8d, [rcx + 0x17]
imul byte [rbp + 0x38]
add bl, al
sub bl, byte [rbp - 0x78]
sub bl, byte [rbp - 0x58]
sub bl, byte [rbp - 0x60]
add bl, 0xc
add bl, byte [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
movzx ecx, bl
mov rdx, rax
mov qword [rbp - 0x68], rax
call fcn.1400d0eb0
mov r10d, dword [rsp + 0x6c]
mov r9, rax
mov qword [rbp - 0x48], rax
cmp r10d, 4
jne 0x140056d49
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rcx, rax
call fcn.1400d6f50
mov r9, qword [rbp - 0x48]
mov r10d, dword [rsp + 0x6c]
mov rcx, rdi
nop dword [rax]
inc rcx
cmp byte [r12 + rcx], 0
jne 0x140056d50
movzx eax, byte [rbp - 0x70]
movzx edx, byte [rbp + 0x24]
add dl, byte [rsp + 0x64]
imul cl
movzx ecx, al
movzx eax, byte [rbp + 0x38]
add dl, dl
imul cl
movzx r8d, al
movzx eax, byte [rbp + 8]
imul byte [rsp + 0x70]
add dl, al
mov al, 0x1f
add dl, dl
imul sil
movzx ecx, al
sub cl, dl
movzx edx, byte [rsp + 0x60]
movzx eax, dl
add al, al
add dl, al
movzx eax, byte [rbp - 0x60]
add cl, dl
sub cl, byte [rbp - 0x58]
imul byte [rsp + 0x68]
add cl, cl
movzx edx, al
mov al, 0xd
imul dl
add al, byte [rbp - 0x50]
movzx edx, al
shl dl, 2
add al, dl
sub cl, al
movzx eax, bl
imul byte [rbp + 0xe0]
movzx edx, al
movzx eax, byte [rbp - 0x80]
imul dl
sub cl, al
sub cl, r8b
sub cl, byte [rsp + 0x74]
sub cl, r14b
add cl, byte [rbp - 0x68]
add cl, byte [rbp - 0x18]
add cl, byte [rbp]
add cl, r10b
add cl, byte [rsp + 0x7c]
add cl, r15b
add cl, r13b
inc rdi
cmp byte [r9 + rdi], 0
jne 0x140056df0
sub cl, dil
lea eax, [rcx - 0x33]
mov rcx, qword [rbp + 0x4d0]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x5e0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret