Function at 0x14008d070
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2e0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x2d0], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x80]
xor edx, edx
mov r13, rax
mov eax, 0xe
mov r8d, 0x140
sub eax, r13d
lea ebp, [r13 + 0xe]
mov dword [rsp + 0x30], eax
call fcn.1400e27d0
lea rdx, [rsp + 0x80]
lea rcx, str.ticket
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rcx, [rsp + 0x1c0]
mov edx, 0x104
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov rsi, rax
mov qword [rsp + 0x50], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, esi
mov qword [rsp + 0x40], rax
imul ecx, ebx
lea edi, [rcx + rax*4]
mov ecx, 8
lea eax, [rdi*4]
sub ecx, eax
mov dword [rsp + 0x38], eax
sub ecx, r13d
mov dword [rsp + 0x68], ecx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov edx, 0x5b
lea r8d, [rdx - 0x40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
mov r14d, eax
mov dword [rsp + 0x34], eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x48], rax
cmp edi, 4
je 0x14008d219
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
mov edx, 0x356
lea r8d, [rcx + 0xe]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov edx, 0x64
xor ecx, ecx
lea r8d, [rdx - 0x4f]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0xf8
lea r8d, [rcx + 3]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x3b3
lea r8d, [rcx + 0x13]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x1ee
lea r8d, [rcx + 0x13]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor eax, eax
lea r9d, [rbx*4 + 7]
mov qword [rsp + 0x28], rax
lea r8, [0x140001b00]
xor edx, edx
add r9d, ebp
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
mov edx, 0xf3
lea r8d, [rcx + 5]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x1b0
lea r8d, [rcx + 3]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
movzx eax, dil
xor ecx, ecx
add r14b, 0x44
lea r8d, [rcx + 5]
mov edx, 0x24f
imul byte [rsp + 0x68]
movzx edi, al
mov al, 7
imul r13b
sub dil, al
add dil, r14b
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r14d, r13d
movsx r12, dil
mov r15d, 0x12
sub r14d, esi
sub r15d, r12d
lea rcx, str.lentil
add r14d, 0x10
sub r15d, eax
mov rbx, rax
sub r15d, r14d
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov eax, dword [rsp + 0x30]
mov edi, dword [rsp + 0x78]
movzx ebp, byte [rsp + 0x34]
mov ecx, r15d
imul eax, dword [rsp + 0x50]
imul ecx, r14d
imul edi, dword [rsp + 0x40]
shl ecx, 2
sub edi, ecx
mov ecx, ebp
imul ecx, dword [rsp + 0x48]
sub edi, ecx
add edi, eax
sub edi, r12d
sub edi, r13d
add edi, 0x39
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea ecx, [rbx + rdi*8]
imul esi, r15d
shl ecx, 2
sub ecx, r14d
add ecx, ecx
sub ecx, r13d
add ecx, ecx
sub ecx, esi
sub ecx, dword [rsp + 0x38]
sub ecx, ebp
sub ecx, eax
mov rax, qword [rsp + 0x40]
sub ecx, dword [rsp + 0x48]
add eax, 0x33
add ecx, r12d
add eax, ecx
mov rcx, qword [rsp + 0x2d0]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret