Function at 0x140076800
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1d8
mov r12, r8
mov rdi, rdx
mov r13, rcx
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov r9d, r12d
xor ecx, ecx
lea r8d, [rcx + 0xb]
mov edx, 0x344
mov r14, rax
imul r9d, r13d
sub r9d, eax
sub r9d, 4
mov dword [rsp + 0x108], r9d
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, r13d
mov qword [rsp + 0x118], rax
sub esi, r12d
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
xor ecx, ecx
mov edx, 0xaf
lea ebp, [r14 + 4]
lea r8d, [rcx + 0x1b]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
movzx edx, r14b
mov ebx, esi
mov qword [rsp + 0x88], rax
movzx eax, r13b
shl dl, 2
imul ebx, r14d
lea ecx, [rdx + r14]
sub ebx, 0x17
mov edx, 0x10a
imul dil
sub al, 2
mov dword [rsp + 0xd8], ebx
add al, cl
xor ecx, ecx
mov byte [rsp + 0x238], al
mov eax, edi
lea edi, [r13 - 1]
lea r8d, [rcx + 0x10]
imul eax, r13d
sub eax, r12d
add eax, 0x28
mov dword [rsp + 0x80], eax
mov eax, r14d
sub eax, r12d
add edi, eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
movsx rcx, byte [rsp + 0x238]
mov r15, rax
mov rax, qword [rsp + 0x88]
sub ecx, ebx
sub ecx, r14d
add eax, 9
sub ecx, r12d
add eax, ecx
mov dword [rsp + 0x64], eax
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
lea rcx, str.wine
movsxd rbx, eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
movzx ecx, r13b
mov qword [rsp + 0x98], rax
movzx eax, r14b
imul r12b
sub cl, al
mov rax, qword [rsp + 0x88]
sub cl, al
mov rdx, rax
add cl, 4
mov byte [rsp + 0x230], cl
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r8, rax
mov qword [rsp + 0x78], rax
movsx r9d, byte [rsp + 0x238]
movzx edx, byte [rsp + 0x230]
movzx ecx, r13b
sub cl, r9b
movzx eax, r12b
mov dword [rsp + 0xc8], r9d
imul cl
add al, 7
movzx ecx, dl
add cl, cl
add dl, cl
mov ecx, r9d
add dl, r14b
add dl, dl
add al, dl
movsx rdx, bl
imul ecx, dword [rsp + 0x64]
add al, bl
dec ecx
mov qword [rsp + 0xa8], rdx
mov byte [rsp + 0x220], al
imul eax, esi, 7
add eax, ecx
imul eax, r14d
sub eax, r8d
mov r8d, dword [rsp + 0x64]
sub eax, 2
mov dword [rsp + 0x70], eax
mov eax, r9d
imul r8d, r14d
mov dword [rsp + 0x60], r8d
imul eax, edi
mov rdi, qword [rsp + 0x98]
lea ecx, [rdi + rdi*2]
add ecx, ecx
sub ecx, eax
lea eax, [r13 + 0x2c]
sub ecx, r8d
add ecx, edx
mov edx, 0x221
add eax, ecx
xor ecx, ecx
lea r8d, [rcx + 0x13]
mov dword [rsp + 0xd0], eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov edx, dword [rsp + 0x80]
mov ecx, r12d
imul ecx, dword [rsp + 0x228]
mov qword [rsp + 0xc0], rax
lea eax, [r13 + 3]
imul edx, r14d
neg edx
shl edx, 2
sub edx, ecx
xor ecx, ecx
sub edx, edi
add edx, r14d
add edx, r12d
add eax, edx
mov edx, 0x34
lea r8d, [rdx - 0x20]
mov dword [rsp + 0x68], eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
movsx r8, byte [rsp + 0x220]
lea ecx, [r14*8]
mov edx, 1
mov rsi, rax
mov rax, qword [rsp + 0x88]
sub edx, ecx
mov rcx, qword [rsp + 0x78]
inc ecx
imul edx, r14d
imul ecx, edi
add edx, ecx
mov ecx, r15d
imul ecx, eax
add edx, ecx
sub edx, dword [rsp + 0xc0]
sub edx, dword [rsp + 0x68]
add edx, dword [rsp + 0x60]
add edx, r8d
mov r9, qword [rsp + 0xa8]
add edx, r12d
lea edi, [r13 - 0xe]
add edi, edx
lea rdx, [0x1400ed3f4]
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x74], edi
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
lea r9, str.c1a0
lea rcx, [rsp + 0x180]
mov r8d, eax
mov edx, edi
mov dword [rsp + 0x6c], eax
call fcn.1400da6a0
xor edx, edx
movzx ecx, bpl
mov ebp, dword [rsp + 0x70]
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x50], rdx
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
mov qword [rsp + 0x48], rdx
movsx r10d, bl
mov dword [rsp + 0xb0], ecx
movaps xmmword [rsp + 0x130], xmm0
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rsp + 0xe8], xmm1
movups xmm1, xmmword [rax + 0x30]
lea r8, [0x1400ed3f4]
mov r9d, ebp
mov dword [rsp + 0xb8], r10d
movaps xmmword [rsp + 0x150], xmm0
movaps xmmword [rsp + 0x160], xmm1
movsd xmm0, qword [rax + 0x40]
mov eax, edi
movsd qword [rsp + 0x170], xmm0
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea rdx, str.motel
mov ecx, r10d
call qword [sym.imp.USER32.dll_CreateWindowExA]
movsx rdx, byte [rsp + 0x230]
or rbx, 0xffffffffffffffff
movups xmm0, xmmword [rsp + 0xe8]
psrldq xmm0, 8
movq rax, xmm0
inc rbx
cmp byte [rax + rbx], 0
jne 0x140076bb0
movsx rax, byte [rsp + 0x220]
mov ecx, dword [rsp + 0x6c]
imul eax, edx
lea eax, [rax + rax*2]
imul ecx, edi
lea edx, [rcx + rax*2]
mov eax, dword [rsp + 0x98]
imul eax, r14d
add edx, eax
lea eax, [r13 - 3]
sub edx, esi
sub edx, dword [rsp + 0xc0]
sub edx, ebp
sub edx, r12d
add eax, edx
add ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov ecx, 5
sub cl, byte [rsp + 0x220]
mov rbp, rax
movzx eax, r13b
imul byte [rsp + 0x228]
movzx edi, al
movzx eax, r14b
add dil, dil
sub dil, byte [rsp + 0x74]
imul cl
movsx ecx, byte [rsp + 0x230]
add dil, dil
add dil, al
movzx eax, r12b
imul ecx, dword [rsp + 0x78]
imul byte [rsp + 0x64]
sub dil, al
movzx eax, r15b
imul byte [rsp + 0xd8]
add dil, al
mov rax, qword [rsp + 0x88]
sub dil, byte [rsp + 0x238]
add dil, 0x11
add dil, byte [rsp + 0x108]
add dil, sil
add dil, al
lea eax, [rax + rax*8]
add ecx, eax
lea eax, [r14 + r14*4]
lea edx, [rcx + rax*2]
lea eax, [r13 - 0x17]
sub edx, dword [rsp + 0x60]
sub edx, dword [rsp + 0xa8]
sub edx, dword [rsp + 0x98]
sub edx, r12d
add edx, esi
add edx, dword [rsp + 0x70]
add eax, edx
mov dword [rsp + 0x90], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
movsx ecx, byte [rsp + 0x220]
imul ecx, dword [rsp + 0xb8]
add ecx, 4
movzx edx, dil
mov rdi, qword [rsp + 0x78]
mov eax, esi
mov dword [rsp + 0xa0], edx
imul ecx, r14d
imul eax, dword [rsp + 0xd0]
sub ecx, eax
mov eax, edx
imul eax, dword [rsp + 0x90]
sub ecx, eax
lea eax, [r13 - 0x1c]
sub ecx, dword [rsp + 0x64]
add ecx, ebp
add ecx, dword [rsp + 0x118]
add ecx, edi
add eax, ecx
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x6c]
mov dword [rsp + 0x28], eax
xor r9d, r9d
mov r8, r12
mov rdx, rdi
mov rcx, rbp
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ecx, ecx
mov edx, 0x305
lea r8d, [rcx + 0x1b]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea r8, [0x140001b00]
mov r9d, ebx
mov qword [rsp + 0xb8], rax
xor eax, eax
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r9d, dword [rsp + 0x60]
lea r8, [0x140001b00]
mov qword [rsp + 0xd0], rax
xor eax, eax
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x78], rax
mov eax, dword [rsp + 0x74]
cmp eax, dword [rsp + 0xc8]
je 0x140076db1
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov eax, dword [rsp + 0x74]
imul esi, dword [rsp + 0x6c]
imul r15d, dword [rsp + 0x80]
movsx rdx, byte [rsp + 0x230]
imul esi, dword [rsp + 0xc0]
imul esi, eax
mov eax, dword [rsp + 0x13c]
imul esi, dword [rsp + 0x68]
lea ecx, [rax*2 + 4]
mov eax, dword [rsp + 0x60]
sub ecx, esi
inc eax
add ecx, ecx
add eax, edi
imul eax, r14d
sub ecx, eax
mov rax, qword [rsp + 0x88]
sub ecx, r15d
sub ecx, dword [rsp + 0x78]
sub ecx, dword [rsp + 0xd0]
sub ecx, dword [rsp + 0xb8]
sub ecx, dword [rsp + 0x98]
sub ecx, edx
movsx rdx, byte [rsp + 0x238]
sub ecx, eax
movsx rax, byte [rsp + 0x220]
add ecx, dword [rsp + 0xa0]
add ecx, dword [rsp + 0xb0]
add ecx, edx
add ecx, ebp
add ecx, dword [rsp + 0x90]
add ecx, ebx
add ecx, dword [rsp + 0xa8]
add ecx, dword [rsp + 0x70]
add eax, ecx
add eax, dword [rsp + 0x64]
add eax, r12d
add eax, dword [rsp + 0x228]
add eax, r13d
add rsp, 0x1d8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret