Function at 0x1400cafa0
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x118
mov eax, edx
mov r13, r8
mov r14, rdx
sub eax, dword [r8 + 0x28]
mov dword [rsp + 0x50], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor ecx, ecx
lea r8d, [rcx + 0x1b]
mov edx, 0x1d6
mov r12, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rbp, rax
mov qword [rsp + 0x88], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor ecx, ecx
lea r8d, [rcx + 0xf]
mov edx, 0x37d
mov dword [rsp + 0x34], eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x1ea
lea r8d, [rcx + 2]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0xb7
lea r8d, [rcx + 0xf]
mov qword [rsp + 0xa8], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0xb0], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
or rdi, 0xffffffffffffffff
mov qword [rsp + 0xb8], rax
mov rax, qword [r13 + 8]
mov rbx, rdi
nop
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400cb060
movzx eax, bl
add al, al
add bl, al
add bl, bl
add bl, 2
add bl, r14b
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rbp
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x48], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rdx, qword [r13 + 8]
mov r15, rax
movzx eax, bl
mov rcx, rdi
mov dword [rsp + 0x30], eax
nop dword [rax + rax]
inc rcx
cmp byte [rdx + rcx], 0
jne 0x1400cb0b0
mov esi, eax
xor eax, eax
lea r8, [0x140001b00]
sub esi, r15d
mov qword [rsp + 0x28], rax
movzx r9d, bl
add esi, ebp
xor edx, edx
mov dword [rsp + 0x20], eax
add esi, r12d
add esi, r14d
sub esi, ecx
xor ecx, ecx
sub esi, 0xa
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r12, rax
mov eax, 1
mov ecx, eax
mov dword [rsp + 0x168], eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x90], rax
movzx eax, byte [rsp + 0x48]
imul byte [rsp + 0x58]
movzx ecx, al
mov al, 0x2d
imul cl
movzx ecx, byte [rsp + 0x38]
add cl, cl
lea ebp, [rcx + rax]
sub bpl, byte [rsp + 0xb0]
sub bpl, bl
add bpl, r14b
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0x70], rax
cmp bpl, sil
jb 0x1400cb148
call qword [sym.imp.USER32.dll_GetForegroundWindow]
movzx ecx, byte [rsp + 0xb0]
movzx eax, r15b
dec cl
imul cl
movzx ecx, r14b
add cl, cl
lea edx, [rcx + r14]
mov ecx, dword [rsp + 0x30]
add dl, dl
lea ebx, [rdx + rax]
mov rax, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x90]
imul ecx, eax
sub bl, dl
sub bl, 8
add bl, al
mov eax, r12d
imul eax, esi
add ecx, eax
lea eax, [r15 + r15*8]
shl eax, 2
sub ecx, eax
lea eax, [r14 - 1]
sub ecx, dword [rsp + 0x88]
sub ecx, dword [rsp + 0x50]
add ecx, edx
mov edx, 0x3cd
add eax, ecx
xor ecx, ecx
lea r8d, [rcx + 0x19]
mov dword [rsp + 0x178], eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, r12d
mov rdx, rax
mov qword [rsp + 0x78], rax
imul ecx, r12d
sub eax, ecx
mov dword [rsp + 0x80], ecx
movsx ecx, byte [rsp + 0x48]
mov dword [rsp + 0x64], eax
cmp ecx, 1
je 0x1400cb211
mov r8, qword [rsp + 0x70]
lea rax, str.c0ret
lea rcx, [rsp + 0xc0]
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rax
call fcn.1400dceb0
movsx ecx, byte [rsp + 0x48]
mov rdx, qword [rsp + 0x78]
mov r9, qword [rsp + 0x90]
mov r8d, dword [rsp + 0x50]
imul ecx, r15d
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x54], ecx
mov r10, qword [rsp + 0x88]
lea r11d, [rax + rax*4]
movzx eax, bpl
movsx ebp, bl
mov dword [rsp + 0x40], eax
lea ecx, [r8 + r8*2]
mov dword [rsp + 0x170], ebp
imul eax, r9d
imul eax, r15d
add ecx, ecx
mov dword [rsp + 0x84], r11d
mov dword [rsp + 0x68], ecx
lea ecx, [rdx + rdx*4]
lea edx, [r10 + r10]
mov r10, qword [rsp + 0x160]
mov dword [rsp + 0x44], ecx
lea ecx, [r12*4 - 0x30]
sub ecx, eax
mov eax, r11d
mov r11, qword [rsp + 0x58]
imul eax, r11d
sub ecx, eax
mov eax, ebp
mov rbp, qword [rsp + 0x70]
imul eax, ebp
sub ecx, eax
mov eax, r14d
imul eax, dword [r13 + 0x28]
add ecx, eax
mov eax, dword [rsp + 0x64]
sub ecx, dword [rsp + 0x68]
sub ecx, dword [rsp + 0xb8]
sub ecx, eax
sub ecx, dword [rsp + 0x178]
sub ecx, r9d
mov r9, qword [rsp + 0x38]
imul eax, r12d
sub ecx, r9d
add ecx, edx
add ecx, dword [rsp + 0x44]
add ecx, dword [rsp + 0x54]
add ecx, r11d
add ecx, esi
mov dword [r10], ecx
movsx rcx, byte [rsp + 0x48]
shl ecx, 2
mov qword [rsp + 0x38], rcx
mov ecx, dword [rsp + 0x178]
imul ecx, r12d
mov dword [rsp + 0x48], ecx
lea ecx, [r11 + r11*2]
add ecx, ecx
mov dword [rsp + 0x60], ecx
mov ecx, dword [rsp + 0x170]
imul ecx, dword [rsp + 0x40]
imul ecx, ebp
mov ebp, dword [rsp + 0x30]
sub ecx, eax
mov eax, r9d
imul eax, dword [rsp + 0x34]
sub ecx, eax
sub ecx, dword [r13 + 0x20]
lea eax, [rcx + r15*2]
mov rcx, qword [rsp + 0x38]
sub eax, dword [rsp + 0x60]
sub eax, dword [rsp + 0x48]
sub eax, edx
mov rdx, r10
sub eax, esi
add eax, 9
add eax, ecx
add eax, dword [rsp + 0x44]
add eax, ebp
add eax, r11d
add eax, r14d
add eax, r8d
mov r10, qword [rsp + 0x88]
mov dword [rdx + 4], eax
mov eax, dword [rsp + 0x40]
imul ecx, r15d
imul eax, dword [rsp + 0x70]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0xb0]
mov qword [rsp + 0x38], rcx
imul eax, r9d
mov dword [rsp + 0x34], eax
movsx rax, bl
mov qword [rsp + 0x58], rax
mov rax, qword [r13 + 8]
nop
cmp byte [rax + rdi + 1], 0
lea rdi, [rdi + 1]
jne 0x1400cb390
mov ebx, dword [rsp + 0x64]
mov eax, dword [rsp + 0x178]
lea ecx, [rdi + rdi*2]
imul edx, r11d, 0xffffffd3
mov rdi, qword [rsp + 0x90]
add ecx, ecx
imul eax, edi
sub edx, eax
lea eax, [r14 - 2]
sub edx, ecx
mov rcx, qword [rsp + 0x160]
sub edx, dword [rsp + 0x30]
sub edx, dword [rsp + 0x78]
sub edx, ebx
sub edx, r10d
sub edx, r8d
lea r8d, [rbp*4]
add edx, dword [rsp + 0x38]
add r8d, ebp
add edx, dword [rsp + 0x34]
add edx, ebp
add edx, edi
add edx, r12d
add edx, r12d
add edx, r11d
add edx, dword [rsp + 0x58]
add edx, r15d
add edx, esi
add eax, edx
mov edx, dword [r13 + 0x18]
mov dword [rcx + 8], eax
mov ecx, dword [rsp + 0x168]
mov eax, r12d
imul eax, r15d
sub ecx, eax
mov eax, dword [rsp + 0x80]
imul ecx, edi
mov dword [rsp + 0x168], ecx
imul eax, ebx
sub dword [rsp + 0x168], eax
mov eax, dword [rsp + 0x54]
imul eax, esi
add dword [rsp + 0x168], eax
imul eax, dword [rsp + 0x78], 0x19
sub dword [rsp + 0x168], eax
lea eax, [r11 + r11*8]
sub dword [rsp + 0x168], eax
mov eax, dword [rsp + 0x168]
sub eax, dword [rsp + 0x68]
sub eax, r8d
mov r8, qword [rsp + 0x160]
sub eax, edx
sub eax, r9d
sub eax, dword [rsp + 0x58]
sub eax, r10d
add eax, 0xb
add eax, dword [rsp + 0x60]
add eax, dword [rsp + 0x48]
add eax, dword [rsp + 0x30]
add eax, dword [rsp + 0xb8]
add eax, r14d
mov dword [r8 + 0xc], eax
mov eax, dword [rsp + 0x170]
imul eax, dword [rsp + 0x70]
imul eax, r11d
mov dword [rsp + 0x170], eax
mov eax, r12d
imul eax, r15d
sub dword [rsp + 0x170], eax
imul eax, ebp, 0x19
mov ebp, dword [rsp + 0x170]
sub ebp, eax
sub ebp, dword [rsp + 0x80]
sub ebp, dword [rsp + 0x54]
sub ebp, dword [rsp + 0x178]
sub ebp, dword [r13]
sub ebp, r11d
sub ebp, dword [rsp + 0x50]
add ebp, dword [rsp + 0x44]
add ebp, dword [rsp + 0x34]
add ebp, dword [rsp + 0x40]
add ebp, ebx
lea eax, [r14 - 4]
add ebp, edi
mov rdi, r8
add ebp, r12d
add ebp, r10d
add ebp, esi
add eax, ebp
mov dword [r8 + 0x10], eax
mov rax, qword [rsp + 0x78]
lea ecx, [rax*4 - 6]
add ecx, eax
lea eax, [rdx + rdx*2]
imul ecx, r12d
lea edx, [rcx + rax*2]
mov rax, qword [rsp + 0x58]
xor ecx, ecx
sub edx, dword [rsp + 0x84]
add eax, 0x14
sub edx, ebx
sub edx, dword [rsp + 0x178]
sub edx, r9d
sub edx, r15d
sub edx, r10d
sub edx, esi
add edx, dword [rsp + 0x38]
add edx, dword [rsp + 0x30]
add edx, dword [rsp + 0xa8]
add eax, edx
mov edx, 0x3e0
mov dword [r8 + 0x14], eax
lea rax, str.c1ret
mov qword [r8 + 0x18], rax
lea r8d, [rcx + 0x10]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rdi + 0x20], rax
mov rax, rdi
add rsp, 0x118
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret