Function at 0x14009c2b0
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4b0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x4a0], rax
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
lea rcx, [rsp + 0x170]
mov edx, 0x104
movzx r15d, ax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov ebx, r15d
mov r12, rax
lea eax, [rax + rax*2]
add eax, eax
mov dword [rsp + 0x74], eax
sub ebx, eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0xd8], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0x80], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
mov esi, r12d
lea r14d, [r15 + 0x24]
lea r8d, [rcx + 0xd]
mov edx, 0x161
mov rdi, rax
mov qword [rsp + 0x88], rax
imul esi, r15d
sub esi, eax
add r14d, r12d
add esi, 0x12
mov dword [rsp + 0x6c], esi
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
lea r8d, [rcx + 1]
mov edx, 0x301
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x280]
mov edx, 0x104
mov qword [rsp + 0x148], rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov edx, 0x95
mov eax, r14d
sub eax, edi
lea r8d, [rdx - 0x7e]
xor ecx, ecx
mov dword [rsp + 0x78], eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r13d, 0xfffffff8
mov edx, 0x104
mov rbp, rax
imul ecx, eax, 7
sub r13d, ecx
lea rcx, [rsp + 0x390]
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor ecx, ecx
mov edx, 0x12d
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x80]
lea r8d, [rcx + 0x1c]
lea edi, [rax + r14*4]
mov al, 0x31
add edi, r14d
add edi, ebx
mov dword [rsp + 0x70], edi
imul r13b
add al, 2
add al, r14b
add al, r12b
mov byte [rsp + 0x60], al
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r10, qword [rsp + 0x88]
lea ecx, [r10 + r10*8]
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0x90]
shl ecx, 2
mov r9d, r15d
lea edx, [rdi*4]
sub r9d, ecx
mov ecx, ebp
sub r9d, eax
sub r9d, edx
sub r9d, r12d
imul ecx, eax
lea eax, [r10 + r10*2]
add eax, eax
sub ecx, eax
lea eax, [r9 + 0xa]
sub ecx, edx
mov dword [rsp + 0x68], eax
sub ecx, r14d
sub ecx, 5
mov dword [rsp + 0x64], ecx
test esi, esi
jne 0x14009c5ab
lea r8d, [rsi + 0x17]
mov edx, 0x31d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, str.egypt
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, rbp
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor eax, eax
lea r8, [0x140001b00]
mov qword [rsp + 0x28], rax
mov r9d, r15d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, str.c2a4
mov r9d, r14d
mov r8d, r15d
xor ecx, ecx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
sub esi, dword [rsp + 0x70]
sub esi, dword [rsp + 0x78]
xor ecx, ecx
mov eax, r13d
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], ecx
movzx edx, dil
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x28], ecx
sub esi, r14d
lea ebx, [r12 - 0x12]
lea r8, str.bank
lea rdx, str.cassock
sub esi, r15d
xor r9d, r9d
mov dword [rsp + 0x20], r15d
add ebx, esi
call qword [sym.imp.USER32.dll_CreateWindowExA]
xor ecx, ecx
lea r8d, [rcx + 0x16]
mov edx, 0x324
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov edx, 0x92
xor ecx, ecx
lea r8d, [rdx - 0x80]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, dword [rsp + 0x70]
mov esi, dword [rsp + 0x6c]
mov r10, qword [rsp + 0x88]
movzx edx, byte [rsp + 0x60]
mov eax, r10d
imul eax, r14d
lea ecx, [rax + rdx*4]
lea eax, [rdx + rdx*2]
mov edx, dword [rsp + 0x80]
sub ecx, edi
lea r8d, [rax + rax]
mov eax, dword [rsp + 0x148]
add ecx, 0xf
imul edx, r12d
add ecx, dword [rsp + 0x74]
add ecx, dword [rsp + 0x68]
add ecx, dword [rsp + 0x64]
mov dword [rsp + 0x64], r8d
add r8d, 2
add esi, ecx
lea ecx, [rax + rdx*2]
add edx, ecx
lea ebx, [r8 + rdx*2]
add ebx, ebp
add ebx, edi
add ebx, r13d
add ebx, r10d
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x120]
mov qword [rsp + 0x30], rax
lea rax, str.course
mov r9d, ebx
mov qword [rsp + 0x28], rax
mov r8d, esi
mov edx, 2
mov dword [rsp + 0x20], 0
call fcn.1400da770
or rcx, 0xffffffffffffffff
movups xmm2, xmmword [rax + 0x20]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
psrldq xmm2, 8
movups xmmword [rsp + 0xe8], xmm0
movups xmmword [rsp + 0xf8], xmm1
movq rax, xmm2
inc rcx
cmp byte [rax + rcx], 0
jne 0x14009c662
mov eax, dword [rsp + 0x6c]
imul ebp, r13d
lea r8d, [r14 + r14]
lea eax, [rax + rbp*8]
imul ebx, esi
imul edx, eax, 7
mov eax, dword [rsp + 0xa0]
sub r8d, edx
imul eax, dword [rsp + 0x68]
sub r8d, eax
mov rax, qword [rsp + 0x90]
sub r8d, ebx
sub r8d, eax
sub r8d, r15d
add r8d, dword [rsp + 0xd8]
add r8d, dword [rsp + 0x64]
add r8d, dword [rsp + 0x80]
lea eax, [r12 + r8]
sub eax, ecx
sub eax, 0x13
mov rcx, qword [rsp + 0x4a0]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x4b0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret