Function at 0x1400d7710
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x180
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rbx, r9
mov r12, rcx
lea r14d, [rcx - 4]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rcx, [rsp + 0x60]
mov edx, 0x104
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov edx, 0x5a
lea r8d, [rdx - 0x53]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov edx, 0x17c
lea ebp, [rax + 1]
movzx eax, bl
imul bl
movzx ecx, al
add cl, cl
imul ebp, ebx
add al, cl
xor ecx, ecx
add al, al
lea r8d, [rcx + 0xf]
sub r12b, al
sub r12b, bpl
call qword [sym.imp.KERNEL32.dll_FindResourceA]
cmp r14b, bpl
jne 0x1400d77cb
mov edx, 0x5e
xor ecx, ecx
lea r8d, [rdx - 0x52]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x1a0
lea r8d, [rcx + 5]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [0x1400ed4fc]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
xor ecx, ecx
mov edx, 0x1dd
lea r8d, [rcx + 8]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor r13d, r13d
movsx edi, r14b
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r13
mov eax, ebp
lea r8, [0x1400ed4fc]
lea rdx, str.c3a4
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], r13d
mov dword [rsp + 0x30], r13d
mov r9d, edi
mov ecx, edi
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], edi
call qword [sym.imp.USER32.dll_CreateWindowExA]
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
movzx eax, ax
add eax, 5
add esi, eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
movzx r15d, al
lea rcx, [rsp + 0x60]
mov edx, 0x104
lea ebx, [r15 + 6]
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
movzx eax, r12b
cmp ebx, eax
jl 0x1400d7918
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r13
mov eax, esi
lea r8, str.cummerbund
lea rdx, str.medicine
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], r15d
mov dword [rsp + 0x30], esi
mov r9d, esi
mov ecx, edi
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], edi
call qword [sym.imp.USER32.dll_CreateWindowExA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x60]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea r8, [0x140001b00]
movsx r9, r14b
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor r8d, r8d
mov edx, 0x2d6
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
mov edx, 0x24c
lea r8d, [rcx + 9]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x1c8]
add rsp, 0x180
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret