Function at 0x1400bdce0
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2d0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
movsxd rax, edx
xor edi, edi
mov r12, rcx
lea r8, [0x140001b00]
xor edx, edx
xor ecx, ecx
mov r9, rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x64], eax
mov rbx, rax
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r15, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea r8, [0x140001b00]
mov r9, rbx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rdi
mov r14, rax
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
mov r13d, r14d
movzx ebx, ax
lea rcx, [rsp + 0x70]
xor edx, edx
imul r13d, r15d
sub r13d, ebx
mov r8d, 0x140
add r13d, 0xfffffff8
add r13d, esi
call fcn.1400e27d0
lea rdx, [rsp + 0x70]
lea rcx, str.painting
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea rcx, [rsp + 0x1b0]
mov edx, 0x104
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov rbp, rax
movzx eax, dil
shl bpl, 2
imul r13b
lea ecx, [rax + 1]
movzx eax, r14b
imul cl
sub bpl, al
sub bpl, bl
add bpl, r12b
add bpl, sil
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
movzx ecx, r12b
mov r9, rax
movzx eax, bl
shl cl, 3
movzx r8d, bpl
imul r13b
lea edx, [rcx + rax]
movzx eax, r14b
lea ecx, [rbx + 4]
lea ebx, [r9 - 5]
imul r14d, r13d
imul dl
sub al, dil
mov edi, dword [rsp + 0x64]
add al, 4
movzx edx, al
mov byte [rsp + 0x60], al
imul r12d, edi
sub r12d, r14d
add r12d, r15d
add ecx, r12d
imul edx, ecx
lea eax, [r8 + rdx*4]
add edx, eax
add ebx, edx
cmp edi, r8d
jge 0x1400bde50
xor ecx, ecx
mov edx, 0x37c
lea r8d, [rcx + 0x1d]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor ecx, ecx
mov edx, 0x1a1
lea r8d, [rcx + 0x12]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor edx, edx
xor ecx, ecx
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
xor ecx, ecx
lea r8d, [rcx + 0x18]
mov edx, 0xf3
mov esi, eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
cmp edi, r13d
jle 0x1400bdf81
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
lea rcx, str.howitzer
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.help
mov r9, rbx
mov rcx, rax
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
lea rcx, str.c0a3
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LockResource]
movzx ecx, byte [rsp + 0x60]
movzx r9d, bl
xor ebx, ebx
lea r8, str.c2a5
lea rdx, str.c1ret
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x38], 4
mov dword [rsp + 0x30], edi
mov ecx, esi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], r13d
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea r9d, [rbx + 4]
lea r8, [0x140001b00]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r8d, [rbx + 2]
mov edx, 0x295
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x70]
lea rcx, str.dirndl
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
xor ecx, ecx
mov edx, 0x106
lea r8d, [rcx + 5]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, qword [rsp + 0x2c0]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x320]
add rsp, 0x2d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret