Function at 0x1400b00e0
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2f0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
lea rcx, [rsp + 0x1d0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov r14d, eax
mov qword [rsp + 0x68], rax
lea esi, [rax + 0x18]
imul r14d, eax
add r14d, r14d
mov dword [rsp + 0x60], r14d
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
lea r8d, [rcx + 0x11]
mov edx, 0x247
mov rbp, rax
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
xor ecx, ecx
mov edx, 0x12d
lea r8d, [rcx + 0xb]
mov edi, eax
mov dword [rsp + 0x80], eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
add esi, r14d
mov dword [rsp + 0x64], esi
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor r15d, r15d
lea r8, [0x140001b00]
lea r9d, [r15 + 2]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r15
mov r13, rax
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea ecx, [r15 + 2]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9d, [r15 + 2]
lea r8, [0x140001b00]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r15
mov r12, rax
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, qword [rsp + 0x68]
mov r8d, 0x140
mov r15, rax
mov eax, r13d
imul ecx, edx, 0x81
imul r15d, r13d
imul eax, esi
imul r15d, esi
imul r15d, edi
sub r15d, ecx
lea rcx, [rsp + 0x90]
sub r15d, ebp
sub r15d, r14d
lea r14d, [rdx + rdx]
xor edx, edx
sub r14d, eax
sub r15d, 5
sub r14d, ebp
sub r14d, edi
add r14d, 0xfffffff0
add r14d, r12d
call fcn.1400e27d0
lea rdx, [rsp + 0x90]
lea rcx, str.cormorant
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
xor ecx, ecx
lea r8d, [rcx + 0x15]
mov edx, 0x37a
movzx esi, ax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea eax, [rbx + rbx]
imul ebp, dword [rsp + 0x68], 0xfffffffe
sub ebp, eax
sub ebp, dword [rsp + 0x64]
movzx eax, r15b
lea rcx, str.believe
sub ebp, dword [rsp + 0x60]
shl al, 2
add ebp, 0x23
lea ebx, [rax + r15]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r8d, dword [rsp + 0x60]
movsx rdi, bl
imul esi, r14d
imul esi, r15d
mov rbx, qword [rsp + 0x68]
shl r8d, 5
lea eax, [rsi + rsi*4]
mov esi, dword [rsp + 0x64]
sub r8d, eax
add ebx, 0xfffffffb
sub r8d, edi
sub r8d, r13d
sub r8d, esi
add r8d, ebp
add r8d, dword [rsp + 0x70]
add ebx, r8d
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor eax, eax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x38], ebp
mov dword [rsp + 0x30], 4
lea r8, str.brush
lea rdx, str.cormorant
mov r9d, ebx
mov ecx, r14d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_CreateWindowExA]
xor ecx, ecx
mov edx, 0x371
lea r8d, [rcx + 0xe]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
movzx eax, byte [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
imul byte [rsp + 0x80]
sub cl, r13b
sub sil, 2
add cl, cl
add al, cl
sub al, r12b
sub al, byte [rsp + 0x60]
add al, sil
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x2f0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret