Function at 0x1400a6020
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x3b8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x3a0], rax
movsxd r12, r8d
xor eax, eax
mov rbx, r9
movsx r15d, dl
mov r14, rcx
mov qword [rsp + 0x28], rax
lea r8, [0x140001b00]
mov r9, r12
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x90], rbx
mov byte [rsp + 0x60], r15b
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
movsx edi, byte [rsp + 0x420]
mov r13d, dword [rsp + 0x428]
mov ecx, ebx
mov ebx, r14d
mov rsi, rax
mov qword [rsp + 0x98], rax
mov dword [rsp + 0xa4], edi
imul ebx, r15d
imul ecx, edi
sub ebx, r12d
mov dword [rsp + 0x74], ecx
sub ebx, ecx
sub ebx, r13d
sub ebx, 3
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebp, eax
mov dword [rsp + 0x70], eax
movzx eax, dil
imul r15b
lea r15d, [rax - 1]
add r15b, r13b
add r15b, sil
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
mov ecx, 0xffff
mov dword [rsp + 0x64], eax
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
mov dword [rsp + 0x68], eax
movzx eax, dil
imul r13b
movzx ecx, al
mov al, 0xe5
imul sil
movzx esi, al
sub sil, cl
sub sil, bpl
sub sil, r12b
sub sil, r14b
add sil, byte [rsp + 0x64]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rdx, rax
mov qword [rsp + 0xf0], rax
movzx eax, byte [rsp + 0x90]
imul r13b
movzx ecx, al
movzx eax, byte [rsp + 0x60]
imul cl
movzx ecx, al
movzx eax, dil
imul cl
lea ecx, [rax + 1]
movzx eax, r14b
imul cl
movzx ebp, al
movzx eax, byte [rsp + 0x68]
imul dl
shl al, 2
add bpl, al
sub bpl, bl
add bpl, 9
add bpl, byte [rsp + 0x70]
add bpl, r15b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor ecx, ecx
lea r8d, [rcx + 0x10]
mov edx, 0x168
mov dword [rsp + 0x6c], eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x260]
xor edx, edx
mov r8d, 0x140
mov qword [rsp + 0xb8], rax
call fcn.1400e27d0
lea rdx, [rsp + 0x260]
lea rcx, str.desk
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rsp + 0x88], rax
cmp dil, byte [rsp + 0x64]
je 0x1400a621a
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
movzx ecx, byte [rsp + 0x68]
mov edx, dword [rsp + 0x6c]
xor eax, eax
lea r8, str.c0ret
mov r9d, r14d
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], ecx
movsx ecx, byte [rsp + 0x60]
lea rdx, [0x1400edccc]
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExA]
movzx edi, byte [rsp + 0x98]
mov al, 7
neg dil
shl dil, 2
imul r14b
sub dil, al
mov rax, qword [rsp + 0x90]
sub dil, r13b
sub dil, byte [rsp + 0x60]
sub dil, byte [rsp + 0x88]
add dil, al
add dil, al
add dil, r14b
add dil, byte [rsp + 0xb8]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x120]
mov edx, 0x104
mov qword [rsp + 0xb0], rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov r9d, dword [rsp + 0x6c]
xor eax, eax
mov qword [rsp + 0x28], rax
lea r8, [0x140001b00]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [rsp + 0xb8]
movsx r10d, byte [rsp + 0x60]
movzx r8d, byte [rsp + 0x64]
movzx r11d, byte [rsp + 0x68]
movsx rcx, bpl
imul eax, ecx
mov qword [rsp + 0x100], rcx
lea ecx, [rax + rax*2]
movsx r9, sil
shl ecx, 7
mov eax, r12d
mov qword [rsp + 0x108], r9
add ecx, 6
imul eax, r10d
imul ecx, dword [rsp + 0x98]
add ecx, eax
lea eax, [r9 + 0xe]
sub ecx, dword [rsp + 0x90]
sub ecx, r8d
sub ecx, r11d
sub ecx, dword [rsp + 0xa4]
sub ecx, dword [rsp + 0x70]
add eax, ecx
mov dword [rsp + 0x80], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r8, qword [rsp + 0x98]
mov r9, qword [rsp + 0x90]
mov r10, qword [rsp + 0xf0]
mov r11, rax
mov qword [rsp + 0xe0], rax
movsx rcx, r15b
mov edx, 1
imul eax, r8d, 0xe
mov dword [rsp + 0xa0], eax
mov eax, dword [rsp + 0x6c]
imul ecx, r9d
lea ecx, [rcx + rcx*4]
lea eax, [rax*4]
sub edx, ecx
movsx ecx, dil
imul ecx, r14d
sub edx, ecx
mov ecx, r11d
imul ecx, dword [rsp + 0xb0]
imul edx, r8d
sub edx, ecx
sub edx, eax
movzx eax, byte [rsp + 0x68]
sub edx, eax
sub edx, dword [rsp + 0x74]
sub edx, r10d
sub edx, r13d
add edx, dword [rsp + 0xa0]
movzx eax, byte [rsp + 0x64]
mov r15, qword [rsp + 0x88]
add edx, r14d
add edx, eax
movsx eax, byte [rsp + 0x60]
movsx rcx, dil
mov edi, dword [rsp + 0x70]
add eax, 0xfffffff5
mov qword [rsp + 0xc8], rcx
add eax, edx
mov edx, 2
mov dword [rsp + 0x7c], eax
lea eax, [r9 + r9*4]
sub edx, eax
movsx eax, bpl
imul eax, r8d
imul edx, r14d
sub edx, eax
mov eax, ecx
imul eax, r11d
lea ecx, [rax + rax*2]
mov eax, r10d
shl eax, 4
add ecx, ecx
sub edx, ecx
xor ecx, ecx
sub edx, eax
lea r8d, [rcx + 0xc]
imul eax, ebx, 0xe
add edx, eax
movsx rax, sil
sub edx, eax
lea eax, [r12 - 1]
sub edx, r15d
sub edx, edi
add eax, edx
mov edx, 0x216
mov dword [rsp + 0xa8], eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0x88], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x120]
xor edx, edx
mov r8d, 0x140
mov qword [rsp + 0xd0], rax
call fcn.1400e27d0
lea rdx, [rsp + 0x120]
lea rcx, str.c0a0
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edx, dword [rsp + 0x88]
mov ecx, eax
mov qword [rsp + 0xe8], rax
imul edx, dword [rsp + 0xa8]
mov eax, edx
mov dword [rsp + 0xc4], edx
imul ecx, dword [rsp + 0xd0]
sub eax, ecx
add eax, dword [rsp + 0x7c]
mov dword [rsp + 0x78], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [rsp + 0xe0]
imul ecx, dword [rsp + 0x7c]
lea edx, [rdi + 1]
mov dword [rsp + 0xc0], eax
movzx eax, byte [rsp + 0x64]
imul edx, dword [rsp + 0x90]
sub edx, ecx
mov ecx, dword [rsp + 0x98]
imul ecx, dword [rsp + 0xb8]
sub edx, ecx
mov ecx, dword [rsp + 0xb0]
imul ecx, dword [rsp + 0x80]
lea r8d, [rdx + rcx*2]
mov ecx, r14d
imul ecx, r12d
add r8d, ecx
sub r8d, dword [rsp + 0x78]
sub r8d, dword [rsp + 0x6c]
sub r8d, r13d
add r8d, dword [rsp + 0xc8]
add eax, 0xfffffffd
add eax, r8d
xor ecx, ecx
mov edx, 0xe7
lea r8d, [rcx + 4]
mov dword [rsp + 0x74], eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0xd8], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r9, qword [rsp + 0xc8]
xor eax, eax
lea r8, [0x140001b00]
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, str.c0ret
mov qword [rsp + 0x110], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
xor ecx, ecx
mov edx, 0x1d9
lea r8d, [rcx + 0x1b]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x100
lea r8d, [rcx + 0xc]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, str.breast
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, qword [rsp + 0xd8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0xf8], rax
cmp bpl, byte [rsp + 0x80]
jge 0x1400a6630
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rdx, qword [rsp + 0x88]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
xor ecx, ecx
mov edx, 0x3e3
lea r8d, [rcx + 0x11]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x326
lea r8d, [rcx + 0x14]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x310
lea r8d, [rcx + 0xc]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x120]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xffff
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
mov rcx, qword [rsp + 0xe8]
movsx r8d, sil
inc ecx
mov ebp, eax
lea edx, [rcx + rcx*2]
mov ecx, dword [rsp + 0x74]
inc r8d
imul r8d, r14d
lea r8d, [r8 + rdx*2]
imul ecx, dword [rsp + 0x78]
lea ecx, [rcx + rcx*4]
lea esi, [rcx + r8*4]
sub esi, dword [rsp + 0xa0]
sub esi, dword [rsp + 0xa8]
sub esi, dword [rsp + 0xb0]
sub esi, dword [rsp + 0x70]
sub esi, r13d
add esi, dword [rsp + 0x88]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
movzx eax, byte [rsp + 0x64]
imul edi, dword [rsp + 0xf8]
mov rdx, qword [rsp + 0x98]
sub r15d, dword [rsp + 0xc0]
movsx r10d, byte [rsp + 0x60]
imul r12d, r10d
sub r15d, edx
mov ecx, r14d
imul ecx, eax
lea eax, [r15 + r15*4]
add ecx, r12d
imul ecx, dword [rsp + 0x90]
add ecx, eax
imul eax, r13d, 0x15
inc eax
imul eax, edx
mov edx, dword [rsp + 0x6c]
add ecx, eax
mov rax, qword [rsp + 0xb0]
add edx, 0xfffffffb
lea eax, [rax + r14*2]
add r14d, eax
lea eax, [rcx + r14*2]
mov rcx, qword [rsp + 0xe8]
sub eax, edi
imul ecx, dword [rsp + 0x78]
add eax, ecx
movzx ecx, byte [rsp + 0x68]
sub eax, dword [rsp + 0x108]
sub eax, dword [rsp + 0x110]
sub eax, dword [rsp + 0xc8]
sub eax, dword [rsp + 0xd0]
sub eax, ecx
sub eax, dword [rsp + 0x7c]
sub eax, dword [rsp + 0x80]
sub eax, dword [rsp + 0x70]
sub eax, ebx
sub eax, dword [rsp + 0x100]
add eax, esi
add eax, ebp
add eax, dword [rsp + 0xd8]
add eax, dword [rsp + 0x74]
add eax, dword [rsp + 0xc4]
add eax, dword [rsp + 0xe0]
add eax, dword [rsp + 0xf0]
add eax, dword [rsp + 0xa4]
add eax, dword [rsp + 0xb8]
add eax, edx
mov rcx, qword [rsp + 0x3a0]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x3b8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret