Function at 0x140098b40
Capabilities:
Copy file
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x360
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x350], rax
mov qword [rsp + 0x90], r9
mov r14, rcx
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rbp, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, 0xffff
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
mov edx, 0x4f
lea r8d, [rdx - 0x34]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdi, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
mov r12, rax
lea eax, [rbp*8]
add edi, eax
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x64], edi
call qword [sym.imp.KERNEL32.dll_LockResource]
movsx r15, al
mov qword [rsp + 0x78], rax
lea r13d, [r15 - 3]
lea r13d, [r13 + r13*4]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rcx, [rsp + 0x100]
xor edx, edx
mov r8d, 0x140
mov dword [rsp + 0x70], eax
call fcn.1400e27d0
lea rdx, [rsp + 0x100]
lea rcx, str.numismatist
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
lea r8d, [rcx + 2]
mov edx, 0x2e4
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea r8, [0x140001b00]
mov r9d, r13d
mov qword [rsp + 0x80], rax
xor eax, eax
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rdx, str.c1a2
lea rcx, str.terrapin
mov r8d, edi
mov qword [rsp + 0x88], rax
call qword [sym.imp.KERNEL32.dll_CopyFileA]
mov ecx, ebx
mov edi, eax
mov eax, dword [rsp + 0x80]
imul ecx, r13d
imul edx, ecx, 0xb
sub eax, edx
xor ecx, ecx
sub eax, 0x15
mov dword [rsp + 0x68], eax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [rsp + 0x64]
movzx eax, cl
add sil, 0x25
shl al, 2
add cl, al
movzx eax, bpl
add al, al
sub cl, al
mov eax, edi
sub cl, bl
add cl, r13b
add cl, sil
movzx esi, cl
sub eax, esi
cmp dword [rsp + 0x68], esi
mov dword [rsp + 0x6c], esi
mov dword [rsp + 0x74], eax
jl 0x140098de3
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x240]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor ecx, ecx
mov edx, 0x34d
lea r8d, [rcx + 0x1a]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
xor ecx, ecx
sub r15d, ebp
lea eax, [r15 + r15*4]
lea r8d, [rcx + 0x16]
mov edx, 0x23b
shl eax, 3
sub eax, dword [rsp + 0x88]
sub eax, ebx
add eax, esi
lea esi, [r13 - 0xa]
add eax, edi
add esi, eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor ecx, ecx
mov edx, 0xda
lea r8d, [rcx + 0x1b]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x381
lea r8d, [rcx + 0xb]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x10d
lea r8d, [rcx + 0x10]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
movsxd rcx, dword [rsp + 0x74]
mov r15, qword [rsp + 0x78]
xor r9d, r9d
movsx edx, bpl
mov qword [rsp + 0x58], r9
mov qword [rsp + 0x50], r9
mov qword [rsp + 0x48], r9
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x38], r9d
mov dword [rsp + 0x30], edx
movsx r8d, r15b
mov r9d, ecx
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], r8d
lea r8, str.plane
lea rdx, [0x1400ed4d4]
mov ecx, esi
call qword [sym.imp.USER32.dll_CreateWindowExA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
jmp 0x140098de8
mov r15, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov esi, dword [rsp + 0x70]
movsx r15d, r15b
mov qword [rsp + 0x98], rax
cmp esi, r15d
je 0x140098e0b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [rsp + 0x6c]
lea eax, [rbp*4]
mov edx, r15d
imul edx, dword [rsp + 0x64]
add eax, ebp
mov dword [rsp + 0x78], edx
imul ecx, dword [rsp + 0x68]
lea r9, str.link
xor r8d, r8d
imul ecx, edi
sub ecx, eax
mov rax, qword [rsp + 0x90]
sub ecx, dword [rsp + 0x60]
mov eax, dword [rax + 8]
sub ecx, edx
sub ecx, ebx
add ecx, dword [rsp + 0x80]
lea edx, [rcx - 0xe]
mov ecx, ebx
add edx, r13d
imul ecx, esi
mov dword [rsp + 0x60], edx
mov esi, ebp
imul ecx, r13d
lea ecx, [rax + rcx*2]
lea eax, [rcx + rcx*4]
lea rcx, [rsp + 0xd0]
sub esi, eax
lea rax, str.c1a2
sub esi, dword [rsp + 0x68]
sub esi, dword [rsp + 0x64]
add esi, edi
mov dword [rsp + 0x38], esi
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], edx
lea rdx, str.c1a3
call fcn.1400dc490
mov r9d, dword [rsp + 0x60]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0xa0], xmm0
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rsp + 0xb0], xmm1
movups xmmword [rsp + 0xc0], xmm0
cmp r9d, esi
jle 0x140098f31
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rcx, str.c1a1
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
xor ecx, ecx
mov edx, 0x288
lea r8d, [rcx + 5]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x240]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov r9d, dword [rsp + 0x60]
mov rcx, qword [rsp + 0xb0]
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140098f40
mov r11, qword [rsp + 0x88]
mov r10, qword [rsp + 0x98]
mov ecx, dword [rsp + 0x68]
imul ecx, edi
mov edx, 2
mov qword [r14 + 0x10], rbp
mov qword [r14 + 0x28], 0
sub edx, ecx
imul edx, ebp
lea ecx, [rdx + r11*4]
mov edx, 0x1a7
sub ecx, dword [rsp + 0x78]
sub ecx, r12d
sub ecx, r10d
sub ecx, r9d
add ecx, dword [rsp + 0x6c]
imul r12d, r15d
imul r12d, dword [rsp + 0x64]
add ecx, dword [rsp + 0x74]
add ecx, ebx
add ecx, dword [rsp + 0x70]
add ecx, r13d
imul ebx, dword [rsp + 0x70]
sub ecx, eax
lea rax, [0x1400ed3f4]
imul ebx, r13d
sub ecx, 9
mov qword [r14 + 8], rax
mov eax, dword [rsp + 0xa8]
mov dword [r14], ecx
lea ecx, [r12*4 + 2]
imul eax, esi
add ecx, r12d
imul ecx, ebp
sub ecx, ebx
sub ecx, eax
lea eax, [rdi + 0x26]
add ecx, r10d
add ecx, r11d
add ecx, dword [rsp + 0x68]
add eax, ecx
xor ecx, ecx
mov dword [r14 + 0x18], eax
lea rax, str.reading
lea r8d, [rcx + 0x15]
mov qword [r14 + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [r14 + 0x30], rax
mov rax, r14
mov rcx, qword [rsp + 0x350]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x360]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret