Function at 0x140071420
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x250
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, qword [rsp + 0x2b0]
movsx r13d, byte [rsp + 0x2b8]
mov rdi, r9
mov qword [rsp + 0x80], r9
mov rbp, r8
mov qword [rsp + 0xd0], r8
mov r15, rdx
mov qword [rsp + 0xe0], rcx
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov r12, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov edx, 0x44
lea r8d, [rdx - 0x3b]
xor ecx, ecx
mov qword [rsp + 0x90], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
or rsi, 0xffffffffffffffff
mov r14d, r13d
mov qword [rsp + 0xa8], rax
cmp r13d, 0x10
jl 0x14007173a
mov rcx, rsi
nop word [rax + rax]
inc rcx
cmp byte [rbx + rcx], 0
jne 0x1400714d0
movzx eax, r12b
sub bpl, r12b
sub bpl, 0x15
imul r13b
movzx edi, al
add bpl, r15b
sub dil, byte [rsp + 0x80]
add dil, r15b
sub dil, cl
add dil, 0x50
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea r8, [0x140001b00]
mov qword [rsp + 0xa0], rax
xor eax, eax
movzx r9d, bpl
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rsi
mov qword [rsp + 0xb8], rax
nop dword [rax + rax]
inc rcx
cmp byte [rbx + rcx], 0
jne 0x140071540
xor r8d, r8d
movzx eax, r15b
movzx edx, dil
mov qword [rsp + 0x58], r8
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x48], r8
imul cl
movzx ecx, dil
shl cl, 3
sub al, cl
sub al, byte [rsp + 0xa0]
sub al, byte [rsp + 0x78]
sub al, bpl
movzx ebp, bpl
add al, 0xe
add al, r13b
movzx ecx, al
movzx eax, dil
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], r8d
mov dword [rsp + 0x30], 4
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x68], ecx
mov r9d, ecx
lea rdx, [0x1400ed3b8]
lea r8, [0x1400ed3b8]
mov ecx, 2
mov dword [rsp + 0x20], ebp
call qword [sym.imp.USER32.dll_CreateWindowExA]
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, rsi
inc r8
cmp byte [rbx + r8], 0
jne 0x1400715e0
mov r11, qword [rsp + 0xa8]
mov r9d, dword [rsp + 0x68]
mov r10, qword [rsp + 0x80]
mov eax, r10d
movzx edi, dil
imul eax, r12d
lea ecx, [rax*4]
lea eax, [r9 + r11]
add ecx, ebp
lea eax, [rax + r11*2]
lea edx, [rax + rcx*4]
mov eax, dword [rsp + 0x90]
mov ecx, 1
add edx, edx
imul eax, r12d
sub ecx, eax
movsx rax, r13b
imul ecx, dword [rsp + 0x78]
sub ecx, edx
xor edx, edx
sub ecx, eax
sub ecx, dword [rsp + 0xb8]
sub ecx, r9d
lea eax, [r10 + rcx]
xor ecx, ecx
add r8d, eax
xor eax, eax
add r8d, r11d
mov qword [rsp + 0x28], rax
lea r9d, [rax + 2]
add edi, r8d
lea r8, [0x140001b00]
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [rsp + 0x100]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x100]
lea rcx, str.chrome
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
xor ecx, ecx
mov edx, 0xea
lea r8d, [rcx + 0xa]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x100]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea rcx, str.diver
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, qword [rsp + 0x78]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
xor eax, eax
lea r8, str.bull_fighter
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], ebp
mov dword [rsp + 0x30], r14d
lea ecx, [rax + 2]
mov r9d, ebp
mov rdx, rbx
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], r14d
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea ecx, [rdi + 0x11]
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rdi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0xd0]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [rsp + 0xb0], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov r11, qword [rsp + 0xa8]
mov r9, qword [rsp + 0x78]
mov r8d, ebp
lea ecx, [r15 + r11]
mov r10, rax
mov qword [rsp + 0xd8], rax
imul r8d, edi
mov ebp, r15d
lea edx, [r14 - 0x1b]
add edx, ecx
mov ecx, eax
mov eax, dword [rsp + 0xb0]
sub ebp, r9d
mov dword [rsp + 0x8c], edx
sub ebp, r12d
sub ebp, r8d
imul ecx, ebp
sub eax, ecx
mov rcx, rsi
sub eax, edx
lea edx, [rax + 7]
inc rcx
cmp byte [rbx + rcx], 0
jne 0x1400717a0
movzx eax, r15b
imul cl
movzx ecx, al
movzx eax, r11b
shl cl, 4
imul r10b
sub cl, al
mov rax, qword [rsp + 0x90]
add eax, eax
sub cl, r9b
mov dword [rsp + 0x98], eax
mov eax, dword [rsp + 0xd0]
add cl, 7
mov byte [rsp + 0x60], cl
imul eax, r15d
mov dword [rsp + 0x6c], eax
mov eax, edi
lea edi, [r11 - 7]
imul ecx, r9d, 0xfffffffb
imul eax, r14d
sub ecx, eax
mov r14, qword [rsp + 0x90]
sub ecx, dword [rsp + 0x98]
sub ecx, edx
sub ecx, ebp
add ecx, dword [rsp + 0x6c]
add edi, ecx
movzx eax, dil
mov dword [rsp + 0x64], edi
add al, al
lea edx, [rdi + 5]
add dl, byte [rsp + 0x60]
lea ecx, [rax + rdi]
movzx eax, r9b
shl al, 5
add cl, cl
add al, 3
add cl, al
mov rax, qword [rsp + 0xb0]
add cl, r15b
add cl, al
add cl, r11b
add cl, r12b
mov byte [rsp + 0x61], cl
imul bpl
movzx ecx, al
movzx eax, r11b
imul cl
movzx ecx, r15b
add cl, cl
add al, cl
movsx rcx, byte [rsp + 0x60]
sub al, dil
lea edi, [rcx + rcx*2]
mov ecx, r14d
sub al, r14b
shl edi, 2
sub al, dl
movzx edx, dl
mov dword [rsp + 0xc4], edi
sub al, r9b
mov dword [rsp + 0x88], edx
sub al, 3
shl ecx, 4
mov dword [rsp + 0x74], ecx
movzx ecx, al
mov rax, rsi
mov dword [rsp + 0x70], ecx
nop dword [rax + rax]
inc rax
cmp byte [rbx + rax], 0
jne 0x1400718a0
sub edi, dword [rsp + 0x74]
sub edi, dword [rsp + 0x64]
sub edi, edx
mov edx, 0x300
sub edi, r11d
add edi, r15d
add edi, r10d
add edi, ebp
add edi, ecx
xor ecx, ecx
add edi, r9d
add edi, r8d
lea r8d, [rcx + 0x1d]
sub edi, eax
add edi, 2
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, rsi
mov qword [rsp + 0xb8], rax
inc rcx
cmp byte [rbx + rcx], 0
jne 0x1400718e7
mov rdx, qword [rsp + 0xd8]
movsx r9, byte [rsp + 0x61]
imul ecx, r12d
imul eax, r14d, 0xfffffffb
sub eax, ecx
movsx r8, r13b
sub eax, ebp
mov qword [rsp + 0xa0], r8
mov rcx, rsi
add eax, 0xfffffff9
add eax, r15d
add eax, edx
mov dword [rsp + 0x68], eax
inc rcx
cmp byte [rbx + rcx], 0
jne 0x140071925
movsx eax, byte [rsp + 0x60]
mov r14d, edx
imul r14d, dword [rsp + 0x90]
imul eax, dword [rsp + 0x8c]
sub r14d, eax
sub r14d, r8d
sub r14d, dword [rsp + 0x64]
add r14d, r9d
add r14d, r15d
sub r14d, ecx
sub r14d, 6
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x100]
xor edx, edx
mov r8d, 0x140
mov qword [rsp + 0xe8], rax
call fcn.1400e27d0
lea rdx, [rsp + 0x100]
lea rcx, str.plough
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ecx, ebp
mov qword [rsp + 0xf0], rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r13, qword [rsp + 0xe0]
xor ecx, ecx
mov edx, 0xb0
mov qword [r13], rax
lea r8d, [rcx + 5]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r10d, dword [rsp + 0xb8]
mov r11d, dword [rsp + 0xb0]
imul r10d, dword [rsp + 0x68]
mov rdx, qword [rsp + 0xd8]
mov qword [r13 + 8], rax
lea rax, str.question
mov qword [r13 + 0x10], rax
mov rax, qword [rsp + 0xa8]
mov dword [rsp + 0xc8], r10d
imul r11d, edx
lea eax, [rax + rax*4]
mov dword [rsp + 0xc0], r11d
mov rcx, rsi
mov dword [rsp + 0xcc], eax
nop word [rax + rax]
inc rcx
cmp byte [rbx + rcx], 0
jne 0x140071a20
mov r8d, dword [rsp + 0x98]
mov r13, qword [rsp + 0x78]
mov edx, dword [rsp + 0x6c]
imul eax, r13d
imul r8d, r12d
mov r9, qword [rsp + 0xa0]
shl r8d, 4
add edx, 0xfffffd5d
sub eax, r8d
mov r8, qword [rsp + 0x80]
sub eax, dword [rsp + 0xc4]
sub eax, r8d
sub eax, r14d
sub eax, r9d
sub eax, r11d
mov r11d, dword [rsp + 0x64]
sub eax, r10d
mov r10, qword [rsp + 0xe8]
sub eax, ebp
sub eax, dword [rsp + 0x70]
add eax, r10d
add eax, edi
add eax, r11d
add eax, dword [rsp + 0x88]
add eax, edx
mov rdx, qword [rsp + 0xd8]
add ecx, eax
mov rax, qword [rsp + 0xe0]
mov dword [rax + 0x18], ecx
mov rax, rsi
inc rax
cmp byte [rbx + rax], 0
jne 0x140071ab1
imul eax, r8d
mov r8, qword [rsp + 0xb8]
imul r10d, r14d
mov r14, qword [rsp + 0xe0]
mov ecx, 5
sub ecx, dword [rsp + 0x70]
imul r8d, edi
imul ecx, ecx, 0xb
sub ecx, r8d
movsx r8, byte [rsp + 0x61]
add ecx, r10d
sub ecx, eax
mov eax, dword [rsp + 0x88]
lea eax, [rax + rax*2]
sub ecx, eax
sub ecx, dword [rsp + 0xcc]
sub ecx, r8d
sub ecx, dword [rsp + 0xd0]
sub ecx, r9d
sub ecx, r11d
sub ecx, dword [rsp + 0x8c]
sub ecx, ebp
sub ecx, r13d
sub ecx, r12d
add ecx, dword [rsp + 0x74]
add ecx, r15d
add ecx, dword [rsp + 0xb0]
add ecx, dword [rsp + 0x68]
add ecx, edx
mov dword [r14 + 0x1c], ecx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [r14 + 0x20], rax
inc rsi
cmp byte [rbx + rsi], 0
jne 0x140071b44
mov rax, qword [rsp + 0x90]
imul esi, dword [rsp + 0x80]
movsx rcx, byte [rsp + 0x60]
imul ecx, dword [rsp + 0x64]
imul eax, r13d
lea eax, [r12 + rax*4]
add eax, eax
sub ecx, eax
movsx eax, byte [rsp + 0x61]
imul eax, dword [rsp + 0x70]
add eax, 0x2d2
lea ecx, [rax + rcx*2]
mov rax, qword [rsp + 0xa8]
sub ecx, esi
sub ecx, dword [rsp + 0xa0]
sub ecx, edi
sub ecx, dword [rsp + 0xc8]
sub ecx, ebp
sub ecx, eax
mov rax, r14
add ecx, dword [rsp + 0xf0]
add ecx, dword [rsp + 0xc0]
add ecx, dword [rsp + 0x6c]
mov dword [r14 + 0x28], ecx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x290]
add rsp, 0x250
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret