Function at 0x14006d320
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4a0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x490], rax
movsx eax, cl
movsxd rsi, edx
movzx r14d, r8b
mov ebp, eax
mov byte [rsp + 0x60], al
mov dword [rsp + 0x64], eax
xor eax, eax
mov byte [rsp + 0x61], r8b
mov dword [rsp + 0x88], esi
cmp esi, ebp
jl 0x14006d38c
mov qword [rsp + 0x28], rax
lea r8, [0x140001b00]
mov r9, rsi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rcx, [rsp + 0x210]
xor edx, edx
mov r8d, 0x140
mov rdi, rax
mov qword [rsp + 0x70], rax
call fcn.1400e27d0
lea rdx, [rsp + 0x210]
lea rcx, str.element
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbx, rax
mov qword [rsp + 0x90], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
movzx r12d, r14b
mov rdx, rax
mov qword [rsp + 0x98], rax
mov ecx, r12d
lea eax, [rbp - 5]
mov r13d, edi
sub ecx, esi
mov dword [rsp + 0x68], r12d
add eax, ecx
mov ecx, edx
mov dword [rsp + 0x6c], eax
imul ecx, eax
sub r13d, ecx
sub r13d, ebx
add r13d, 0x23
cmp eax, r12d
je 0x14006d414
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x350]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x350]
lea rcx, [0x1400ed4fc]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea edx, [rsi - 1]
lea ecx, [rbx + rbx*4]
imul edx, edi
sub edx, ecx
lea r15d, [rbp - 0xe]
add r15d, edx
mov r8, rax
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x78], r15d
cmp esi, r15d
jl 0x14006d5a6
movzx ecx, sil
mov al, 0x32
movzx r15d, bpl
shl cl, 2
add bl, 6
imul dil
sub r15b, al
lea r12d, [rcx + rsi]
mov esi, dword [rsp + 0x78]
movzx eax, dil
sub r15b, r12b
sub r15b, r8b
imul r14b
movzx ecx, al
add r15b, sil
shl cl, 2
add r15b, bl
lea r14d, [rcx + rax]
add r14b, r14b
add r14b, bpl
add r14b, sil
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
mov edx, 0x229
mov rbp, rax
lea r8d, [rcx + 8]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x345
lea r8d, [rcx + 0xf]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
lea r8d, [rcx + 7]
mov edx, 0xaa
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0xd0]
mov edx, 0x104
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov rdi, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
movzx eax, byte [rsp + 0x80]
xor ecx, ecx
add r14b, 0x26
mov edx, 0x24b
imul sil
movzx esi, byte [rsp + 0x60]
lea r8d, [rcx + 7]
sub sil, al
sub sil, r13b
sub sil, r12b
sub sil, bl
sub sil, r15b
sub sil, byte [rsp + 0x70]
add sil, bpl
add sil, dil
add sil, r14b
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor eax, eax
mov qword [rsp + 0x28], rax
lea r8, [0x140001b00]
movzx r9d, sil
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, dword [rsp + 0x88]
mov ebp, dword [rsp + 0x64]
mov r15d, dword [rsp + 0x78]
mov rbx, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x70]
mov r12d, dword [rsp + 0x68]
movzx r14d, byte [rsp + 0x61]
mov r8, qword [rsp + 0x80]
movsx rdx, byte [rsp + 0x60]
movzx eax, r14b
shl al, 2
lea ecx, [rax + r14]
mov al, 7
imul byte [rsp + 0x98]
movzx r14d, al
lea eax, [rdi*4]
sub r14b, cl
mov ecx, ebx
sub r14b, r8b
sub r14b, dil
add r14b, 6
add r14b, dl
imul ecx, dword [rsp + 0x6c]
sub eax, ecx
mov rcx, rdx
add r14b, r15b
lea edx, [r15 + rax]
add ecx, 0xf9
add edx, ecx
mov dword [rsp + 0x68], edx
imul eax, ebx, 0x23
add eax, r8d
mov ebx, ebp
imul ecx, eax, 7
sub ebx, ecx
lea rcx, str.c0ret
sub ebx, r12d
sub ebx, r13d
add ebx, 5
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0xa0]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov edx, dword [rsp + 0x70]
imul edx, ebx
movsx rax, r14b
lea ecx, [rax*4]
sub edx, ecx
sub edx, r12d
sub edx, dword [rsp + 0x80]
lea eax, [rsi + rdx]
add eax, 2
add eax, ebp
add eax, edi
mov dword [rsp + 0x64], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp byte [rsp + 0x61], bl
jae 0x14006d7d2
mov edx, 0x16
xor ecx, ecx
lea r8d, [rdx - 0xc]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, qword [rsp + 0x70]
lea edi, [rcx*4]
mov ecx, 0xffff
sub edi, eax
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
lea rcx, [rsp + 0xd0]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0xd0]
lea rcx, str.c2a1
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
xor eax, eax
lea r8, str.c0ret
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
movsx rax, r14b
lea rdx, str.fill
mov r9d, r15d
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x6c]
mov dword [rsp + 0x38], r12d
mov r12d, dword [rsp + 0x68]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], r13d
mov r13d, dword [rsp + 0x64]
mov dword [rsp + 0x20], r12d
mov ecx, r13d
call qword [sym.imp.USER32.dll_CreateWindowExA]
xor ecx, ecx
mov edx, 0x13f
lea r8d, [rcx + 0x11]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
movsx ebx, r14b
xor r14d, r14d
lea r8, [0x1400ed4fc]
lea rdx, [0x1400ed4d4]
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r13
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], ebx
mov r9d, r12d
mov ecx, edi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], ebp
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r14
movsxd rax, edi
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], ebp
mov dword [rsp + 0x30], r15d
lea r8, str.c2ret
lea rdx, str.c2a1
mov r9d, ebp
mov ecx, ebx
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], ebp
call qword [sym.imp.USER32.dll_CreateWindowExA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x4f8]
add rsp, 0x4a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret