Function at 0x140093120
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x248
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rax, qword [rsp + 0x2b8]
mov rdi, qword [rsp + 0x2b0]
mov rbp, qword [rsp + 0x2c0]
or rsi, 0xffffffffffffffff
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x70], r9
mov r14, r8
mov qword [rsp + 0x98], r8
mov r15, rdx
mov qword [rsp + 0x60], rdx
mov r13, rcx
mov qword [rsp + 0x90], rcx
mov rbx, rsi
inc rbx
cmp byte [rdi + rbx], 0
jne 0x140093190
imul ebx, dword [r8 + 0x20]
mov r12d, 2
imul ebx, dword [r9]
sub ebx, eax
add ebx, ecx
mov rcx, rsi
sub r12d, ebx
inc rcx
cmp byte [rdi + rcx], 0
jne 0x1400931b2
imul eax, ebx
add eax, dword [r8 + 0x10]
sub eax, edx
add eax, r13d
sub eax, ecx
mov ecx, r12d
mov dword [rsp + 0xb8], eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor ecx, ecx
lea r8d, [rcx + 6]
mov edx, 0x312
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LockResource]
mov dword [rsp + 0xe0], eax
mov rax, rsi
nop dword [rax]
inc rax
cmp byte [rdi + rax], 0
jne 0x140093200
mov rcx, qword [rsp + 0x70]
mov r15d, r13d
mov r8, rdi
mov rdx, rdi
imul eax, dword [rcx + 0x20]
mov ecx, r12d
sub r15d, eax
xor eax, eax
sub r15d, dword [rsp + 0x60]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
add r15d, dword [r14]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], 4
mov dword [rsp + 0x38], ebx
add r15d, ebx
mov dword [rsp + 0x30], ebx
mov r9d, r15d
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], r15d
call qword [sym.imp.USER32.dll_CreateWindowExA]
xor ecx, ecx
mov edx, 0x2c3
lea r8d, [rcx + 0x13]
mov qword [rsp + 0x68], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r8d, eax
mov r9, rax
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0x68]
imul r8d, eax
lea ecx, [rax + rax*8]
imul eax, ebx, 0xfffffff4
mov dword [rsp + 0x88], r8d
sub eax, ecx
mov rcx, rsi
add eax, 0xfffffffa
add eax, r13d
add eax, dword [r14 + 8]
add eax, r9d
add eax, r15d
mov dword [rsp + 0x8c], eax
inc rcx
cmp byte [rcx + rbp], 0
jne 0x1400932b7
movzx eax, bl
imul cl
movzx r14d, al
movzx eax, r8b
imul r12b
movzx ecx, al
movzx eax, r9b
imul cl
add al, al
sub r14b, al
mov rax, rsi
add r14b, r14b
add r14b, r13b
inc rax
cmp byte [rdi + rax], 0
jne 0x1400932e7
sub r14b, al
mov rcx, rsi
inc rcx
cmp byte [rcx + rbp], 0
jne 0x1400932f6
mov rax, rsi
inc rax
cmp byte [rdi + rax], 0
jne 0x140093302
imul cl
movzx ecx, al
movzx eax, r12b
imul cl
movzx r13d, al
movzx eax, r15b
imul byte [rsp + 0xe0]
movzx ecx, al
movzx eax, byte [rsp + 0x90]
imul byte [rsp + 0x60]
sub al, cl
mov rcx, qword [rsp + 0x70]
sub al, byte [rcx + 0x2c]
add r13b, al
movzx eax, r8b
shl al, 3
lea ecx, [rax + r8]
mov rax, qword [rsp + 0x98]
sub r13b, cl
sub r13b, byte [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
movsx r8d, r14b
movsx rcx, r13b
mov edx, r8d
mov dword [rsp + 0x78], eax
shl ecx, 2
sub edx, ecx
movsx ecx, r13b
add edx, eax
add edx, dword [rsp + 0x8c]
imul ecx, r8d
shl ecx, 2
mov dword [rsp + 0xa8], edx
sub ecx, eax
add ecx, dword [rsp + 0x8c]
mov dword [rsp + 0xac], ecx
cmp r12d, 4
jne 0x140093546
mov rcx, qword [rsp + 0xa8]
mov r12, qword [rsp + 0x90]
movzx eax, r13b
shr rcx, 0x20
shl bl, 2
imul cl
mov rcx, qword [rsp + 0x70]
movzx ebp, al
movzx eax, byte [rsp + 0x60]
imul byte [rcx]
movzx ecx, al
movzx eax, r12b
imul cl
add bpl, al
mov rax, qword [rsp + 0x68]
add bpl, bl
mov ebx, dword [rsp + 0x88]
sub bpl, r15b
sub bpl, bl
sub bpl, byte [rsp + 0x80]
sub bpl, al
sub bpl, r14b
add bpl, 0x1a
add bpl, byte [rsp + 0xb8]
add bpl, byte [rsp + 0xa0]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea r8, [0x140001b00]
mov qword [rsp + 0x68], rax
xor eax, eax
mov r9d, ebx
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
lea r8d, [rcx + 0xd]
mov edx, 0x11b
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0xf0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
inc rsi
cmp byte [rdi + rsi], 0
jne 0x140093476
movzx eax, byte [rsp + 0x60]
mov edi, dword [rsp + 0x78]
mov ecx, 1
sub cl, bl
xor edx, edx
mov r8d, 0x140
imul cl
movzx ebx, al
movzx eax, r13b
lea rcx, [rsp + 0xf0]
imul dil
shl al, 2
add bl, al
mov rax, qword [rsp + 0x98]
add bl, byte [rax + 0x28]
sub bl, byte [rsp + 0xa0]
add bl, r12b
add bl, byte [rsp + 0x68]
sub bl, sil
call fcn.1400e27d0
lea rdx, [rsp + 0xf0]
lea rcx, [0x1400ed3b4]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
xor eax, eax
movsx edx, bl
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], 4
mov dword [rsp + 0x38], r15d
mov dword [rsp + 0x30], edx
movsx r8d, bpl
lea r9d, [rax + 4]
lea rdx, str.angora
mov dword [rsp + 0x28], r8d
lea r8, str.pressure
movsx ecx, r14b
mov dword [rsp + 0x20], edi
call qword [sym.imp.USER32.dll_CreateWindowExA]
xor ecx, ecx
lea r8d, [rcx + 0xe]
mov edx, 0x187
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x248
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret