Function at 0x1400b6aa0
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x270
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov r14, r9
mov r13, r8
mov rsi, rdx
mov qword [rsp + 0x48], rdx
mov r12, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
mov r15d, eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0x40], rax
cmp r15b, 0x40
jl 0x1400b6d14
mov qword [rsp + 0x268], rbx
mov qword [rsp + 0x260], rbp
mov qword [rsp + 0x258], rdi
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rdi, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x100]
mov edx, 0x104
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov ebp, esi
mov eax, r14d
sub eax, ebx
movzx esi, r12b
lea r8, str.economics
imul ebp, r12d
sub sil, dil
add eax, r13d
add ebp, r13d
add ebp, ebx
add eax, r12d
add sil, 0x39
mov dword [rsp + 0x38], eax
add sil, bl
lea rbx, [0x1400ed8b4]
mov qword [rsp + 0x30], rbx
lea rcx, [rsp + 0xb0]
xor edi, edi
movzx r9d, sil
mov edx, ebp
mov byte [rsp + 0x28], 4
mov qword [rsp + 0x20], rdi
call fcn.1400dc630
mov rcx, rbx
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rsp + 0x60], xmm0
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rsp + 0x50], xmm1
movups xmm1, xmmword [rax + 0x30]
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x90], xmm1
movsd xmm0, qword [rax + 0x40]
movsd qword [rsp + 0xa0], xmm0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
movzx eax, byte [rsp + 0x40]
movups xmm0, xmmword [rsp + 0x50]
psrldq xmm0, 8
imul bpl
movzx ecx, al
add cl, cl
lea r8d, [rcx + rax]
movzx eax, r12b
movd ecx, xmm0
add r8b, r8b
inc r8b
imul r8b
movzx ebx, al
sub bl, cl
sub bl, 9
add bl, sil
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x100]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea r8d, [rdi + 0xf]
mov edx, 0x2a3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea r9d, [rdi + 0x40]
lea r8, [0x140001b00]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
movsxd r9, ebp
movsx r8, bl
lea rdx, [0x1400ed8b4]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
movzx ecx, r15b
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
call qword [sym.imp.KERNEL32.dll_GetLastError]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x100]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x100]
lea rcx, str.economics
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
lea rcx, str.lamb
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x258]
mov rbp, qword [rsp + 0x260]
mov rbx, qword [rsp + 0x268]
imul r14d, r13d
imul r14d, esi
imul r14d, r12d
sub r14d, eax
movzx eax, r15b
add eax, 0x44
add eax, r14d
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x270
pop r15
pop r14
pop r13
pop r12
pop rsi
ret