Function at 0x140060960
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x268
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x250], rax
movsxd r15, dword [rsp + 0x2d8]
movsxd r13, dword [rsp + 0x2d0]
mov rbx, rcx
mov qword [rsp + 0x78], rcx
xor ecx, ecx
mov qword [rsp + 0xa8], r8
mov rbp, rdx
lea r8d, [rcx + 0x16]
mov edx, 0x3d3
mov r12, r9
mov dword [rsp + 0xa0], r15d
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x169
mov qword [rsp + 0xb8], rax
lea r8d, [rcx + 0x16]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdi, rax
mov qword [rsp + 0x80], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
or r14, 0xffffffffffffffff
mov rcx, rax
mov qword [rsp + 0x98], rax
mov rsi, r14
inc rsi
cmp byte [rsi + rbp], 0
jne 0x140060a01
imul esi, dword [rbx + 0x14]
mov rdx, qword [rsp + 0xa8]
mov eax, r13d
imul eax, dword [rdx + 0x18]
lea eax, [rax + rax*8]
sub esi, eax
sub esi, ecx
sub esi, edi
sub esi, 0xa
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor ecx, ecx
mov edx, 0x156
mov qword [rsp + 0x130], rax
lea r8d, [rcx + 0xc]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor edx, edx
mov r8, r12
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x38], r13d
add eax, 8
mov dword [rsp + 0x30], r15d
mov rdx, r12
add eax, esi
mov ecx, r13d
mov dword [rsp + 0x28], r15d
mov r9d, eax
mov dword [rsp + 0x6c], eax
mov dword [rsp + 0x20], r13d
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea rcx, [rsp + 0x140]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov rdx, qword [rsp + 0xa8]
mov rax, qword [rsp + 0xb8]
lea edi, [rsi*8]
sub edi, r15d
sub edi, r13d
sub edi, dword [rdx + 0x20]
add edi, dword [rbx]
mov rbx, r14
add edi, eax
inc rbx
cmp byte [r12 + rbx], 0
jne 0x140060ad5
imul r15b
movzx ecx, al
movzx eax, byte [rdx + 0x20]
mov rdx, qword [rsp + 0x78]
imul byte [rdx + 0x14]
add cl, al
sub cl, byte [rsp + 0x130]
sub cl, byte [rsp + 0x80]
add cl, 0xa
add bl, cl
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, r14
mov dword [rsp + 0x88], eax
inc rcx
cmp byte [r12 + rcx], 0
jne 0x140060b16
mov rax, qword [rsp + 0x78]
lea r8, [0x140001b00]
movzx eax, byte [rax + 0x10]
imul cl
movzx edx, al
movzx eax, byte [rsp + 0x130]
imul byte [rsp + 0x98]
movzx ecx, al
movzx eax, byte [rsp + 0x80]
imul r13b
sub cl, al
movsx rax, bl
sub cl, 3
mov r9, rax
mov qword [rsp + 0x108], rax
add dl, cl
xor ecx, ecx
add dl, byte [rsp + 0x6c]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ecx
add dl, byte [rsp + 0x90]
mov byte [rsp + 0x61], dl
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, qword [rsp + 0xa8]
movsx r10d, byte [rsp + 0x61]
mov ecx, dword [rdx]
mov qword [rsp + 0xc8], rax
mov rax, qword [rsp + 0x78]
xor edx, edx
lea r8, str.legal
imul ecx, dword [rax + 0x18]
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rdx
lea eax, [rcx + rcx*8]
mov ecx, dword [rsp + 0x90]
mov qword [rsp + 0x40], r13
mov dword [rsp + 0x38], r13d
mov dword [rsp + 0x30], edx
mov rdx, rbp
imul ecx, dword [rsp + 0x98]
sub eax, ecx
movsx ecx, bl
mov ebx, dword [rsp + 0x6c]
sub eax, 2
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x68], ecx
mov dword [rsp + 0xb0], eax
mov eax, dword [rsp + 0x88]
mov r9d, ebx
mov ecx, r10d
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov ecx, dword [rsp + 0xb0]
lea r8, [0x1400ed3b8]
mov qword [rsp + 0xe0], rax
xor eax, eax
lea rdx, str.legal
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x38], r15d
mov dword [rsp + 0x30], ecx
mov ecx, dword [rsp + 0x88]
mov r9d, r15d
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], r15d
call qword [sym.imp.USER32.dll_CreateWindowExA]
xor ecx, ecx
lea r8d, [rcx + 0x10]
mov edx, 0x316
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x100], rax
mov rcx, r14
inc rcx
cmp byte [rcx + rbp], 0
jne 0x140060ca7
mov rax, qword [rsp + 0xa8]
mov edx, r13d
imul edx, dword [rax]
mov eax, dword [rsp + 0x90]
imul eax, esi
shl eax, 3
sub edx, eax
mov rax, qword [rsp + 0x78]
add edx, dword [rax + 0x14]
add edx, dword [rsp + 0xc8]
add edx, dword [rsp + 0xb8]
sub edx, ecx
mov ecx, 2
sub edx, 0x15
mov dword [rsp + 0xa4], edx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0xd0], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, str.typewriter
mov qword [rsp + 0xc0], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, qword [rsp + 0x80]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, qword [rsp + 0x90]
xor ecx, ecx
mov dword [rsp + 0x64], eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
movsxd rcx, dword [rsp + 0x64]
mov r9d, dword [rsp + 0x68]
mov qword [rsp + 0xd8], rax
add al, 0x10
add al, byte [rsp + 0xc0]
movsx r10d, cl
lea rdx, str.master
add al, cl
movsx rcx, cl
mov r8, rbp
mov byte [rsp + 0x60], al
xor eax, eax
mov dword [rsp + 0xb4], r10d
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
movsx eax, byte [rsp + 0x61]
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x38], 8
mov dword [rsp + 0x30], r10d
mov ecx, r10d
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExA]
xor ecx, ecx
lea r8d, [rcx + 0xc]
mov edx, 0x19a
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x3a2
lea r8d, [rcx + 0xf]
mov qword [rsp + 0xf8], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x140]
mov edx, 0x104
mov qword [rsp + 0x118], rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea rcx, [rsp + 0x140]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
movzx ebx, byte [rsp + 0x60]
lea rcx, str.c5a5
mov qword [rsp + 0xf0], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.c5a5
mov r9, r13
mov r8d, ebx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
mov rcx, r14
mov dword [rsp + 0x68], eax
inc rcx
cmp byte [rcx + rbp], 0
jne 0x140060e45
mov rax, qword [rsp + 0x78]
movzx eax, byte [rax + 0x18]
imul cl
movzx ecx, byte [rsp + 0xd0]
movzx ebx, al
mov eax, dword [rsp + 0x64]
imul byte [rsp + 0x60]
sub cl, al
movzx eax, r15b
add cl, 4
imul r13b
shl cl, 2
sub cl, al
mov al, 0x31
imul byte [rsp + 0xc8]
sub cl, al
add bl, cl
mov rcx, qword [rsp + 0x90]
movzx eax, cl
add al, al
add cl, al
add cl, cl
add bl, cl
sub bl, byte [rsp + 0x98]
sub bl, byte [rsp + 0x80]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea r8, str.kohlrabi
mov rcx, rax
mov qword [rsp + 0xe8], rax
movzx eax, bl
lea rdx, str.step_son
imul cl
movzx ecx, al
movzx eax, byte [rsp + 0x68]
imul cl
shl al, 2
movzx ecx, al
xor eax, eax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], 8
mov dword [rsp + 0x38], r15d
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], eax
movsx eax, byte [rsp + 0x61]
mov dword [rsp + 0x64], ecx
mov r9d, ecx
mov ecx, 8
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExA]
movzx r8d, byte [rsp + 0x60]
movzx edx, bl
mov dword [rsp + 0x70], edx
mov rcx, r14
mov qword [rsp + 0x110], rax
nop dword [rax]
inc rcx
cmp byte [rcx + rbp], 0
jne 0x140060f40
mov rax, qword [rsp + 0xd8]
mov r9d, dword [rsp + 0xa4]
mov ebx, dword [rsp + 0xa0]
lea eax, [r9 + rax*2]
mov r15d, 3
add eax, eax
sub r15d, eax
mov eax, ebx
sub r15d, edi
mov rdi, qword [rsp + 0x78]
imul eax, dword [rsp + 0xb8]
add r15d, r15d
sub r15d, eax
mov rax, qword [rsp + 0xe0]
lea eax, [rax + rax*8]
add r15d, eax
sub r15d, dword [rsp + 0xf8]
sub r15d, dword [rsp + 0x64]
sub r15d, esi
add r15d, r13d
add r15d, dword [rdi + 0x14]
add r15d, dword [rsp + 0xc0]
add r15d, r8d
add r15d, edx
mov edx, 0x3bb
add r15d, dword [rsp + 0x98]
add r15d, dword [rsp + 0x80]
sub r15d, ecx
xor ecx, ecx
lea r8d, [rcx + 0x1d]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov eax, dword [rsp + 0xb4]
mov rdx, r14
lea r8d, [rax*8]
mov eax, dword [rsp + 0x70]
lea r9d, [rax*4]
mov dword [rsp + 0x70], r9d
inc rdx
cmp byte [rdx + rbp], 0
jne 0x140061001
mov ecx, dword [rsp + 0x90]
mov eax, ebx
imul eax, r13d
imul eax, dword [rsp + 0xb8]
imul ecx, esi
lea eax, [rax + rax*8]
sub ecx, eax
mov rax, qword [rsp + 0x118]
imul eax, dword [rsp + 0xf0]
sub ecx, eax
mov eax, dword [rsp + 0x98]
imul eax, dword [rsp + 0x80]
sub ecx, eax
mov eax, dword [rsp + 0x6c]
lea eax, [rax + rax*4]
sub ecx, eax
mov rax, qword [rsp + 0xc0]
lea eax, [rcx + rax*4]
movzx ecx, byte [rsp + 0x60]
sub eax, r8d
sub eax, dword [rsp + 0xd0]
sub eax, ecx
add eax, r9d
add edx, eax
mov rax, qword [rsp + 0xd8]
add edx, dword [rdi + 0x10]
add eax, 0x21
add edx, dword [rsp + 0xe8]
add eax, edx
mov dword [rsp + 0xe0], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
xor ecx, ecx
movsxd rbx, eax
mov qword [rsp + 0x28], rcx
lea r8, [0x140001b00]
movsx rdi, bl
xor edx, edx
mov dword [rsp + 0x20], ecx
mov r9, rdi
call qword [sym.imp.KERNEL32.dll_CreateThread]
movsx ebx, bl
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor eax, eax
lea r8, [0x140001b00]
mov qword [rsp + 0x28], rax
mov r9, rdi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, r14
mov r9, rax
nop dword [rax]
inc rcx
cmp byte [rcx + rbp], 0
jne 0x1400610f0
mov rax, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x110]
mov r8, qword [rsp + 0xc0]
imul r9d, ebx
imul ecx, dword [rax + 8]
mov rax, qword [rsp + 0x98]
imul eax, dword [rsp + 0x80]
sub edx, eax
mov rax, qword [rsp + 0xb8]
lea eax, [rax + rax*2]
lea edx, [rdx + rdx*4]
sub r8d, eax
lea eax, [r8 + r8*2]
movzx r8d, byte [rsp + 0x60]
lea edx, [rax + rdx*2]
mov rax, qword [rsp + 0xd8]
imul eax, r8d
add eax, dword [rsp + 0x90]
lea r8d, [rdx + rax*4]
movzx eax, byte [rsp + 0x68]
mov edx, dword [rsp + 0xb4]
imul eax, dword [rsp + 0x70]
sub r8d, eax
mov eax, dword [rsp + 0xe0]
imul eax, r15d
sub r8d, eax
mov rax, qword [rsp + 0xe8]
add ecx, r8d
imul eax, dword [rsp + 0x64]
add ecx, eax
mov rax, qword [rsp + 0xc8]
imul eax, dword [rsp + 0xb0]
add ecx, eax
mov rax, qword [rsp + 0x100]
imul eax, dword [rsp + 0xa4]
add ecx, eax
movsx rax, byte [rsp + 0x61]
add ecx, r9d
add ecx, eax
lea eax, [rdx*8]
sub ecx, eax
mov rax, qword [rsp + 0xa8]
sub ecx, dword [rsp + 0xf0]
sub ecx, dword [rax + 0x18]
sub ecx, dword [rsp + 0x88]
sub ecx, dword [rsp + 0x6c]
sub ecx, esi
add ecx, dword [rsp + 0xa0]
add ecx, r13d
add ecx, dword [rsp + 0x108]
add ecx, dword [rsp + 0xd0]
inc r14
cmp byte [r12 + r14], 0
jne 0x140061200
lea eax, [rcx - 0x19]
add eax, r14d
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x268
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret