Function at 0x14007d650
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov rbx, r9
mov r14, r8
mov rsi, rdx
mov r15d, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r12, rax
add eax, r15d
or rdi, 0xffffffffffffffff
mov r10, rdi
mov byte [rsp + 0xc0], al
inc r10
cmp byte [rbx + r10], 0
jne 0x14007d692
movzx eax, r14b
mov rcx, rdi
imul r10b
movzx r14d, al
movzx eax, r12b
imul r12b
add r14b, al
add r14b, r15b
inc rcx
cmp byte [rsi + rcx], 0
jne 0x14007d6b7
sub r14b, cl
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
lea r8d, [rcx + 0xe]
mov edx, 0x178
mov rbp, rax
mov qword [rsp + 0x68], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
lea r8d, [rcx + 0x10]
mov edx, 0x143
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, rdi
mov r9, rax
mov qword [rsp + 0x78], rax
inc rcx
cmp byte [rsi + rcx], 0
jne 0x14007d703
mov r8, qword [rsp + 0xd0]
movzx eax, r12b
mov r13d, 4
sub r13b, r9b
shl al, 2
sub bpl, al
sub bpl, r14b
add bpl, r8b
add bpl, r15b
sub bpl, cl
sub r13b, bpl
shl r13b, 2
cmp r14b, r15b
jae 0x14007d763
xor ecx, ecx
mov edx, 0x297
lea r8d, [rcx + 0x19]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov r8, qword [rsp + 0xd0]
mov r9, qword [rsp + 0x78]
movzx r10d, bpl
mov rax, rdi
mov dword [rsp + 0x64], r10d
nop
inc rax
cmp byte [rbx + rax], 0
jne 0x14007d770
movzx ecx, byte [rsp + 0xc0]
lea ebp, [r12*2 + 1]
imul ebp, r12d
sub ebp, r10d
sub ebp, r8d
sub ebp, dword [rsp + 0x68]
add ebp, r15d
sub ebp, eax
mov rax, rdi
sub ebp, 2
inc rax
cmp byte [rbx + rax], 0
jne 0x14007d7a2
imul eax, ecx
mov rcx, qword [rsp + 0x70]
movzx r14d, r14b
imul eax, r12d
mov rdx, rdi
imul eax, r15d
lea eax, [rax + rcx*8]
sub eax, r9d
add eax, 0xffffffec
add eax, r8d
mov dword [rsp + 0x60], eax
inc rdx
cmp byte [rbx + rdx], 0
jne 0x14007d7d2
imul edx, r8d
mov eax, r14d
mov ebx, r15d
imul eax, r9d
imul edx, r12d
lea ecx, [rax + rax*2]
shl ecx, 6
sub ebx, ecx
sub ebx, edx
inc rdi
cmp byte [rsi + rdi], 0
jne 0x14007d7f7
mov dword [rsp + 0x30], r15d
xor r9d, r9d
mov r8, r12
mov rdx, r12
mov rcx, r12
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r10d
sub ebx, edi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov dword [rsp + 0x30], r14d
xor r9d, r9d
mov r8, r12
mov rdx, r12
mov rcx, r12
mov dword [rsp + 0x28], r15d
mov esi, eax
mov dword [rsp + 0x20], 8
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov r12d, dword [rsp + 0x60]
sub r14d, ebx
mov edi, eax
mov rax, qword [rsp + 0x70]
movzx edx, r13b
mov r13d, dword [rsp + 0x64]
imul r14d, dword [rsp + 0x68]
lea ecx, [r14 + rax*4]
mov r14, qword [rsp + 0xd0]
sub ecx, r14d
lea r14d, [r15 + 0xf]
sub ecx, r12d
add ecx, edi
add edx, ecx
add edx, ebp
add r14d, edx
cmp ebp, r13d
ja 0x14007d8b8
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ebp, ebp
lea r8, [0x140001b00]
mov r9d, edi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
jmp 0x14007d8ba
xor ebp, ebp
mov rdx, qword [rsp + 0x78]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
movzx eax, byte [rsp + 0xc0]
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x38], r14d
mov dword [rsp + 0x30], eax
lea r8, str.tugboat
lea rdx, [0x1400ed3b8]
mov r9d, r12d
mov ecx, esi
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_CreateWindowExA]
xor ecx, ecx
mov edx, 0x2f9
lea r8d, [rcx + 0xf]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rax, qword [rsp + 0x68]
mov rbx, qword [rsp + 0xc8]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret