Function at 0x1400bfd70
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1c0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
lea r15d, [rdx + rcx]
movsx r13d, cl
mov edi, ecx
mov r14d, r13d
mov ebp, edx
mov eax, r13d
imul edi, r15d
xor ebx, ebx
mov r12, rdx
mov rsi, rcx
imul r14d, r15d
imul ebp, ecx
imul eax, ecx
add edi, r14d
add ebp, r15d
mov dword [rsp + 0x60], eax
cmp edi, 0x10
jg 0x1400bfe15
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea r8, [0x140001b00]
mov r9d, r15d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x70]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
movzx eax, sil
imul r14b
movzx ecx, al
movzx eax, sil
imul cl
movzx ecx, bpl
shl cl, 4
lea ebx, [rax + 7]
mov eax, dword [rsp + 0x60]
add eax, eax
add bl, cl
sub eax, r12d
add eax, r13d
add eax, esi
add eax, edi
add eax, ebp
mov dword [rsp + 0x60], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor ecx, ecx
mov edx, 0x37f
mov qword [rsp + 0x68], rax
lea r8d, [rcx + 0xe]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
movzx ecx, bl
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x70]
lea rcx, str.mustard
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
mov ecx, r15d
mov ebx, eax
mov dword [rsp + 0x64], eax
xor eax, eax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x38], 4
mov dword [rsp + 0x30], edi
lea r8, str.c1ret
lea rdx, str.c1ret
mov r9d, r13d
mov ecx, r14d
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], edi
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov r15d, dword [rsp + 0x60]
cmp ebx, r15d
jle 0x1400bff14
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetLastError]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea ecx, [r14 + 6]
movzx eax, r12b
lea r8, str.inlay
lea rdx, str.c1ret
imul cl
movzx ebx, al
mov al, 0xf
imul sil
sub bl, al
xor eax, eax
sub bl, byte [rsp + 0x68]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rax
sub bl, r15b
mov dword [rsp + 0x38], r14d
sub bl, dil
mov dword [rsp + 0x30], ebp
lea r9d, [rax + 0x10]
lea ecx, [rax + 4]
add bl, 3
add bl, byte [rsp + 0x64]
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], edi
call qword [sym.imp.USER32.dll_CreateWindowExA]
movzx eax, bl
cmp edi, eax
je 0x1400bffbe
xor ecx, ecx
mov edx, 0xa2
lea r8d, [rcx + 0xd]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x328
lea r8d, [rcx + 0xf]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
lea rax, str.c1a0
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x210]
add rsp, 0x1c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret