Function at 0x1400d9770
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1d0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov rsi, rdx
mov r13, rcx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r15d, r13d
lea rcx, [rsp + 0xb0]
mov edx, 0x104
mov qword [rsp + 0x98], rax
imul r15d, eax
add r15d, 8
lea edi, [r15 - 2]
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
mov dword [rsp + 0x64], eax
xor eax, eax
mov qword [rsp + 0x28], rax
lea r8, [0x140001b00]
mov r9d, edi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
movzx r12d, r13b
mov ecx, 0xffff
mov r14, rax
lea eax, [r12 + rbx]
add eax, r13d
mov dword [rsp + 0x68], eax
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
mov ebp, eax
mov dword [rsp + 0x80], ebp
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor ebx, ebx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbx
mov ecx, r15d
lea rdx, [0x1400ed3f4]
mov r9d, r12d
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x38], r15d
mov dword [rsp + 0x30], edi
mov r8, rsi
mov ecx, r15d
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], r12d
mov qword [rsp + 0x90], rax
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea r8, [0x140001b00]
mov r9d, ebp
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 0xffff
mov rbx, rax
mov qword [rsp + 0x88], rax
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor ecx, ecx
mov edx, 0x166
lea r8d, [rcx + 0x13]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov edx, ebx
movsx ebx, bpl
imul edx, r14d
shl edx, 2
sub ebx, edx
sub ebx, edi
sub ebx, dword [rsp + 0x70]
mov dword [rsp + 0x7c], ebx
cmp r15d, ebx
ja 0x1400d98ea
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
mov edx, 0x28
xor ecx, ecx
lea r8d, [rdx - 0x18]
mov word [rsp + 0x60], ax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r8, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x90]
mov dword [rsp + 0x30], r15d
xor r9d, r9d
mov rdx, r14
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ecx, ecx
mov edx, 0x1c1
mov dword [rsp + 0x78], eax
lea r8d, [rcx + 0xd]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
movzx eax, byte [rsp + 0x70]
or rbx, 0xffffffffffffffff
mov rdx, rbx
inc rdx
cmp byte [rsi + rdx], 0
jne 0x1400d9950
imul edx, dword [rsp + 0x98]
movsx ecx, byte [rsp + 0x60]
imul ecx, eax
mov eax, 3
sub eax, dword [rsp + 0x68]
lea ebp, [rcx + rax*2]
xor ecx, ecx
sub ebp, edx
xor edx, edx
sub ebp, r14d
add ebp, dword [rsp + 0x64]
add ebp, r13d
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov edx, 0x32
lea r8d, [rdx - 0x1f]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
lea r8d, [rcx + 0x16]
mov edx, 0x249
mov qword [rsp + 0xa0], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor eax, eax
lea r8, [0x140001b00]
mov qword [rsp + 0x28], rax
movzx r9d, r13b
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rax, qword [rsp + 0x70]
mov ecx, ebp
imul ecx, eax
imul ecx, ecx, 0xfffffffb
mov dword [rsp + 0x64], ecx
cmp r13b, 4
jae 0x1400d9a12
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
mov edx, 0x134
lea r8d, [rcx + 0x1c]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, dword [rsp + 0x64]
mov rax, qword [rsp + 0x70]
inc rbx
cmp byte [rsi + rbx], 0
jne 0x1400d9a12
imul edi, dword [rsp + 0x7c]
movsxd rdx, dword [rsp + 0x80]
imul ebx, dword [rsp + 0x98]
add r13d, 0x16
shl edi, 2
sub edi, r14d
dec edi
imul edi, eax
imul r12d, r15d
mov eax, edx
shl r12d, 3
imul eax, dword [rsp + 0x68]
sub edi, r12d
sub edi, eax
lea eax, [rcx + rcx*4]
sub edi, ebx
add edi, eax
movsx rax, dl
add edi, eax
movsx rax, byte [rsp + 0x60]
add edi, eax
movzx eax, byte [rsp + 0x70]
sub edi, dword [rsp + 0xa0]
sub edi, dword [rsp + 0x78]
sub edi, dword [rsp + 0x88]
sub edi, r14d
add edi, eax
lea eax, [r15 - 2]
add edi, r13d
add edi, ebp
add edi, dword [rsp + 0x90]
add eax, edi
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x220]
add rsp, 0x1d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret