Function at 0x14001d950
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x320]
sub rsp, 0x420
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x310], rax
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
mov rbx, rdx
mov r8b, 2
mov edx, 0x40
movaps xmmword [rbp - 0x60], xmm0
movaps xmmword [rbp - 0x50], xmm1
movups xmm0, xmmword [rcx + 0x20]
movsd xmm1, qword [rcx + 0x30]
lea rcx, [rbp + 0x20]
movaps xmmword [rbp - 0x40], xmm0
movsd qword [rbp - 0x30], xmm1
call fcn.1400bf030
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x20], xmm0
movsd xmm0, qword [rax + 0x20]
movups xmmword [rbp - 0x10], xmm1
movsd qword [rbp], xmm0
call fcn.1400bab40
lea rcx, [rbp + 0x200]
mov edx, 0x104
movzx r14d, al
mov byte [rsp + 0x40], al
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
or rdi, 0xffffffffffffffff
mov rsi, rax
mov qword [rbp - 0x68], rax
mov rcx, rdi
nop dword [rax + rax]
inc rcx
cmp byte [rbx + rcx], 0
jne 0x14001da00
imul ecx, dword [rbp - 0x30]
mov r13d, dword [rbp - 0x18]
xor edx, edx
add r13d, 0xffffff80
mov r8d, 0x140
add r13d, ecx
lea rcx, [rbp + 0xc0]
call fcn.1400e27d0
lea rdx, [rbp + 0xc0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
movsx rdx, r14b
mov rcx, rdi
mov qword [rsp + 0x60], rax
nop dword [rax + rax]
inc rcx
cmp byte [rbx + rcx], 0
jne 0x14001da50
mov r14d, dword [rbp - 0x40]
shl ecx, 6
lea r8, [0x1400ed3f4]
sub ecx, edx
mov edx, dword [rbp - 0x50]
mov r9d, r13d
add edx, 2
add ecx, edx
xor edx, edx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x48], ecx
mov rcx, rsi
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rax
call fcn.14006ce60
mov dword [rsp + 0x50], eax
cmp r13d, r14d
jb 0x14001dac5
mov edx, 0x76
xor ecx, ecx
lea r8d, [rdx - 0x5a]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, rax
call fcn.1400b25c0
call fcn.1400b5830
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rdx, rax
call fcn.14008ee80
mov r14, rdi
nop dword [rax + rax]
inc r14
cmp byte [rbx + r14], 0
jne 0x14001dad0
mov r15, qword [rbp - 0x58]
neg r14b
mov rax, rdi
shl r14b, 7
sub r14b, r13b
nop dword [rax + rax]
inc rax
cmp byte [r15 + rax], 0
jne 0x14001daf0
add r14b, al
mov rcx, rbx
add r14b, byte [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
lea rcx, [rbp + 0x200]
mov edx, 0x104
mov qword [rbp - 0x80], rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov r12, rax
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
mov rdx, qword [rbp - 0x80]
lea rcx, str.c2a2
movzx eax, ax
mov qword [rsp + 0x28], rcx
mov r9d, eax
mov r8, r12
movzx ecx, r14b
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x20], 8
call fcn.1400c42d0
movsx ecx, byte [rsp + 0x40]
mov rdx, rax
mov qword [rsp + 0x58], rax
cmp dword [rsp + 0x48], ecx
jb 0x14001e04d
mov r12, rdi
inc r12
cmp byte [r15 + r12], 0
jne 0x14001db81
mov eax, esi
mov ecx, 0x30
sub ecx, r13d
imul eax, dword [rbp]
add ecx, ecx
sub ecx, eax
sub ecx, edx
sub ecx, dword [rsp + 0x78]
sub ecx, dword [rsp + 0x60]
add r12d, ecx
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
mov ecx, r12d
movzx edx, al
mov dword [rsp + 0x4c], eax
call fcn.1400776f0
movsx rdx, r14b
mov rsi, rdi
mov dword [rsp + 0x54], eax
mov qword [rbp - 0x70], rdx
inc rsi
cmp byte [r15 + rsi], 0
jne 0x14001dbd3
mov rax, rdi
inc rax
cmp byte [rbx + rax], 0
jne 0x14001dbe0
movsx r8, byte [rsp + 0x40]
mov ecx, dword [rsp + 0x44]
imul esi, eax
mov eax, dword [rsp + 0x60]
lea ecx, [rcx*4 - 0x40]
imul eax, dword [rsp + 0x50]
sub ecx, eax
mov eax, dword [rbp - 0x68]
imul eax, r13d
sub ecx, eax
add esi, ecx
sub esi, r8d
sub esi, dword [rbp - 8]
sub esi, dword [rsp + 0x58]
sub esi, dword [rsp + 0x78]
add esi, edx
add esi, r12d
mov r8d, esi
call fcn.1400962f0
mov rcx, rdi
mov qword [rbp - 0x78], rax
inc rcx
cmp byte [rax + rcx], 0
jne 0x14001dc35
movzx eax, byte [rsp + 0x54]
imul cl
movzx ecx, al
movzx eax, byte [rsp + 0x58]
imul r12b
add cl, al
sub cl, byte [rsp + 0x48]
sub cl, 8
mov byte [rsp + 0x42], cl
call fcn.1400d3490
mov r9d, dword [rsp + 0x4c]
movzx r11d, r9b
mov qword [rsp + 0x70], rax
mov rcx, rdi
inc rcx
cmp byte [r15 + rcx], 0
jne 0x14001dc73
mov rdx, rdi
inc rdx
cmp byte [rax + rdx], 0
jne 0x14001dc80
add ecx, dword [rbp - 0x40]
mov eax, dword [rbp - 0x10]
mov r9, qword [rbp - 0x68]
imul eax, r9d
mov r10d, dword [rsp + 0x44]
add ecx, edx
mov r8d, 0x1f
sub r8d, eax
mov eax, r10d
add r8d, r8d
imul eax, dword [rsp + 0x50]
sub r8d, eax
mov rax, qword [rbp - 0x78]
sub r8d, r11d
add r8d, ecx
mov rcx, rdi
add r8d, dword [rsp + 0x58]
add r8d, dword [rsp + 0x48]
mov dword [rsp + 0x68], r8d
inc rcx
cmp byte [rax + rcx], 0
jne 0x14001dcd1
mov r15d, dword [rsp + 0x54]
movzx eax, sil
imul cl
movzx edx, al
movzx eax, byte [rsp + 0x60]
imul byte [rsp + 0x78]
movzx ecx, al
movzx eax, r14b
imul cl
movzx ecx, al
movzx eax, byte [rbp - 8]
imul byte [rbp - 0x5c]
shl al, 6
sub al, cl
sub al, dl
sub al, r10b
sub al, r15b
sub al, r9b
sub al, byte [rsp + 0x40]
sub al, 8
add al, r13b
add al, byte [rsp + 0x4c]
mov byte [rsp + 0x41], al
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rcx, rdi
mov rdx, rax
mov qword [rbp - 0x78], rax
mov rax, qword [rsp + 0x70]
nop word [rax + rax]
inc rcx
cmp byte [rax + rcx], 0
jne 0x14001dd40
imul ecx, r15d
lea eax, [r12*8]
mov r15, rdi
sub eax, ecx
nop word [rax + rax]
inc r15
cmp byte [rbx + r15], 0
jne 0x14001dd60
movsx r8, byte [rsp + 0x40]
mov rcx, qword [rbp - 0x80]
xor r9d, r9d
add eax, r8d
movzx r8d, byte [rsp + 0x41]
add r15d, eax
add r15d, dword [rbp - 0x70]
add r15d, dword [rbp - 0x30]
add r15d, dword [rsp + 0x44]
add r15d, dword [rsp + 0x50]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rdx
mov edx, dword [rsp + 0x68]
call fcn.14008ea00
mov rcx, rdi
mov qword [rbp - 0x70], rax
nop
inc rcx
cmp byte [rax + rcx], 0
jne 0x14001ddb0
movzx r8d, byte [rsp + 0x42]
mov r11, qword [rbp - 0x80]
mov r10, qword [rsp + 0x78]
mov al, 7
mov qword [rbp + 8], 0
imul cl
movzx edx, al
mov eax, dword [rsp + 0x54]
add al, 0x1f
mov ecx, 1
add al, al
sub cl, r8b
sub r13b, al
movzx eax, r11b
add r13b, r13b
imul cl
mov rcx, qword [rsp + 0x70]
add r13b, al
movzx eax, byte [rsp + 0x60]
imul byte [rbp - 0x40]
sub r13b, al
mov rax, rdi
sub r13b, dl
movzx edx, byte [rsp + 0x41]
sub r13b, sil
mov esi, dword [rsp + 0x68]
sub r13b, byte [rsp + 0x44]
sub r13b, r12b
sub r13b, r10b
sub r13b, byte [rbp - 0x68]
sub r13b, dl
add r13b, sil
add r13b, byte [rbp - 0x60]
inc rax
cmp byte [rcx + rax], 0
jne 0x14001de31
inc eax
mov rcx, rdi
imul eax, r11d
inc rcx
cmp byte [rbx + rcx], 0
jne 0x14001de43
imul ecx, dword [rbp - 0x50]
mov r9d, dword [rsp + 0x4c]
mov dword [rsp + 0x30], 0x10
add eax, ecx
movzx ecx, r9b
mov r9, qword [rbp - 0x78]
mov qword [rbp + 0x18], r9
mov qword [rsp + 0x28], r11
imul ecx, dword [rsp + 0x58]
add ecx, 0x12
movsd xmm1, qword [rbp + 0x18]
movsd qword [rbp + 0x30], xmm1
lea ecx, [rax + rcx*4]
mov eax, r9d
lea r9, [rbp + 0x20]
imul eax, r15d
add ecx, eax
movsx rax, dl
add ecx, eax
movzx eax, r8b
mov r8, r10
add ecx, eax
lea rax, str.believe
movzx edx, r13b
sub ecx, dword [rbp - 0x18]
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x10], ecx
lea rcx, [rbp + 0x70]
movups xmm0, xmmword [rbp + 8]
movaps xmmword [rbp + 0x20], xmm0
call fcn.1400a6ef0
movsx r9, byte [rsp + 0x40]
lea r8, [0x140001b00]
xor edx, edx
xor ecx, ecx
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rbp + 0x20], xmm0
movaps xmmword [rbp + 0x30], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmm1, xmmword [rax + 0x30]
movaps xmmword [rbp + 0x40], xmm0
movaps xmmword [rbp + 0x50], xmm1
movsd xmm0, qword [rax + 0x40]
xor eax, eax
movsd qword [rbp + 0x60], xmm0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rbp - 0x70]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, qword [rsp + 0x70]
lea r9, str.c6a5
lea r8, str.c8ret
lea rdx, str.c11a3
mov qword [rsp + 0x20], rax
call fcn.1400c4a00
inc rdi
cmp byte [rbx + rdi], 0
jne 0x14001df51
movzx eax, byte [rbp + 0x10]
mov rbx, qword [rsp + 0x70]
imul r15b
mov r15, qword [rsp + 0x78]
movzx ecx, al
movzx eax, sil
imul cl
movzx ecx, al
movzx eax, r15b
imul cl
movzx ecx, al
mov al, 7
imul cl
lea ecx, [rax - 1]
movzx eax, byte [rbp - 0x80]
imul cl
movzx esi, al
movzx eax, byte [rsp + 0x40]
imul byte [rbp]
sub sil, al
movzx eax, byte [rbp - 0x40]
imul byte [rsp + 0x48]
add sil, al
movzx eax, byte [rsp + 0x4c]
imul byte [rsp + 0x42]
add sil, al
mov eax, 0x3a
sub al, byte [rsp + 0x60]
add al, al
add sil, al
sub sil, bl
sub sil, byte [rsp + 0x58]
add sil, byte [rbp + 0x20]
add sil, r12b
add sil, byte [rbp - 0x30]
add sil, r15b
add sil, r14b
sub sil, dil
call qword [sym.imp.KERNEL32.dll_GetTickCount]
movsx edx, r14b
mov edi, eax
mov rax, qword [rsp + 0x58]
imul ecx, r15d, 7
imul edx, dword [rbp - 0x40]
xor r8d, r8d
imul edx, dword [rsp + 0x44]
imul eax, r12d
sub edx, eax
sub edx, ecx
movsx rcx, r13b
sub edx, ecx
xor ecx, ecx
sub edx, dword [rbp - 0x78]
add ebx, edx
mov edx, 0x35e
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea r9d, [rbx + 2]
lea r8, str.c9ret
mov qword [rsp + 0x30], rax
lea rax, str.c8a0
mov edx, edi
mov qword [rsp + 0x28], rax
movzx ecx, sil
mov qword [rsp + 0x20], 0
call fcn.1400aa2f0
lea rax, str.joey
mov rcx, qword [rbp + 0x310]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x470]
add rsp, 0x420
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret