Function at 0x140023410
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
mov rbx, r8
mov r15, rdx
mov qword [rbp - 0x20], rcx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov ecx, 0xffff
mov rdi, rax
mov qword [rbp - 0x68], rax
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
mov r14d, eax
mov dword [rsp + 0x68], eax
lea rax, [0x1400ed3f4]
lea rcx, [0x1400ed830]
mov r8, rdi
mov rdx, r12
mov r9d, r14d
mov qword [rsp + 0x20], rax
call fcn.140063d10
mov r13d, r15d
mov dword [rbp - 0x40], 2
sub r13d, r12d
movzx esi, al
or rdi, 0xffffffffffffffff
mov byte [rsp + 0x60], al
lea edx, [r14 + r14]
mov dword [rsp + 0x64], esi
mov rcx, rdi
inc rcx
cmp byte [rbx + rcx], 0
jne 0x1400234b6
lea eax, [rdx + r15]
mov edx, 0x98
add eax, esi
sub eax, ecx
xor ecx, ecx
lea r8d, [rcx + 0xc]
mov dword [rbp + 4], eax
mov dword [rbp - 0x3c], eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, esi
mov qword [rbp - 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, r13d
movaps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp - 0x10], xmm0
mov qword [rbp - 0x18], rax
call fcn.140096a00
mov qword [rsp + 0x78], rax
cmp r13d, r14d
jge 0x140023740
xor ecx, ecx
mov edx, 0x1e4
lea r8d, [rcx + 0x15]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r8, r12
mov rcx, r14
mov rsi, rax
mov qword [rbp - 0x10], rax
call fcn.140088220
movzx edx, byte [rsp + 0x60]
mov qword [rbp - 0x70], rax
movzx eax, r14b
imul sil
movzx esi, byte [rbp - 0x3c]
movzx ecx, sil
add cl, cl
add sil, cl
mov rcx, rdi
shl sil, 2
sub sil, al
mov rax, qword [rbp - 0x68]
sub sil, r13b
sub sil, r12b
sub sil, 3
add sil, byte [rsp + 0x68]
add sil, r15b
add sil, al
add sil, dl
nop dword [rax]
inc rcx
cmp byte [rbx + rcx], 0
jne 0x140023580
imul ecx, eax
mov rax, qword [rbp - 0x18]
xor r8d, r8d
lea eax, [rax + rax*2]
mov qword [rbp + 0x10], r8
lea ecx, [rcx + rax*4]
lea eax, [r15 - 6]
sub ecx, dword [rsp + 0x64]
sub ecx, r14d
sub ecx, r13d
add eax, ecx
mov ecx, dword [rsp + 0x78]
mov dword [rbp + 8], eax
lea eax, [r15 + r15*2]
imul ecx, r14d
imul ecx, r12d
lea ecx, [rcx + rax*4]
mov dword [rbp + 0x18], ecx
mov rcx, rdi
nop dword [rax]
inc rcx
cmp byte [rbx + rcx], r8b
jne 0x1400235d0
imul ecx, r13d
mov qword [rsp + 0x28], r8
mov dword [rsp + 0x20], r8d
lea eax, [r15 + rcx]
movzx r9d, dl
lea r14d, [r14 + 3]
lea eax, [rax + rcx*2]
lea r8, [0x140001b00]
xor edx, edx
lea ecx, [rax + r14*4]
mov dword [rbp + 0x1c], ecx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [rbp + 0x70]
xor edx, edx
mov r8d, 0x140
mov qword [rbp + 0x20], rax
call fcn.1400e27d0
lea rdx, [rbp + 0x70]
lea rcx, str.thunderstorm
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rcx, r15
mov qword [rbp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_LockResource]
lea r9, [rbp + 0x40]
movups xmm0, xmmword [rbp + 8]
movups xmm1, xmmword [rbp + 0x18]
mov dword [rbp + 0x30], eax
mov r14, rax
lea rax, str.c2a3
movaps xmmword [rbp + 0x40], xmm0
movaps xmmword [rbp + 0x50], xmm1
movups xmm0, xmmword [rbp + 0x28]
mov qword [rsp + 0x28], rax
lea rax, [0x1400ed3f4]
lea rcx, str.cart
movaps xmmword [rbp + 0x60], xmm0
mov r8b, 0x10
movzx edx, sil
mov qword [rsp + 0x20], rax
call fcn.140063910
mov rdx, rdi
movzx ecx, al
inc rdx
cmp byte [rbx + rdx], 0
jne 0x140023694
mov r9d, dword [rsp + 0x68]
mov r8, qword [rbp - 0x10]
imul edx, r15d
add edx, 8
movzx ecx, cl
mov eax, r13d
add ecx, 0xfffffffc
imul edx, r12d
imul eax, r9d
sub edx, eax
sub edx, r8d
add edx, r14d
add edx, ecx
mov rcx, rdi
nop dword [rax + rax]
inc rcx
cmp byte [rbx + rcx], 0
jne 0x1400236d0
movzx eax, r9b
mov dword [rsp + 0x30], edx
lea rdx, str.c3a5
imul cl
movzx ecx, al
mov rax, qword [rbp - 0x70]
add al, r8b
mov r8, qword [rbp - 0x18]
shl al, 2
mov r9, r8
sub cl, al
movzx eax, r8b
lea r8, str.bank
imul byte [rsp + 0x78]
sub cl, al
lea rax, str.c3a4
sub cl, byte [rbp + 0x30]
mov qword [rsp + 0x28], rax
add cl, 0xe
add cl, r13b
add cl, r15b
add cl, r12b
mov byte [rsp + 0x20], cl
lea rcx, str.turkey
call fcn.14006fac0
mov esi, dword [rsp + 0x64]
call fcn.140081090
mov r14, rax
call fcn.140079de0
mov byte [rsp + 0x61], al
call fcn.140069e70
mov dword [rbp - 0x80], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
lea rdx, str.c7a1
mov qword [rsp + 0x30], rdx
lea rcx, [0x1400ed3f4]
mov r8, rdx
mov qword [rsp + 0x28], rcx
lea rcx, str.c7a2
lea r9, str.c1a2
mov qword [rsp + 0x20], rcx
lea rdx, str.c0a4
mov ecx, eax
mov dword [rsp + 0x6c], eax
call fcn.1400b86d0
xor edx, edx
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rdx
mov byte [rsp + 0x62], al
mov eax, dword [rsp + 0x6c]
lea r8, str.c1a2
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], eax
lea rdx, str.c7a1
mov r9d, eax
mov ecx, r13d
mov dword [rsp + 0x20], esi
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea rcx, [rbp + 0x70]
mov edx, 0x104
mov qword [rbp - 0x58], rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
movzx r8d, byte [rsp + 0x61]
movsxd r9, r13d
mov rdx, rbx
xor ecx, ecx
mov qword [rbp - 0x10], rax
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
lea rcx, str.anywhere
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x20], eax
call fcn.1400bc780
mov rdx, rax
mov qword [rbp - 0x60], rax
lea eax, [r15 + 0xa]
movzx ecx, al
add cl, cl
add al, cl
lea rcx, str.midi
sub al, byte [rsp + 0x6c]
sub al, dl
sub al, byte [rbp - 0x38]
sub al, byte [rbp - 0x68]
sub al, byte [rsp + 0x60]
add al, byte [rsp + 0x78]
movzx edx, al
mov byte [rsp + 0x60], al
call fcn.1400a57a0
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rdx, str.c1a2
lea rcx, str.cattle
mov r9, r12
mov r8, rax
mov qword [rbp - 0x70], rax
call fcn.1400af2d0
movsx edx, byte [rsp + 0x60]
mov r10d, dword [rsp + 0x68]
mov dword [rbp - 0x78], eax
cmp r10d, edx
jb 0x140023979
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdx, rdi
mov qword [rbp + 8], rax
nop dword [rax]
inc rdx
cmp byte [rsi + rdx], 0
jne 0x1400238b0
movsx rax, byte [rsp + 0x60]
mov ecx, 3
imul edx, eax
mov eax, dword [rbp - 0x60]
imul eax, dword [rsp + 0x70]
sub ecx, eax
mov eax, r13d
add ecx, ecx
imul eax, dword [rsp + 0x68]
sub ecx, edx
lea rdx, [rbp - 0x40]
lea ecx, [rax + rcx*2]
mov eax, dword [rbp - 0x10]
imul eax, dword [rbp - 0x58]
lea r8d, [rax + rcx*2]
mov eax, dword [rbp - 0x38]
lea rcx, [0x1400ed3f4]
imul eax, dword [rsp + 0x78]
add r8d, eax
lea eax, [r15 + r15*2]
add r8d, eax
lea rax, str.c7a0
sub r8d, dword [rsp + 0x6c]
mov qword [rbp + 0x18], rax
movsd xmm1, qword [rbp + 0x18]
sub r8d, r12d
movsd qword [rbp - 0x30], xmm1
add r8d, dword [rbp - 0x68]
mov dword [rbp + 0x10], r8d
lea r8, str.kohlrabi
movups xmm0, xmmword [rbp + 8]
movaps xmmword [rbp - 0x40], xmm0
call fcn.140070750
xor ecx, ecx
lea r8d, [rcx + 6]
mov edx, 0x1e4
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea r9, str.flare
lea r8, str.c10a0
lea rcx, [rbp + 8]
mov rdx, rax
call fcn.1400b6e30
movzx edx, byte [rsp + 0x60]
mov r10d, dword [rsp + 0x68]
mov eax, dword [rbp - 0x78]
mov r8d, dword [rsp + 0x64]
mov r11d, dword [rbp - 0x10]
movsx r9, byte [rsp + 0x62]
imul eax, r12d
mov dword [rbp - 0x7c], eax
mov rax, qword [rbp - 0x18]
movsx rcx, dl
mov edx, dword [rsp + 0x6c]
add eax, eax
mov qword [rbp - 0x40], rcx
imul r11d, dword [rbp - 0x58]
mov dword [rsp + 0x64], eax
lea ecx, [r8 + r8]
lea eax, [rdx*4]
mov dword [rbp], eax
mov dword [rbp - 0x50], ecx
movzx ecx, byte [rsp + 0x61]
mov rax, rdi
inc rax
cmp byte [r14 + rax], 0
jne 0x1400239c3
imul eax, ecx
lea ecx, [r9*4]
mov r9, qword [rbp - 0x40]
sub ecx, eax
mov eax, dword [rbp - 0x50]
shl ecx, 3
imul eax, r10d
sub ecx, eax
lea eax, [r9*4]
imul eax, dword [rbp - 0x60]
imul eax, dword [rsp + 0x70]
add ecx, eax
mov rax, rdi
cmp byte [rbx + rax + 1], 0
lea rax, [rax + 1]
jne 0x140023a00
lea eax, [rax + rax*2]
sub ecx, eax
lea eax, [rdx*4]
sub ecx, eax
mov rax, rdi
sub ecx, dword [rsp + 0x64]
sub ecx, dword [rbp - 0x7c]
sub ecx, dword [rbp - 0x70]
sub ecx, dword [rbp - 0x68]
sub ecx, r12d
add ecx, r11d
add ecx, r15d
add ecx, dword [rbp - 0x80]
add ecx, dword [rsp + 0x78]
add ecx, r13d
nop dword [rax]
inc rax
cmp byte [rsi + rax], 0
jne 0x140023a40
mov r9, qword [rbp - 0x20]
sub ecx, eax
add ecx, 0x14
mov dword [r9], ecx
mov r9d, edx
mov rdx, rdi
imul r9d, dword [rbp - 0x80]
inc rdx
cmp byte [r14 + rdx], 0
jne 0x140023a60
mov rax, qword [rbp - 0x10]
imul edx, dword [rsp + 0x78]
imul r8d, r13d
lea ecx, [rax + rax]
sub ecx, dword [rbp - 0x70]
add ecx, ecx
sub ecx, r12d
add ecx, ecx
sub ecx, r8d
mov r8, qword [rbp - 0x18]
mov eax, r8d
imul eax, dword [rbp + 4]
sub ecx, eax
mov rax, rdi
sub ecx, edx
nop dword [rax]
inc rax
cmp byte [rbx + rax], 0
jne 0x140023aa0
mov rdx, qword [rbp - 0x68]
sub eax, 2
lea eax, [rax + rax*2]
add ecx, eax
lea eax, [r10 + r10]
sub ecx, eax
movzx eax, byte [rsp + 0x61]
sub ecx, dword [rbp - 0x58]
sub ecx, dword [rbp - 0x78]
sub ecx, dword [rbp - 0x40]
add ecx, r9d
add ecx, eax
movsx rax, byte [rsp + 0x62]
add ecx, r15d
add ecx, dword [rbp - 0x60]
add ecx, dword [rsp + 0x70]
add ecx, eax
mov rax, rdi
add ecx, edx
inc rax
cmp byte [rsi + rax], 0
jne 0x140023ae5
sub ecx, eax
mov rax, qword [rbp - 0x20]
mov dword [rax + 4], ecx
mov rax, rdi
nop word [rax + rax]
cmp byte [rsi + rax + 1], 0
lea rax, [rax + 1]
jne 0x140023b00
lea ecx, [rax + rax*2]
lea eax, [rdx + rdx*2]
sub eax, dword [rbp - 0x70]
imul eax, r12d
lea edx, [rax + rcx*8]
mov eax, dword [rsp + 0x78]
mov rcx, qword [rbp - 0x40]
imul eax, r8d
add edx, eax
lea eax, [rcx*4]
mov ecx, dword [rsp + 0x70]
sub edx, eax
movzx eax, byte [rsp + 0x61]
sub edx, r9d
sub edx, eax
mov rax, rdi
sub edx, r11d
movsx r11, byte [rsp + 0x62]
sub edx, dword [rbp - 0x60]
sub edx, ecx
sub edx, r11d
sub edx, r10d
add edx, r15d
add edx, dword [rbp - 0x78]
nop dword [rax]
inc rax
cmp byte [rbx + rax], 0
jne 0x140023b60
sub edx, eax
mov rax, rdi
nop
inc rax
cmp byte [r14 + rax], 0
jne 0x140023b70
mov r9, qword [rbp - 0x20]
add edx, 0x1e
add eax, edx
lea edx, [rcx*8]
mov dword [r9 + 8], eax
mov rax, rdi
cmp byte [rsi + rax + 1], 0
lea rax, [rax + 1]
jne 0x140023b91
lea eax, [rax + rax*2]
mov ecx, r11d
add eax, eax
sub ecx, eax
mov rax, rdi
sub ecx, dword [rbp - 0x80]
shl ecx, 2
nop
inc rax
cmp byte [r14 + rax], 0
jne 0x140023bb0
movzx r9d, byte [rsp + 0x61]
imul eax, r9d
mov r9, qword [rbp - 0x40]
imul eax, dword [rsp + 0x78]
sub ecx, eax
lea eax, [r9*4]
sub ecx, dword [rsp + 0x64]
sub ecx, dword [rbp - 0x7c]
sub ecx, dword [rbp - 0x50]
sub ecx, eax
mov rax, rdi
sub ecx, dword [rbp - 0x70]
sub ecx, dword [rbp - 0x10]
sub ecx, dword [rbp - 0x58]
sub ecx, r10d
add ecx, dword [rbp]
add ecx, r15d
add ecx, dword [rbp - 0x60]
add ecx, edx
add ecx, dword [rbp - 0x68]
add ecx, r12d
add ecx, r13d
inc rax
cmp byte [rbx + rax], 0
jne 0x140023c06
mov r13, qword [rbp - 0x20]
add eax, 0xffffffdb
add eax, ecx
mov qword [r13 + 0x10], r8
mov dword [r13 + 0xc], eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [r13 + 0x18], rax
mov rax, rdi
nop dword [rax]
inc rax
cmp byte [rsi + rax], 0
jne 0x140023c30
imul eax, dword [rbp - 0x40]
mov ecx, dword [rsp + 0x6c]
imul ecx, dword [rbp - 0x80]
sub ecx, dword [rbp - 0x58]
lea ecx, [rcx*2 + 0xe]
sub ecx, eax
mov rax, rdi
inc rax
cmp byte [r14 + rax], 0
jne 0x140023c54
movzx edx, byte [rsp + 0x61]
imul eax, edx
imul eax, dword [rsp + 0x78]
lea ecx, [rax + rcx*4]
nop
inc rdi
cmp byte [rbx + rdi], 0
jne 0x140023c70
mov r9d, dword [rsp + 0x70]
lea eax, [r12 + r12*2]
imul edi, r15d
add ecx, edi
sub ecx, eax
lea eax, [r9*8]
sub ecx, dword [rbp - 0x70]
sub ecx, eax
movsx rax, byte [rsp + 0x62]
sub ecx, eax
mov rax, r13
sub ecx, dword [rbp - 0x68]
sub ecx, dword [rsp + 0x68]
add ecx, dword [rsp + 0x64]
add ecx, dword [rbp - 0x7c]
add ecx, dword [rbp - 0x60]
add ecx, dword [rbp - 0x10]
mov dword [r13 + 0x20], ecx
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x300]
add rsp, 0x2c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret