Function at 0x140040900
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x170], rax
movsxd r15, r8d
lea rcx, str.theoretician
mov r13d, 0xc
xor esi, esi
mov r14, rdx
lea edi, [r15 + 0xc]
mov dword [rsp + 0x70], r13d
mov qword [rsp + 0x78], rsi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.theoretician
mov r9, r15
mov r8, r15
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
lea rcx, str.theoretician
mov dword [rbp - 0x80], eax
lea eax, [r14 + 0xc]
mov dword [rbp - 0x7c], eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, r14
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
lea r8, [0x140001b00]
mov r9, r15
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rsi
mov qword [rbp - 0x78], rax
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp - 0x70], rax
mov eax, r15d
mov ecx, 0xffff
imul eax, r14d
sub r13d, eax
mov dword [rbp - 0x68], r13d
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
lea r8, [rsp + 0x40]
movups xmm0, xmmword [rsp + 0x70]
movups xmm1, xmmword [rbp - 0x80]
mov r12d, eax
lea rax, [0x1400ed4d4]
mov edx, edi
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x50], xmm1
movups xmm0, xmmword [rbp - 0x70]
mov r9d, r12d
mov rcx, rax
mov qword [rsp + 0x28], rax
movaps xmmword [rsp + 0x60], xmm0
call fcn.1400a23d0
mov rbx, rax
mov qword [rsp + 0x38], rax
cmp r12d, r15d
jg 0x140040b25
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
lea r8d, [rsi + 0x13]
mov edx, 0x3d6
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdx, r14
xor ecx, ecx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
xor ecx, ecx
lea r8d, [rcx + 0x19]
mov edx, 0xba
mov esi, eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0xda
lea r8d, [rcx + 0xb]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rbp + 0x30]
xor edx, edx
mov r8d, 0x140
mov ebx, eax
call fcn.1400e27d0
lea rdx, [rbp + 0x30]
lea rcx, [0x1400ed4d4]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rax, qword [rsp + 0x38]
lea ecx, [r14 - 4]
lea edx, [rcx + rcx*2]
mov ecx, 4
lea r8, str.waiter
add edx, edx
sub ecx, eax
sub edx, r12d
add edx, edx
sub edx, edi
lea edi, [r15 + 0xc]
sub edx, ebx
add edx, eax
mov eax, r12d
mov dword [rsp + 0x28], edx
imul eax, edi
lea r9d, [rax + rcx*2]
lea rax, str.streetcar
sub r9d, r15d
xor ecx, ecx
mov qword [rsp + 0x20], rax
sub r9d, r14d
sub r9d, ebx
add r9d, esi
call fcn.1400c1ff0
mov rbx, qword [rsp + 0x38]
xor esi, esi
lea rax, str.c0a5
mov qword [rsp + 0x40], rax
mov eax, r14d
sub eax, r15d
add eax, 0xe
mov dword [rsp + 0x48], eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, 0xa
mov qword [rsp + 0x50], rax
mov eax, dword [rbp - 0x70]
mov dword [rsp + 0x5c], esi
mov qword [rsp + 0x68], rbx
imul eax, ebx
sub ecx, eax
mov eax, 6
sub eax, dword [rbp - 0x78]
sub ecx, r14d
lea eax, [r14 + rax*2]
sub ecx, edi
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x58], ecx
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
mov ecx, r15d
movzx esi, ax
mov word [rsp + 0x30], ax
sub ecx, r12d
sub ecx, r13d
sub ecx, edi
lea r13d, [rcx + 7]
mov ecx, edi
add r13d, ebx
mov dword [rsp + 0x34], r13d
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdx, [rbp - 0x50]
movups xmm0, xmmword [rsp + 0x40]
movups xmm1, xmmword [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rcx, [rbp - 0x20]
movzx r9d, sil
movaps xmmword [rbp - 0x30], xmm1
movups xmmword [rbp - 0x50], xmm0
movups xmm0, xmmword [rsp + 0x50]
mov qword [rbp - 0x60], rax
mov dword [rsp + 0x20], r13d
movaps xmmword [rbp - 0x40], xmm0
call fcn.140086980
lea eax, [rbx*4]
movups xmm0, xmmword [rsp + 0x40]
movzx ecx, r14b
mov esi, r12d
add cl, cl
psrldq xmm0, 8
imul esi, dword [rbp - 0x7c]
lea r13d, [rcx + r14]
movd ecx, xmm0
sub esi, eax
movzx eax, byte [rbp - 0x78]
shl r13b, 2
sub esi, r14d
sub esi, edi
add esi, 4
imul dil
sub r13b, al
mov eax, dword [rsp + 0x34]
sub r13b, r12b
movzx r12d, word [rsp + 0x30]
sub r13b, al
sub r13b, 2
add r13b, r15b
add r13b, r12b
movzx r8d, r13b
imul cl
movzx ecx, al
movzx eax, r12b
imul cl
movzx edx, al
movzx eax, r14b
imul r15b
sub al, dl
sub al, dil
lea ecx, [rax + 0x16]
mov edx, esi
call fcn.1400c5360
movzx eax, r13b
cmp edi, eax
ja 0x140040c7a
lea r8, str.c0a0
lea rcx, [rbp - 0x50]
mov rdx, r14
call fcn.1400c5b30
lea rcx, str.c0a0
call fcn.1400c46d0
xor ecx, ecx
mov rbx, rax
call fcn.14007baa0
cmp r13b, sil
jbe 0x140040d1b
or rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp byte [rbx + rcx], 0
jne 0x140040ca0
mov rax, qword [rsp + 0x38]
add r14b, 5
add r14b, r14b
imul byte [rsp + 0x50]
add al, r14b
sub al, sil
sub al, r12b
add cl, al
add cl, dil
mov rdi, qword [rbp - 0x60]
add cl, dil
call fcn.1400c7510
xor ecx, ecx
call fcn.14009ee80
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rbp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
mov ecx, dword [rsp + 0x34]
movzx ebx, ax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rdx, rdi
mov r8, rax
movzx ecx, bl
call fcn.14006b930
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x2c0]
add rsp, 0x280
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret