Function at 0x140077420
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1d8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov ebp, dword [rsp + 0x240]
mov r13, qword [rsp + 0x248]
mov rsi, r9
mov qword [rsp + 0x60], r8
movzx r14d, dl
mov r12, rcx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], r13
cmp dl, bpl
jl 0x140077479
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp r14b, bpl
jne 0x14007748f
xor ecx, ecx
mov edx, 0x21f
lea r8d, [rcx + 0xd]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
lea rcx, [rsp + 0x80]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x80]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
or rdi, 0xffffffffffffffff
mov r15, rax
mov rbx, rdi
nop dword [rax]
inc rbx
cmp byte [rsi + rbx], 0
jne 0x1400774e0
imul ebx, dword [r12 + 8]
sub ebx, 3
movzx eax, bl
add al, al
lea ecx, [rax + rbx]
sub r15b, cl
mov ecx, 0xffff
sub r15b, 0x65
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
mov r12d, eax
nop
inc rdi
cmp byte [rsi + rdi], 0
jne 0x140077510
mov r8, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
movsx rax, r15b
mov ecx, dword [rdx + 0x38]
lea esi, [rbp - 0xf]
imul edi, r8d
sub ecx, edi
movsx edi, r14b
sub ecx, eax
sub ecx, r13d
lea r13d, [rdi + rbp]
add esi, ecx
xor ecx, ecx
imul eax, ebx, 0x1e0
imul r13d, r8d
add r13d, dword [rdx + 0x18]
lea r8d, [rcx + 0x1d]
mov edx, 0xf5
add r13d, eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea r8, [0x140001b00]
mov r9, rbp
mov rcx, rax
movzx eax, r12b
xor edx, edx
imul sil
lea r15d, [rax - 9]
xor eax, eax
add r15b, r13b
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
add r15b, byte [rsp + 0x60]
add r15b, cl
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.USER32.dll_GetActiveWindow]
cmp esi, edi
jge 0x1400775c1
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_LockResource]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
xor edi, edi
lea r8, [0x140001b00]
movsx r9, r14b
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
movzx ecx, r12b
movsxd rax, esi
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], ebp
mov dword [rsp + 0x30], ecx
lea r9d, [rdi + 1]
lea r8, str.c1ret
lea rdx, str.c3a5
mov ecx, ebx
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 0x20
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
cmp r14b, bpl
jg 0x1400776aa
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
movzx eax, r12b
lea r8, [0x1400ed988]
lea rdx, [0x1400ed988]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], r13d
lea ecx, [rdi + 0x20]
movsx r9d, r15b
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], esi
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
lea r8d, [rdi + 4]
mov edx, 0x276
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea r8, [0x140001b00]
mov r9d, ebx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x1d8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret