Function at 0x1400c1b40
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
mov dword [rsp + 0x20], r9d
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x68
mov r12, rcx
mov ecx, 0xffff
mov r13d, r8d
movsxd rbp, edx
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
xor ecx, ecx
mov qword [rsp + 0x28], rcx
lea r8, [0x140001b00]
mov r9, rbp
xor edx, edx
mov ebx, eax
mov dword [rsp + 0x20], ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r15, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r14, rax
movzx eax, bl
imul r15b
movzx edx, al
mov al, 7
imul dl
movzx esi, al
movsx eax, bl
sub sil, r14b
mov dword [rsp + 0xc0], eax
cmp r13d, eax
ja 0x1400c1bbc
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
mov ebx, eax
mov dword [rsp + 0xb0], eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
xor ecx, ecx
mov edx, 0xa5
lea r8d, [rcx + 0x17]
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
movzx ecx, sil
movzx eax, r14b
add cl, cl
lea edx, [rcx + rsi]
shl dl, 2
inc dl
imul dl
mov edx, 0x3bd
movzx ecx, al
mov al, 0xfd
imul bpl
movzx edi, al
sub dil, cl
xor ecx, ecx
add dil, 7
lea r8d, [rcx + 0xa]
add dil, bl
add dil, r12b
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0x30], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0x38], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, qword [rsp + 0xd0]
mov ecx, dword [rcx]
mov qword [rsp + 0x48], rax
movzx eax, dil
mov edx, 1
sub edx, eax
mov rax, qword [rsp + 0x30]
imul ecx, ebp
imul ecx, dword [rsp + 0xc8]
add eax, 6
imul edx, r12d
add edx, ecx
mov ecx, r14d
imul ecx, r15d
add edx, ecx
sub edx, dword [rsp + 0x38]
add eax, edx
mov dword [rsp + 0xb8], eax
cmp dil, bl
jb 0x1400c1cbc
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
mov edx, 6
xor ecx, ecx
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea ecx, [r12 + 1]
movzx eax, r14b
imul cl
movzx ebx, al
movzx eax, dil
imul byte [rsp + 0xb8]
movzx ecx, al
shl cl, 2
add al, cl
sub bl, al
add bl, 4
add bl, r12b
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor eax, eax
mov qword [rsp + 0x28], rax
lea r8, [0x140001b00]
mov r9, rbp
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r11d, dword [rsp + 0xc8]
mov edx, ebp
imul r15d, dword [rsp + 0xc0]
mov r9, rax
mov rax, qword [rsp + 0x40]
lea r10d, [r11 + 0x10]
imul edx, r13d
lea ecx, [rax*2 + 1]
mov eax, dword [rsp + 0xb8]
movzx r8d, bl
imul ecx, r14d
mov r14, qword [rsp + 0x48]
sub edx, ecx
lea ecx, [rax + rax*8]
add edx, ecx
mov rcx, qword [rsp + 0x30]
sub edx, r14d
sub r14d, dword [rsp + 0x50]
sub edx, ecx
sub edx, r15d
add edx, r12d
add r10d, edx
lea eax, [r10 + r10*4]
sub r9d, eax
mov rax, qword [rsp + 0x38]
imul eax, ecx
mov ecx, 1
sub ecx, r12d
lea eax, [rax + r9*2]
imul ecx, r12d
lea ecx, [rcx + rax*2]
mov eax, dword [rsp + 0xb0]
lea eax, [rax + rax*2]
add ecx, eax
mov rax, qword [rsp + 0xd0]
mov eax, dword [rax + 0x24]
imul eax, r13d
imul eax, r11d
lea edx, [rax + rcx*2]
lea eax, [r14 + r14*4]
add edx, eax
lea eax, [r8 + r8]
sub edx, eax
movsx rax, sil
sub edx, eax
movzx eax, dil
sub edx, ebp
add eax, 0x157
add edx, r10d
add edx, dword [rsp + 0xb8]
add edx, r15d
add eax, edx
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret