Function at 0x1400d9010
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x198
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov r13, qword [rsp + 0x210]
mov r12, qword [rsp + 0x200]
movsxd r14, dword [rsp + 0x208]
mov eax, r12d
mov r15, r8
mov rsi, r9
mov qword [rsp + 0x38], r9
mov rbp, rcx
mov edi, r13d
imul eax, dword [r8 + 0x28]
sub edi, eax
movzx eax, cl
mov r9, r14
sub edi, edx
xor ecx, ecx
add edi, 4
imul dl
movzx ebx, al
xor eax, eax
xor edx, edx
sub bl, byte [r8 + 0x28]
mov qword [rsp + 0x28], rax
lea r8, [0x140001b00]
add bl, r13b
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
movzx eax, sil
movsx esi, bl
add edi, ebp
imul r12b
movzx ecx, al
movzx eax, bpl
imul cl
add al, r14b
movzx eax, al
mov ecx, eax
mov dword [rsp + 0x30], eax
mov eax, esi
imul ecx, edx
sub eax, ecx
add edi, eax
cmp r14d, esi
jg 0x1400d91f9
xor ecx, ecx
mov edx, 0x10e
lea r8d, [rcx + 0x19]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x140
mov rbx, rax
call fcn.1400e27d0
lea rdx, [rsp + 0x40]
lea rcx, str.turkey
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
lea r8d, [rcx + 1]
mov edx, 0x1a0
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
lea r8d, [rcx + 0x14]
mov edx, 0x3ac
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rcx, str.faucet
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor ecx, ecx
mov edx, 0x307
lea r8d, [rcx + 0x1b]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
xor ecx, ecx
lea r8d, [rcx + 0x1c]
mov edx, 0x278
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdx, qword [rsp + 0x38]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor ecx, ecx
lea r8d, [rcx + 0x1a]
mov edx, 0x2e1
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x194
lea r8d, [rcx + 0x12]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdx, qword [rsp + 0x38]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov eax, dword [rsp + 0x30]
imul esi, r13d
xor ecx, ecx
lea eax, [rax*8]
lea r8d, [rcx + 0x1d]
mov edx, 0x12f
sub esi, eax
add esi, dword [r15]
add esi, ebp
add esi, r14d
add esi, edi
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
add ebp, 0xfffffffa
imul ebx, esi
imul ebx, edi
sub ebx, r12d
add ebx, eax
add ebx, ebp
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor eax, eax
mov qword [rsp + 0x28], rax
lea r8, [0x140001b00]
movsxd r9, ebx
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x40]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor eax, eax
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x198
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret