Function at 0x1400d0fb0
Capabilities:
Create thread
Extract resource via kernel32 functions
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x270
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor eax, eax
mov qword [rsp + 0x80], r8
lea r8, [0x140001b00]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov r12, rax
mov qword [rsp + 0xc0], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x150]
mov edx, 0x104
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov r14, rax
mov qword [rsp + 0xc8], rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, 0xa
mov qword [rsp + 0x78], rax
sub sil, r14b
sub sil, bl
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [rsp + 0x98], rax
movzx eax, sil
mov ecx, eax
mov dword [rsp + 0x70], eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, r14d
mov rbp, rax
mov qword [rsp + 0xa8], rax
imul ecx, edi
imul ecx, r12d
imul r15d, ecx, 7
lea rcx, str.c0a6
sub r15d, 4
mov dword [rsp + 0x88], r15d
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.cupola
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
xor ecx, ecx
mov edx, 0x2db
lea r8d, [rcx + 0x12]
mov r13d, eax
mov dword [rsp + 0x64], eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov edx, r14d
movzx edi, bpl
mov r8, rax
mov qword [rsp + 0xa0], rax
imul edx, r12d
mov dword [rsp + 0xb8], edx
imul r13b
movzx ecx, al
movzx eax, r14b
imul cl
mov ecx, dword [rsp + 0x70]
sub dil, al
mov eax, r8d
sub dil, r15b
imul ecx, ebp
imul eax, r14d
imul ecx, r13d
sub ecx, eax
lea eax, [rdx + 0x12]
xor edx, edx
add eax, ecx
xor ecx, ecx
mov dword [rsp + 0xe0], eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
xor ecx, ecx
lea r8d, [rcx + 0x1d]
mov edx, 0xc6
mov qword [rsp + 0x108], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x38d
lea r8d, [rcx + 0x1b]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, 0xffff
mov qword [rsp + 0xb0], rax
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
xor edx, edx
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rdx
movsx rcx, dil
mov dword [rsp + 0x68], eax
movzx ebp, r13b
mov qword [rsp + 0x40], rcx
sub bpl, r15b
mov dword [rsp + 0x38], r15d
sub bpl, sil
movsx esi, dil
mov rdi, qword [rsp + 0x78]
sub bpl, byte [rsp + 0x78]
movsx eax, dil
mov dword [rsp + 0x30], esi
mov qword [rsp + 0xd8], rcx
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], edx
lea r8, str.cupola
lea rdx, str.cupola
mov r9d, eax
mov ecx, esi
add bpl, r14b
mov dword [rsp + 0x8c], eax
call qword [sym.imp.USER32.dll_CreateWindowExA]
xor ecx, ecx
mov edx, 0x267
lea r8d, [rcx + 0x1c]
mov r13, rax
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r8d, dword [rsp + 0x68]
mov rcx, rax
mov qword [rsp + 0xd0], rax
movzx eax, bpl
imul r13b
sub al, cl
sub al, 8
add al, byte [rsp + 0xe0]
add al, byte [rsp + 0xb0]
add al, r8b
mov byte [rsp + 0x61], al
test al, al
jg 0x1400d1612
mov r9, qword [rsp + 0xc0]
mov edx, dword [rsp + 0x64]
mov r10, qword [rsp + 0xa8]
mov r11, qword [rsp + 0xa0]
mov ecx, dword [rsp + 0x98]
movsx r12, al
mov eax, dword [rsp + 0x80]
movsx r13, dil
movsx r8d, r8b
imul ecx, r10d
imul eax, r9d
sub ecx, eax
imul eax, r13d, 7
add ecx, eax
movsx rax, bpl
sub ecx, eax
lea eax, [rdx + 4]
sub ecx, r12d
sub ecx, r11d
sub ecx, r14d
add eax, ecx
mov ecx, dword [rsp + 0x70]
mov dword [rsp + 0x94], eax
mov eax, r8d
imul ecx, dword [rsp + 0x98]
imul eax, r11d
imul ecx, r10d
mov r10, qword [rsp + 0x78]
sub ecx, eax
mov eax, dword [rsp + 0x8c]
imul eax, r9d
sub ecx, eax
mov eax, edx
imul eax, r14d
add ecx, eax
lea eax, [r10*8]
sub ecx, eax
movzx eax, r10b
sub ecx, dword [rsp + 0x80]
add ecx, r15d
imul dl
mov dword [rsp + 0x90], ecx
movzx ecx, al
movzx eax, bpl
imul cl
movzx ecx, dil
add cl, cl
movzx edx, al
movzx eax, r9b
add dil, cl
add dil, dil
imul byte [rsp + 0x80]
sub dl, al
imul eax, ebx, 0x2a
sub dl, dil
movsx edi, bpl
sub esi, eax
mov eax, dword [rsp + 0xd0]
add dl, 8
mov byte [rsp + 0x60], dl
imul esi, r14d
imul eax, dword [rsp + 0xb0]
add esi, eax
mov eax, dword [rsp + 0x98]
imul eax, r11d
add esi, eax
sub esi, r9d
mov r9d, r8d
add esi, 4
xor ecx, ecx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rcx
mov eax, esi
mov dword [rsp + 0x6c], esi
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x8c]
mov dword [rsp + 0x38], r15d
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], eax
lea r8, str.c0a4
lea rdx, str.cultivar
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8, qword [rsp + 0xc8]
movsx rdx, byte [rsp + 0x60]
mov r10d, dword [rsp + 0x6c]
mov r9, qword [rsp + 0xc0]
movsx rbp, byte [rsp + 0x68]
mov r15d, eax
lea ecx, [r8 + r8*2]
add ecx, ecx
movzx eax, dl
lea esi, [rbp*8 - 0x20]
sub esi, ecx
mov ecx, dword [rsp + 0x90]
add esi, edx
dec dl
sub esi, r12d
sub esi, r13d
imul cl
sub esi, r10d
sub esi, ecx
movzx ecx, al
movzx eax, r10b
sub esi, dword [rsp + 0x94]
shl cl, 5
sub esi, dword [rsp + 0x64]
inc cl
add esi, dword [rsp + 0x70]
imul cl
add esi, dword [rsp + 0xa0]
movzx ecx, al
movzx eax, bl
add esi, ebx
imul r8b
add cl, al
movzx eax, r9b
add esi, r9d
imul cl
movzx ebx, al
movzx eax, byte [rsp + 0x78]
xor ecx, ecx
imul byte [rsp + 0xd0]
shl al, 3
sub bl, al
sub bl, r8b
lea r8d, [rcx + 8]
add bl, byte [rsp + 0x80]
add bl, byte [rsp + 0xb0]
add bl, byte [rsp + 0xa8]
add bl, dl
mov edx, 0x330
add bl, byte [rsp + 0x61]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov eax, 2
imul edi, dword [rsp + 0xa0]
sub eax, dword [rsp + 0x98]
inc edi
mov ecx, 0xffff
lea edx, [r12 + rax*2]
mov eax, dword [rsp + 0x64]
add edx, edx
sub edx, r13d
mov r13, qword [rsp + 0xc8]
imul eax, dword [rsp + 0x88]
shl edx, 2
imul edi, r13d
sub edx, edi
add edx, eax
sub edx, dword [rsp + 0x6c]
add edx, dword [rsp + 0x94]
add edx, dword [rsp + 0xa8]
mov dword [rsp + 0x130], edx
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
mov dword [rsp + 0x134], eax
mov rcx, qword [rsp + 0x130]
movsx eax, bl
shr rcx, 0x20
imul ecx, eax
mov eax, r14d
imul eax, r15d
lea edi, [rax + rax*4]
sub edi, ecx
sub edi, esi
add edi, 4
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov ebx, 7
lea r8d, [rbx + 6]
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
movsxd rax, dword [rsp + 0x90]
xor ecx, ecx
imul edi, esi
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rcx
mov r9, rax
imul eax, dword [rsp + 0x94]
mov qword [rsp + 0x48], rcx
mov ecx, dword [rsp + 0x68]
mov qword [rsp + 0x40], r9
sub ebx, edi
mov rdi, qword [rsp + 0x80]
movsx r9d, cl
mov ecx, dword [rsp + 0x6c]
lea edx, [rbx + rbx*4]
mov rbx, qword [rsp + 0xc0]
sub edx, eax
mov rax, qword [rsp + 0xa8]
mov dword [rsp + 0x38], r9d
lea r8, str.c0a4
mov r9d, r15d
imul eax, dword [rsp + 0x88]
sub edx, eax
movsx eax, byte [rsp + 0x60]
sub edx, ebp
sub edx, dword [rsp + 0xd8]
sub edx, r13d
add edx, dword [rsp + 0xb8]
add edx, edi
add edx, r14d
add edx, dword [rsp + 0x108]
add edx, dword [rsp + 0x78]
add edx, dword [rsp + 0xa0]
add edx, ebx
mov dword [rsp + 0x30], edx
lea rdx, str.cultivar
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rcx, str.vietnam
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rax, rbx
jmp 0x1400d1615
mov rax, r12
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret