Function at 0x1400d67b0
Capabilities:
Copy file
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2f0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
mov edi, ecx
lea rcx, [rsp + 0x1d0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov edx, 0x5d
xor ecx, ecx
lea r8d, [rdx - 0x53]
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea ebx, [rdi + rdi*2]
mov rbp, rax
shl ebx, 2
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r14, rax
mov qword [rsp + 0x80], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r12, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
lea r9d, [rcx + 4]
mov edx, 0x4daa
mov r8d, 0x3000
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
xor edx, edx
mov rcx, rax
mov r8d, 0x8000
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor ecx, ecx
mov eax, ebx
mov qword [rsp + 0x28], rcx
lea r8, [0x140001b00]
mov r9d, ebx
xor edx, edx
mov dword [rsp + 0x20], ecx
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r15, rax
cmp ebx, edi
jne 0x1400d68b8
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
mov edx, 0x10a
lea r8d, [rcx + 0x19]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x161
lea r8d, [rcx + 0x1c]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r8, qword [rsp + 0x60]
lea ecx, [rdi + 6]
lea edx, [rsi*4]
lea eax, [r8 + r8*4]
mov r13d, 1
mov dword [rsp + 0x68], edx
add eax, eax
sub r13d, eax
lea eax, [r14 + r14*4]
imul r13d, edi
add r13d, eax
mov eax, r14d
sub r13d, edx
mov edx, 0x17a
sub r13d, ebp
add r13d, 8
imul eax, r15d
imul r14d, eax, 0xe
lea eax, [r8 + r8*4]
add r14d, edi
add r14d, r14d
add r13d, r15d
sub r14d, eax
mov eax, edi
add r14d, 5
imul eax, ecx
lea ecx, [rax + rax*2]
mov eax, r12d
add ecx, ecx
imul eax, r15d
shl eax, 4
sub ecx, eax
sub ecx, ebx
mov rbx, qword [rsp + 0x80]
add ebx, 0xe
add ebx, ecx
xor ecx, ecx
lea r8d, [rcx + 7]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, r14d
mov r8d, edi
mov edx, eax
mov rsi, rax
imul ecx, r13d
lea ecx, [rcx + rcx*2]
add ecx, ecx
imul edx, ebx
lea eax, [rcx + rdx*4]
lea rdx, str.farmer
lea rcx, str.c1a2
mov dword [rsp + 0x60], eax
call qword [sym.imp.KERNEL32.dll_CopyFileA]
xor eax, eax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x70]
lea r8, str.farmer
lea rdx, str.alley
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edi
mov r9d, edi
mov ecx, r13d
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], edi
call qword [sym.imp.USER32.dll_CreateWindowExA]
xor ecx, ecx
lea r8d, [rcx + 0x13]
mov edx, 0x39c
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x24c
lea r8d, [rcx + 0xd]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebx, dword [rsp + 0x60]
cmp ebx, edi
jne 0x1400d6a18
lea rcx, str.alley
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, rbp
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
lea rcx, str.alley
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, rbp
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov edx, 0x4f
xor ecx, ecx
lea r8d, [rdx - 0x39]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rax, qword [rsp + 0x78]
imul esi, ebx
lea eax, [rax*8]
lea ecx, [rsi + rsi*2]
lea ebx, [r15 + 9]
sub ecx, eax
add ecx, ebp
lea eax, [rdi + rcx*2]
add eax, dword [rsp + 0x68]
add eax, r12d
add ebx, eax
cmp ebx, 2
jae 0x1400d6ac8
lea rcx, [rsp + 0x90]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x90]
lea rcx, str.igloo
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
xor ecx, ecx
movsxd rax, r14d
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edi
lea r8, [0x1400ed4d4]
lea rdx, str.alley
mov r9d, edi
mov ecx, 2
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 4
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea rax, str.c2ret
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x2f0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret