Function at 0x140081bd0
Capabilities:
Copy file
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1a0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x190], rax
or rbx, 0xffffffffffffffff
mov r13, r8
mov rdi, rdx
mov qword [rsp + 0x38], rdx
mov r14, rcx
mov r15, rbx
nop
inc r15
cmp byte [rcx + r15], 0
jne 0x140081c10
mov rcx, qword [rdx + 8]
sub r15d, r8d
mov rax, rbx
inc rax
cmp byte [rcx + rax], 0
jne 0x140081c24
mov ecx, 0xffff
sub r15d, eax
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
mov r12d, eax
cmp eax, r15d
je 0x140081c77
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor eax, eax
lea r8, [0x140001b00]
mov qword [rsp + 0x28], rax
mov r9d, r12d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, qword [rdi + 8]
mov rax, rbx
nop
inc rax
cmp byte [rcx + rax], 0
jne 0x140081c80
lea ecx, [r13*2]
sub ecx, eax
mov rax, rbx
nop word [rax + rax]
cmp byte [r14 + rax + 1], 0
lea rax, [rax + 1]
jne 0x140081ca0
lea ebp, [rax - 2]
lea r8, [0x140001b00]
mov r9, r12
add ebp, ecx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov rsi, r12
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [0x1400ed4d4]
movsxd rdi, r15d
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r9, rdi
mov r8, r12
mov rdx, r14
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x50]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov qword [rsp + 0x40], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0x30], rax
cmp r15d, ebp
jl 0x140081da8
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x50]
lea rcx, str.world
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x50]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea rcx, str.c0a0
mov r8d, 1
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_CopyFileA]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
xor ecx, ecx
mov edx, 0x10d
lea r8d, [rcx + 0x11]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x50]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov rcx, rbx
mov rbp, rax
nop
inc rcx
cmp byte [r14 + rcx], 0
jne 0x140081dc0
movzx eax, r12b
movzx edx, r13b
shl dl, 2
imul cl
lea ecx, [rdx + r13]
lea esi, [rax - 8]
add sil, cl
mov rcx, rbx
inc rcx
cmp byte [r14 + rcx], 0
jne 0x140081de4
movzx eax, r13b
imul cl
movzx ecx, al
movzx eax, r12b
imul cl
movzx edi, al
sub dil, byte [rsp + 0x30]
add dil, 3
add dil, byte [rsp + 0x48]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rcx, qword [rsp + 0x38]
mov rcx, qword [rcx + 8]
mov r8, rax
mov rdx, rbx
inc rdx
cmp byte [rcx + rdx], 0
jne 0x140081e23
sub edx, 5
movzx eax, dil
lea ecx, [rbp*2]
add ecx, ebp
shl ecx, 5
imul eax, r8d
imul edx, r13d
sub ecx, dword [rsp + 0x40]
shl ecx, 2
sub ecx, eax
mov rax, qword [rsp + 0x30]
add eax, 0xc
add edx, ecx
lea ecx, [rax + rax*4]
movsx rax, sil
add edx, ecx
sub edx, eax
inc rbx
cmp byte [r14 + rbx], 0
jne 0x140081e65
lea eax, [r12 + rdx]
add eax, ebx
add eax, r15d
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x1f8]
add rsp, 0x1a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret