Function at 0x140017b50
Capabilities:
Create thread
Extract resource via kernel32 functions
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x270]
sub rsp, 0x370
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x260], rax
movsx eax, dl
mov qword [rbp - 0x60], rcx
xor ecx, ecx
mov r15d, eax
add eax, r9d
mov r14, r9
mov dword [rbp + 0x80], eax
lea rax, [0x1400ede90]
lea edi, [r15 + r8]
mov qword [rbp - 0x18], r9
mov qword [rbp - 0x28], r8
mov qword [rbp + 0x88], rcx
mov qword [rbp + 0x98], rax
mov dword [rbp + 0x90], edi
mov dword [rbp + 0xa0], 2
mov qword [rbp + 0xa8], rcx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rbp + 0x30]
movups xmm0, xmmword [rbp + 0x80]
movups xmm1, xmmword [rbp + 0x90]
mov qword [rbp + 0xb0], rax
mov edx, r15d
movaps xmmword [rbp + 0x30], xmm0
movaps xmmword [rbp + 0x40], xmm1
movups xmm0, xmmword [rbp + 0xa0]
movsd xmm1, qword [rbp + 0xb0]
movaps xmmword [rbp + 0x50], xmm0
movsd qword [rbp + 0x60], xmm1
call fcn.14001fb90
mov ebx, r15d
mov r12, rax
mov qword [rsp + 0x68], rax
imul ebx, edi
sub ebx, r14d
add ebx, r15d
add ebx, eax
mov ecx, ebx
mov dword [rsp + 0x58], ebx
call fcn.140045110
mov rdi, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
or rsi, 0xffffffffffffffff
mov r13, rax
mov qword [rsp + 0x78], rax
mov rcx, rsi
inc rcx
cmp byte [rdi + rcx], 0
jne 0x140017c50
imul ecx, r12d
lea rax, str.c1ret
mov r12d, r15d
sub r12d, ecx
mov qword [rbp + 0x38], rax
add r12d, r14d
add r12d, dword [rbp + 0x80]
mov dword [rbp + 0x30], r12d
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [rbp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
lea r8, str.c1ret
xorps xmm0, xmm0
mov qword [rbp + 0x50], r8
movdqu xmmword [rbp + 0x58], xmm0
mov rcx, rsi
mov qword [rbp + 0x78], rax
mov dword [rbp + 0x48], eax
nop dword [rax]
inc rcx
cmp byte [rdi + rcx], 0
jne 0x140017cb0
imul ecx, dword [rsp + 0x68]
movups xmm0, xmmword [rbp + 0x30]
movups xmm1, xmmword [rbp + 0x40]
lea rdx, [rbp + 0xc0]
mov r9, r8
imul ecx, r15d
movaps xmmword [rbp + 0xc0], xmm0
movaps xmmword [rbp + 0xd0], xmm1
movups xmm0, xmmword [rbp + 0x50]
movsd xmm1, qword [rbp + 0x60]
lea eax, [rcx + rcx*2]
mov ecx, r15d
sub ecx, eax
add ecx, r14d
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x4c], ecx
mov rcx, r13
mov qword [rsp + 0x20], r8
movaps xmmword [rbp + 0xe0], xmm0
movsd qword [rbp + 0xf0], xmm1
call fcn.140025660
mov r8, qword [rsp + 0x68]
lea r9, [0x1400ed988]
mov rdx, rax
mov qword [rsp + 0x60], rax
movzx eax, r13b
movzx r13d, r15b
imul bl
movzx ecx, al
movzx eax, r8b
imul cl
mov ecx, r15d
sub r13b, al
imul ecx, r14d
mov eax, r12d
sub r13b, r15b
sub r13b, 0xa
imul eax, r8d
sub ecx, eax
sub ecx, r15d
lea eax, [rcx - 5]
mov rcx, r14
add eax, edx
movzx edx, r13b
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x44], eax
lea rax, str.snakebite
mov qword [rsp + 0x20], rax
call fcn.14002c2f0
mov ecx, dword [rsp + 0x4c]
mov r9, rax
mov qword [rbp - 0x20], rax
cmp r13b, cl
je 0x140017dd7
mov ecx, dword [rsp + 0x78]
mov r10, qword [rsp + 0x60]
mov r8d, dword [rsp + 0x44]
imul ecx, r12d
movsx edx, r13b
add r8d, 0xa
imul edx, r14d
sub edx, ecx
lea rcx, str.vineyard
add edx, r15d
add edx, r10d
add r8d, edx
lea rdx, str.c1ret
call fcn.140022100
mov ecx, dword [rsp + 0x4c]
mov r9, qword [rbp - 0x20]
movsx rdx, r13b
mov rax, rsi
mov qword [rbp + 0x70], rdx
inc rax
cmp byte [rdi + rax], 0
jne 0x140017de2
mov r11, qword [rbp - 0x28]
imul eax, ebx
mov r8d, r15d
sub eax, edx
mov rdx, qword [rsp + 0x60]
sub eax, r9d
imul r8d, r11d
lea r10d, [rdx + 0x22]
add r10d, eax
movsx eax, r13b
mov dword [rbp - 0x40], r8d
mov qword [rsp + 0x20], rdx
mov dword [rsp + 0x54], r10d
imul r8d, r14d
imul eax, edx
lea r14d, [rcx + rcx*4]
lea ecx, [rax + rax*2]
lea eax, [r15 + r15*4]
sub eax, ecx
mov ecx, dword [rsp + 0x44]
mov dword [rbp - 0x3c], r14d
sub eax, r14d
mov dword [rsp + 0x70], r8d
sub eax, ecx
lea r14d, [r8 + rax]
movzx eax, r9b
lea r8, str.genetics
add r14d, 0xfffffffc
imul cl
add r14d, r9d
movzx ecx, r11b
sub cl, al
mov edx, r14d
mov dword [rsp + 0x48], r14d
sub cl, bl
add cl, 3
add cl, r15b
add cl, byte [rsp + 0x68]
mov byte [rsp + 0x40], cl
movzx r9d, cl
mov ecx, r10d
call fcn.14003e4f0
xor ecx, ecx
mov edx, 0x356
lea r8d, [rcx + 0x17]
mov dword [rsp + 0x5c], eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, 0xffff
mov qword [rbp - 0x80], rax
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
xor ecx, ecx
lea r8d, [rcx + 0x19]
mov edx, 0xeb
mov r14d, eax
mov dword [rsp + 0x50], eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r9, qword [rsp + 0x78]
mov rcx, qword [rbp - 0x80]
mov r8, rax
mov edx, r14d
mov qword [rbp - 0x70], rax
call fcn.140043aa0
mov rcx, qword [rbp - 0x80]
mov r14, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rcx, qword [rbp - 0x28]
mov qword [rbp - 0x38], rax
call qword [sym.imp.KERNEL32.dll_LockResource]
movzx r9d, byte [rbp - 0x38]
mov rdx, qword [rsp + 0x60]
lea rcx, str.step_son
xor r8d, r8d
mov qword [rsp + 0x28], 0
mov qword [rbp], rax
mov byte [rsp + 0x20], al
call fcn.140028a00
xor ecx, ecx
mov edx, 0x16e
lea r8d, [rcx + 6]
mov qword [rbp - 8], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x260
mov qword [rbp + 8], rax
lea r8d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x16c
lea r8d, [rcx + 0x1a]
mov qword [rbp - 0x48], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdx, rsi
mov qword [rbp - 0x78], rax
inc rdx
cmp byte [r14 + rdx], 0
jne 0x140017f63
mov r8, qword [rsp + 0x78]
movzx eax, bl
imul r15b
movzx ecx, al
movzx eax, byte [rbp - 0x18]
imul cl
movzx ecx, al
movzx eax, r15b
imul cl
movzx ecx, al
movzx eax, r8b
imul cl
movzx ecx, al
shl cl, 2
lea ebx, [rcx + rax]
mov rcx, qword [rsp + 0x60]
movzx eax, byte [rsp + 0x4c]
imul cl
sub bl, al
movzx eax, r8b
mov r8d, dword [rsp + 0x44]
imul byte [rsp + 0x50]
add bl, al
sub bl, byte [rsp + 0x48]
sub bl, r8b
mov r8d, 0x140
sub bl, byte [rbp - 0x80]
sub bl, cl
lea rcx, [rbp + 0x120]
sub bl, byte [rbp - 0x38]
add bl, r13b
sub bl, dl
xor edx, edx
sub bl, 0xc
call fcn.1400e27d0
lea rdx, [rbp + 0x120]
lea rcx, str.c1ret
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rdx, qword [rbp - 0x78]
lea r9, str.jellyfish
mov qword [rsp + 0x38], rax
mov qword [rbp - 0x58], rax
mov rax, qword [rbp - 0x48]
mov byte [rsp + 0x30], bl
mov qword [rsp + 0x28], rdx
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 0x100]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call fcn.14001e080
xor ecx, ecx
movups xmm0, xmmword [rax]
movsd xmm1, qword [rax + 0x10]
movups xmmword [rbp + 0x10], xmm0
movsd qword [rbp + 0x20], xmm1
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rcx, qword [rsp + 0x60]
mov edx, eax
mov qword [rbp - 0x68], rax
call fcn.14005d830
lea r8, [0x140001b00]
movsx r9, r15b
mov qword [rbp - 0x30], rax
xor eax, eax
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rbp - 0x60]
mov qword [rcx], rax
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r10d, dword [rsp + 0x68]
mov r9, qword [rbp - 0x60]
imul r10d, r15d
movzx r8d, bl
mov qword [r9 + 8], rax
movzx eax, byte [rsp + 0x40]
mov dword [rbp - 0x10], r10d
mov dword [rbp - 0x50], r8d
mov rdx, rsi
inc rdx
cmp byte [r14 + rdx], 0
jne 0x1400180b4
mov r11, qword [rsp + 0x60]
mov ebx, dword [rsp + 0x58]
dec edx
imul edx, dword [rsp + 0x78]
mov ecx, 3
sub ecx, eax
mov eax, dword [rbp + 0x20]
imul ecx, r11d
imul eax, dword [rbp - 0x58]
sub ecx, eax
movsx eax, r13b
mov r13, qword [rbp - 0x18]
add edx, ecx
mov ecx, dword [rsp + 0x48]
add eax, 0xfffffffe
imul eax, r13d
add edx, eax
lea eax, [r12 + r12*4]
mov r12, qword [rbp - 8]
add edx, eax
lea eax, [rcx*8]
sub edx, eax
mov rax, rsi
sub edx, dword [rbp - 0x3c]
sub edx, r8d
sub edx, r10d
mov r10, qword [rbp - 0x20]
sub edx, dword [rbp - 0x28]
sub edx, dword [rbp - 0x30]
sub edx, dword [rbp - 0x78]
sub edx, dword [rbp - 0x70]
sub edx, r10d
sub edx, dword [rsp + 0x44]
sub edx, ebx
add edx, r15d
add edx, dword [rbp - 0x80]
add edx, dword [rbp - 0x68]
add edx, dword [rsp + 0x50]
add edx, dword [rsp + 0x5c]
add edx, dword [rsp + 0x54]
inc rax
cmp byte [r12 + rax], 0
jne 0x140018146
sub edx, eax
mov rax, rsi
inc rax
cmp byte [rdi + rax], 0
jne 0x140018155
imul r10d, dword [rsp + 0x54]
add edx, 0xfffffff3
add eax, edx
mov rdx, rsi
mov dword [r9 + 0x10], eax
movzx eax, byte [rsp + 0x40]
movzx r9d, byte [rbp - 0x38]
lea ecx, [rax*8]
movzx eax, byte [rbp]
mov dword [rbp - 0x38], r10d
mov dword [rbp - 0x18], ecx
imul r9d, eax
mov eax, r13d
mov dword [rbp - 8], r9d
imul eax, r11d
mov dword [rsp + 0x58], eax
nop
inc rdx
cmp byte [rdi + rdx], 0
jne 0x1400181a0
mov eax, dword [rsp + 0x5c]
imul edx, ebx
imul eax, ecx
mov ecx, dword [rbp - 0x30]
inc eax
imul ecx, dword [rbp - 0x68]
imul eax, r11d
sub ecx, eax
mov eax, r8d
mov r8d, 0x140
imul eax, dword [rbp - 0x58]
sub ecx, eax
mov eax, dword [rbp - 0x70]
imul eax, dword [rsp + 0x50]
sub ecx, eax
mov eax, r10d
imul eax, dword [rsp + 0x44]
add ecx, eax
mov eax, dword [rbp - 0x10]
imul eax, dword [rbp + 0x80]
add ecx, eax
mov rax, qword [rbp - 0x78]
sub ecx, edx
add eax, 0xffffff76
xor edx, edx
sub ecx, dword [rbp - 0x48]
sub ecx, dword [rbp - 0x80]
sub ecx, dword [rsp + 0x48]
sub ecx, dword [rsp + 0x78]
sub ecx, dword [rsp + 0x4c]
sub ecx, dword [rsp + 0x58]
add ecx, r9d
add ecx, dword [rsp + 0x70]
add ecx, dword [rbp + 0x18]
add eax, ecx
mov rcx, qword [rbp - 0x60]
mov dword [rcx + 0x14], eax
lea rcx, [rbp + 0x120]
call fcn.1400e27d0
lea rdx, [rbp + 0x120]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov r10, qword [rbp - 0x60]
mov r9d, dword [rbp - 0x80]
imul r9d, dword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
mov qword [r10 + 0x18], rax
mov qword [r10 + 0x20], 0
imul r9d, dword [rsp + 0x5c]
mov rdx, rsi
imul r9d, r8d
mov dword [rsp + 0x70], r9d
inc rdx
cmp byte [rdi + rdx], 0
jne 0x140018274
mov eax, dword [rbp - 0x50]
mov ecx, dword [rsp + 0x68]
imul eax, dword [rbp + 0x18]
imul ecx, ebx
imul eax, dword [rbp - 0x58]
sub ecx, eax
mov rax, qword [rsp + 0x78]
add eax, eax
sub ecx, eax
movzx eax, byte [rsp + 0x40]
sub ecx, dword [rbp - 8]
sub ecx, dword [rbp - 0x30]
sub ecx, dword [rbp - 0x78]
sub ecx, dword [rbp - 0x48]
sub ecx, dword [rbp - 0x70]
sub ecx, dword [rbp - 0x68]
sub ecx, dword [rsp + 0x44]
add ecx, dword [rbp - 0x38]
add ecx, eax
mov rax, rsi
add ecx, dword [rbp - 0x40]
add ecx, r13d
add ecx, dword [rbp + 0x40]
add ecx, dword [rsp + 0x48]
add ecx, r9d
add ecx, r8d
add ecx, dword [rsp + 0x4c]
add ecx, r15d
sub ecx, edx
nop dword [rax]
inc rax
cmp byte [r14 + rax], 0
jne 0x1400182e0
add eax, 0xffffffdf
mov edx, 0x238
add eax, ecx
xor ecx, ecx
lea r8d, [rcx + 0xb]
mov dword [r10 + 0x28], eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r11, qword [rbp - 0x60]
mov qword [r11 + 0x30], rax
mov rax, rsi
nop
inc rax
cmp byte [rdi + rax], 0
jne 0x140018310
imul eax, dword [rsp + 0x68]
mov r8d, dword [rbp - 0x50]
mov r9, qword [rsp + 0x78]
mov rdx, qword [rbp - 0x78]
imul eax, ebx
imul eax, r15d
imul ecx, eax, 0x19
mov eax, r8d
imul eax, edx
dec ecx
imul ecx, r9d
add ecx, eax
mov eax, dword [rsp + 0x44]
lea eax, [rax + rax*8]
sub ecx, eax
mov rax, rsi
nop
inc rax
cmp byte [r14 + rax], 0
jne 0x140018350
mov edx, dword [rsp + 0x48]
mov r10, qword [rsp + 0x60]
shl eax, 3
sub ecx, eax
movzx eax, byte [rsp + 0x40]
sub ecx, dword [rbp + 0x70]
sub ecx, eax
lea eax, [rdx*8]
mov rdx, qword [rbp]
sub ecx, r13d
sub ecx, dword [rbp + 0x20]
sub ecx, dword [rbp - 0x58]
sub ecx, dword [rbp - 0x20]
sub ecx, dword [rsp + 0x54]
sub ecx, dword [rsp + 0x70]
sub ecx, r10d
add ecx, eax
movzx eax, dl
mov rdx, qword [rbp + 8]
add ecx, eax
mov rax, rsi
add ecx, dword [rbp - 0x40]
add ecx, dword [rbp - 0x30]
add ecx, dword [rbp - 0x48]
add ecx, edx
add ecx, dword [rbp - 0x70]
add ecx, dword [rbp - 0x68]
add ecx, dword [rsp + 0x4c]
add ecx, dword [rsp + 0x58]
nop dword [rax + rax]
inc rax
cmp byte [r12 + rax], 0
jne 0x1400183c0
sub ecx, eax
sub ecx, 0x14
mov dword [r11 + 0x38], ecx
mov rcx, rsi
inc rcx
cmp byte [r12 + rcx], 0
jne 0x1400183d6
imul r8d, dword [rbp - 0x78]
imul ecx, edx
mov edx, dword [rbp + 0x18]
imul edx, dword [rbp - 0x58]
imul r8d, dword [rbp - 0x48]
add edx, 2
lea eax, [r8 + r8*8]
mov r8, qword [rbp - 0x28]
imul edx, r10d
sub eax, edx
mov rdx, qword [rbp - 0x70]
imul edx, dword [rsp + 0x50]
imul edx, r9d
add eax, edx
lea edx, [r15 + r8]
imul r13d, edx
add eax, r13d
sub eax, ecx
mov rcx, rsi
inc rcx
cmp byte [rdi + rcx], 0
jne 0x140018424
imul ecx, r9d
sub eax, ecx
mov rcx, qword [rbp + 0x78]
lea ecx, [rcx + rcx*4]
sub eax, ecx
sub eax, dword [rbp - 0x30]
sub eax, dword [rsp + 0x5c]
sub eax, dword [rbp - 0x20]
sub eax, dword [rsp + 0x68]
sub eax, ebx
sub eax, dword [rbp - 0x18]
add eax, dword [rbp - 0x3c]
add eax, r15d
add eax, r8d
add eax, dword [rbp - 0x80]
add eax, dword [rbp - 0x68]
add eax, dword [rsp + 0x48]
add eax, dword [rsp + 0x54]
add eax, dword [rsp + 0x44]
add eax, r15d
nop dword [rax]
inc rsi
cmp byte [r14 + rsi], 0
jne 0x140018470
sub eax, esi
add eax, 9
mov dword [r11 + 0x3c], eax
mov rax, r11
mov rcx, qword [rbp + 0x260]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x3b0]
add rsp, 0x370
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret