Function at 0x1400bd2d0
Capabilities:
Create thread
Extract resource via kernel32 functions
Query environment variable

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x390
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x380], rax
movsxd r15, r8d
mov qword [rsp + 0xc8], rdx
mov rbp, rcx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
mov r14, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
mov dword [rsp + 0xb8], eax
lea eax, [rbp + 5]
add eax, r14d
mov dword [rsp + 0x64], eax
mov dword [rsp + 0xbc], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x100], eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor r8d, r8d
mov edx, 0x2a8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea r13d, [r14 + 1]
mov esi, r15d
mov qword [rsp + 0x110], rax
lea eax, [rbx*4]
movzx r12d, bpl
sub eax, r13d
sub r12b, r14b
sub eax, r14d
dec r12b
add eax, 0xfffffffb
add eax, ebp
mov dword [rsp + 0x68], eax
lea eax, [rbp*4]
add eax, ebp
add eax, eax
mov dword [rsp + 0x74], eax
imul esi, eax
mov eax, dword [rsp + 0x110]
imul esi, ebx
lea eax, [rax*4]
sub esi, eax
add esi, r13d
mov dword [rsp + 0xe8], esi
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
lea r8d, [rcx + 0x16]
mov edx, 0x175
mov qword [rsp + 0xf0], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, str.c0a2
mov rbx, rax
mov qword [rsp + 0xd0], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
lea r8, [0x140001b00]
xor r9d, r9d
mov edi, eax
mov dword [rsp + 0x70], eax
xor eax, eax
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x90], rax
test r13d, r13d
je 0x1400bd45b
movzx eax, bl
imul byte [rsp + 0x68]
movzx ecx, al
movzx eax, byte [rsp + 0x110]
imul byte [rsp + 0xb8]
sub cl, al
sub cl, dil
sub cl, r14b
sub cl, 4
add cl, r13b
add cl, bpl
movsx ecx, cl
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x80], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov qword [rsp + 0xa0], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0x88], rax
cmp dword [rsp + 0xa0], edi
jne 0x1400bd4fe
mov eax, dword [rsp + 0x68]
xor edx, edx
movsx ecx, r12b
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea r8, str.c0ret
lea rdx, str.songbird
xor ecx, ecx
mov r9d, edi
call qword [sym.imp.USER32.dll_CreateWindowExA]
xor eax, eax
lea r8, [0x140001b00]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [rsp + 0xf0]
or eax, 0xffffffff
mov edx, 0x104
sub eax, r14d
imul ecx, dword [rsp + 0x68]
lea eax, [rax + rax*8]
sub eax, ecx
lea rcx, [rsp + 0x270]
sub eax, ebx
sub eax, dword [rsp + 0x90]
sub eax, r13d
add eax, dword [rsp + 0x88]
add eax, dword [rsp + 0x80]
add eax, dword [rsp + 0x74]
add eax, dword [rsp + 0x64]
mov dword [rsp + 0x6c], eax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor edx, edx
mov qword [rsp + 0x98], rax
movzx eax, r13b
mov r8d, 0x140
imul byte [rsp + 0x100]
movzx ecx, al
movzx eax, byte [rsp + 0x68]
imul cl
movzx ecx, al
movzx eax, r12b
imul cl
movzx ecx, al
movzx eax, r14b
imul r15b
add cl, al
movzx eax, bl
imul byte [rsp + 0x88]
add cl, al
movzx eax, byte [rsp + 0x80]
imul dil
sub al, 6
add cl, al
add cl, byte [rsp + 0x6c]
add cl, bpl
mov byte [rsp + 0x61], cl
lea rcx, [rsp + 0x130]
call fcn.1400e27d0
lea rdx, [rsp + 0x130]
lea rcx, str.c0a2
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, 1
mov edx, 0x1ec
mov r8d, edi
xor ecx, ecx
mov qword [rsp + 0xb0], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r10, qword [rsp + 0xa0]
mov r8, qword [rsp + 0x88]
mov r9, qword [rsp + 0x80]
mov r11, rax
mov qword [rsp + 0xc0], rax
movzx eax, bl
imul r10b
movzx ecx, al
movzx eax, byte [rsp + 0xb8]
add al, al
add cl, al
movzx eax, r14b
shl cl, 2
imul r15b
lea edx, [rax + 2]
movzx eax, dl
shl al, 2
add dl, al
movzx eax, r8b
add dl, dl
sub dl, cl
imul byte [rsp + 0x6c]
sub dl, al
sub dl, r13b
sub dl, r9b
add dl, byte [rsp + 0xc8]
add dl, bpl
add dl, r11b
mov r11, qword [rsp + 0xb0]
mov eax, dword [rsp + 0x90]
mov ecx, ebx
imul ecx, r10d
imul eax, esi
mov esi, dword [rsp + 0x70]
add dl, r11b
imul eax, dword [rsp + 0x68]
add dl, byte [rsp + 0x98]
shl ecx, 3
mov byte [rsp + 0x60], dl
mov edx, dword [rsp + 0x64]
sub ecx, r8d
add ecx, ecx
movsx r8, r12b
imul edx, r14d
mov dword [rsp + 0x64], edx
sub ecx, r9d
lea eax, [rax + rcx*2]
sub eax, edx
mov edx, ebx
sub eax, dword [rsp + 0xc0]
sub eax, r14d
add eax, 5
imul edx, esi
add eax, ebp
add eax, r11d
add eax, r13d
mov dword [rsp + 0x78], eax
mov eax, dword [rsp + 0xc8]
imul eax, dword [rsp + 0x98]
lea ecx, [rax + rax*2]
lea eax, [r10 - 0x1d]
add ecx, ecx
sub edx, ecx
xor ecx, ecx
sub edx, r15d
sub edx, dword [rsp + 0x64]
sub edx, r13d
add edx, ebp
add edx, r8d
add edx, dword [rsp + 0x88]
add eax, edx
mov edx, 0x168
mov dword [rsp + 0x64], eax
mov eax, dword [rsp + 0xd0]
imul eax, dword [rsp + 0x90]
sub edi, eax
mov eax, dword [rsp + 0x6c]
lea eax, [rax + rax*2]
imul edi, r9d
shl eax, 6
sub edi, eax
movsx rax, byte [rsp + 0x61]
sub edi, eax
mov rax, qword [rsp + 0x98]
sub edi, dword [rsp + 0xc0]
add eax, 0xfffffffb
sub edi, r11d
sub edi, r13d
add edi, ebp
add edi, r8d
lea r8d, [rcx + 0x18]
add eax, edi
mov dword [rsp + 0x74], eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov edx, 4
mov qword [rsp + 0xd8], rax
movzx eax, byte [rsp + 0x60]
sub dl, r13b
imul byte [rsp + 0xb0]
movzx ecx, al
movzx eax, dl
shl al, 2
add dl, al
movzx eax, byte [rsp + 0x88]
sub dl, cl
shl al, 2
sub dl, al
sub dl, byte [rsp + 0x68]
add dl, byte [rsp + 0x64]
add dl, byte [rsp + 0xa0]
add dl, bpl
add dl, bl
add dl, byte [rsp + 0x80]
add dl, r14b
mov dword [rsp + 0x70], edx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, dword [rsp + 0x78]
mov r8d, dword [rsp + 0x64]
mov dword [rsp + 0xa8], eax
cmp r8d, edx
je 0x1400bd90a
mov r10, qword [rsp + 0x80]
movzx eax, byte [rsp + 0xc8]
mov dword [rsp + 0x30], 0
imul r15b
movzx ecx, al
movzx eax, bpl
xor r9d, r9d
mov dword [rsp + 0x28], 0x20
imul cl
movzx edi, al
movzx eax, byte [rsp + 0xb0]
imul byte [rsp + 0xc0]
movzx ecx, al
movzx eax, r10b
imul cl
mov rcx, r10
sub dil, al
movzx eax, r12b
imul r13b
sub dil, al
movzx eax, byte [rsp + 0x90]
imul sil
sub dil, al
movzx eax, byte [rsp + 0x98]
shl al, 4
sub dil, al
movzx eax, r8b
mov r8, r10
imul byte [rsp + 0x74]
add dil, al
mov rax, qword [rsp + 0xa0]
sub dil, dl
mov rdx, r10
mov dword [rsp + 0x20], eax
sub dil, al
sub dil, bl
sub dil, byte [rsp + 0x110]
add dil, 0x17
add dil, byte [rsp + 0xf0]
add dil, byte [rsp + 0x60]
add dil, r14b
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ecx, ecx
lea r8d, [rcx + 3]
mov edx, 0x364
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
movzx eax, byte [rsp + 0x70]
xor ecx, ecx
movzx r9d, dil
mov edi, dword [rsp + 0x78]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0xa8]
lea r8, str.colloquia
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x6c]
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], eax
lea rdx, str.cicada
mov ecx, r15d
mov dword [rsp + 0x20], r15d
call qword [sym.imp.USER32.dll_CreateWindowExA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov r8d, dword [rsp + 0x64]
jmp 0x1400bd90e
mov edi, dword [rsp + 0x78]
movzx eax, byte [rsp + 0xd0]
sub r12b, 0x1b
imul byte [rsp + 0xe8]
movzx edx, al
movzx eax, byte [rsp + 0x90]
add dl, dl
imul sil
add dl, al
movzx eax, byte [rsp + 0xd8]
shl dl, 2
imul byte [rsp + 0xa8]
movzx ecx, al
movzx eax, byte [rsp + 0x70]
imul cl
mov rcx, qword [rsp + 0xb0]
sub dl, al
movzx eax, byte [rsp + 0x80]
inc cl
imul cl
add dl, al
movzx eax, byte [rsp + 0x88]
imul byte [rsp + 0xa0]
sub dl, al
movzx eax, r8b
imul dil
sub dl, al
movzx eax, r14b
imul byte [rsp + 0xbc]
movzx ecx, al
shl cl, 2
add al, cl
add dl, al
movzx eax, byte [rsp + 0x60]
imul byte [rsp + 0xc0]
add al, dl
sub al, bl
add al, r15b
add al, byte [rsp + 0x74]
add al, byte [rsp + 0x6c]
add al, r13b
add al, byte [rsp + 0x68]
add al, bpl
add al, byte [rsp + 0x98]
add al, byte [rsp + 0x61]
add al, r12b
mov rcx, qword [rsp + 0x380]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x3e8]
add rsp, 0x390
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret