Function at 0x140082c90
Capabilities:
Extract resource via kernel32 functions
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x2c0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
lea rcx, [rsp + 0x90]
mov edx, 0x104
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov ecx, 4
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rcx, [rsp + 0x90]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov esi, 0xe
mov edx, 0x368
mov r8d, esi
xor ecx, ecx
mov r14, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea ecx, [rsi - 0xa]
lea edi, [r14 + 8]
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, r12d
lea rcx, [rsp + 0x90]
mov edx, 0x104
imul ebp, r14d
imul ebp, r14d
imul ebp, ebx
inc ebp
imul ebp, r15d
sub ebp, edi
mov eax, ebp
imul eax, r14d
sub esi, eax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rcx, [rsp + 0x1a0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
test edi, edi
je 0x140082e90
mov ecx, dword [rsp + 0x78]
mov edi, esi
sub sil, bl
sub sil, 0xc
add sil, r15b
imul ecx, r12d
imul ecx, r15d
sub edi, ecx
sub edi, eax
sub edi, r14d
movzx eax, dil
imul sil
lea esi, [rax + 4]
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
xor ecx, ecx
lea r8d, [rcx + 0x17]
mov edx, 0x2ed
movzx ebx, ax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
lea rcx, [rsp + 0x1a0]
mov edx, 0x104
mov edi, eax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
xor ecx, ecx
mov edx, 0x22a
lea r8d, [rcx + 0x19]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
xor eax, eax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
movzx edx, bl
lea r8, str.c0a6
movzx r9d, sil
mov qword [rsp + 0x40], rdx
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ebp
lea rdx, str.paleontologist
xor ecx, ecx
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdx, str.c0a6
mov r8d, edi
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
lea rax, str.c1a3
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret