Function at 0x1400cb5a0
Capabilities:
Create thread
Extract resource via kernel32 functions
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1c0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov rbp, r9
movsxd rsi, r8d
mov rdi, rdx
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
movzx r12d, sil
lea r15d, [rax + rax]
add r12b, r12b
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
mov edx, 0x2da
lea r8d, [rcx + 0x13]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor eax, eax
lea r8, [0x140001b00]
mov qword [rsp + 0x28], rax
mov r9, rsi
xor edx, edx
xor ecx, ecx
mov rbx, rsi
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r14, [0x1400ed4d4]
mov r9, rsi
mov r8, rsi
xor ecx, ecx
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
imul esi, edi
mov r13d, 2
mov r9, rbx
mov r8, rbx
sub r13d, esi
mov rdx, r14
xor ecx, ecx
sub r13d, dword [rbp + 8]
mov word [rsp + 0x60], ax
sub r13d, r15d
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
cmp r13d, r15d
je 0x1400cb6bc
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x70]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, byte [rsp + 0x60]
xor ecx, ecx
mov eax, r15d
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], edi
movzx r9d, r12b
mov dword [rsp + 0x30], r9d
lea r8, str.gladiolus
lea rdx, str.cassock
mov ecx, r15d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ecx, ecx
lea r8d, [rcx + 0x1c]
mov edx, 0x19c
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rbx, rax
cmp r12b, r13b
je 0x1400cb744
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
call qword [sym.imp.USER32.dll_GetActiveWindow]
cmp r15d, edi
jae 0x1400cb78c
lea rcx, str.gladiolus
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x70]
lea rcx, str.c0a3
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rax, r14
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret