Function at 0x1400097c0
Capabilities:
Copy file
Extract resource via kernel32 functions
Query environment variable

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x288]
sub rsp, 0x388
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x270], rax
movups xmm0, xmmword [r9]
movups xmm1, xmmword [r9 + 0x20]
movzx eax, byte [rbp + 0x2f0]
movzx ebx, r8b
mov qword [rbp - 0x70], rdx
mov rdi, rcx
mov byte [rsp + 0x61], bl
mov qword [rsp + 0x78], rcx
mov byte [rsp + 0x60], al
movaps xmmword [rbp + 0xb0], xmm0
movaps xmmword [rbp + 0xd0], xmm1
movups xmmword [rbp + 0x20], xmm0
movups xmm0, xmmword [r9 + 0x10]
movaps xmmword [rbp + 0xc0], xmm0
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rsi, qword [rbp + 0x20]
mov r15, rax
mov qword [rsp + 0x70], rax
imul esi, edi
mov qword [rbp - 0x78], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, str.course
mov r9d, esi
mov r8d, r15d
mov r13d, eax
mov dword [rsp + 0x64], eax
mov byte [rsp + 0x20], al
call fcn.140022050
mov r12, rax
mov qword [rsp + 0x68], rax
call fcn.14001e7b0
mov r14, rax
mov qword [rbp - 0x80], rax
cmp bl, sil
jb 0x140009b91
movsx ecx, byte [rsp + 0x60]
movzx eax, r13b
mov qword [rbp + 0x60], r12
mov dword [rbp + 0x6c], 1
mov qword [rbp + 0x70], r14
mov qword [rbp + 0x78], rdi
imul ecx, esi
sub ecx, eax
mov qword [rbp + 0x90], rdi
add ecx, edi
mov dword [rbp + 0x68], ecx
movzx ecx, bl
mov ebx, eax
mov eax, ecx
mov ecx, r15d
imul ebx, esi
lea rsi, str.c0a1
mov qword [rbp + 0x88], rsi
imul eax, edi
sub eax, r14d
add eax, 0xfffffffa
add eax, ebx
add eax, r15d
mov dword [rbp + 0x80], eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rbp + 0xa0], r12
movaps xmm0, xmmword [rbp + 0x60]
movaps xmm1, xmmword [rbp + 0x70]
mov qword [rbp + 0x98], rax
lea rcx, [rbp - 0x60]
mov r9d, 0x40
movaps xmmword [rbp - 0x60], xmm0
movaps xmm0, xmmword [rbp + 0x80]
movaps xmmword [rbp - 0x50], xmm1
mov r8, rsi
xor edx, edx
mov qword [rsp + 0x20], 0
movaps xmm1, xmmword [rbp + 0x90]
movaps xmmword [rbp - 0x40], xmm0
movsd xmm0, qword [rbp + 0xa0]
movsd qword [rbp - 0x20], xmm0
movaps xmmword [rbp - 0x30], xmm1
call fcn.14004bdb0
movzx r15d, al
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
mov r14d, 2
mov edx, 0x221
xor ecx, ecx
mov r8d, r14d
movzx r13d, ax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rbp + 0x20], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, str.course
mov qword [rbp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r8, qword [rsp + 0x70]
lea rdx, str.course
mov r12, rax
mov qword [rbp + 0x30], rax
lea rax, str.c2a2
lea rcx, str.course
mov qword [rbp - 0x60], rax
call qword [sym.imp.KERNEL32.dll_CopyFileA]
lea r8d, [r14 + 0x15]
mov edx, 0x3e1
xor ecx, ecx
mov dword [rbp - 0x58], eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rbp + 0x130]
xor edx, edx
mov qword [rbp - 0x50], rax
mov rax, qword [rsp + 0x68]
mov r8d, 0x140
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x48], rdi
call fcn.1400e27d0
lea rdx, [rbp + 0x130]
lea rcx, str.course
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea r8d, [r14 + 0xd]
mov edx, 0xc3
xor ecx, ecx
mov qword [rbp - 0x30], 0
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x38], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea r8d, [r14 + 0x1b]
mov edx, 0x3b3
xor ecx, ecx
mov qword [rbp - 0x20], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea r9, [rbp + 0xe0]
lea r8, [rbp - 0x10]
movaps xmm0, xmmword [rbp - 0x60]
movaps xmm1, xmmword [rbp - 0x50]
lea rcx, str.c0a1
mov edx, r13d
mov qword [rsp + 0x28], rdi
movaps xmmword [rbp + 0xe0], xmm0
movaps xmm0, xmmword [rbp - 0x40]
movaps xmmword [rbp + 0xf0], xmm1
movsd xmm1, qword [rbp - 0x20]
movsd qword [rbp + 0x120], xmm1
movsd xmm1, qword [rbp + 0x30]
mov rsi, rax
mov qword [rsp + 0x20], rax
movsd qword [rbp], xmm1
movaps xmmword [rbp + 0x100], xmm0
movaps xmm0, xmmword [rbp - 0x30]
movaps xmmword [rbp + 0x110], xmm0
movups xmm0, xmmword [rbp + 0x20]
movaps xmmword [rbp - 0x10], xmm0
call fcn.14001f390
mov rcx, qword [rsp + 0x78]
mov rdi, rax
movsx eax, byte [rsp + 0x60]
imul eax, ecx
add eax, edi
imul eax, ecx
sub eax, ebx
mov rbx, qword [rbp - 0x80]
sub eax, dword [rsp + 0x68]
add ebx, 0xffffffba
add eax, esi
add ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
mov r9, qword [rsp + 0x78]
movaps xmm0, xmmword [rbp + 0x90]
movzx edx, byte [rsp + 0x61]
mov r10d, eax
movzx eax, byte [rbp - 0x70]
psrldq xmm0, 8
movd ecx, xmm0
movaps xmm0, xmmword [rbp - 0x40]
psrldq xmm0, 8
sub cl, 6
shl r15b, 2
imul byte [rbp + 0xc0]
sub r14b, al
movzx eax, r9b
imul r14b
lea r8d, [r15 + rax]
movd eax, xmm0
sub r8b, r13b
sub r8b, byte [rsp + 0x68]
add r8b, cl
mov byte [rsp + 0x28], r8b
mov dword [rsp + 0x20], r10d
imul eax, r12d
imul eax, r13d
mov r13d, dword [rsp + 0x64]
movzx ecx, r13b
imul edx, ecx
imul edx, dword [rbp - 0x78]
sub edx, eax
add edx, r9d
add edx, edi
add edx, esi
lea r8, str.burst
mov r9d, ebx
mov ecx, 0x20
call fcn.140054bb0
mov rsi, qword [rbp - 0x78]
mov rdi, qword [rsp + 0x78]
mov r15, qword [rsp + 0x70]
mov r14, qword [rbp - 0x80]
mov r12, qword [rsp + 0x68]
movzx ebx, byte [rsp + 0x61]
movzx eax, dil
mov qword [rbp - 0x10], rdi
imul r15b
movzx ecx, al
movzx eax, dil
imul cl
movzx ecx, al
movzx eax, bl
imul cl
movzx ebx, al
movzx eax, r12b
imul r14b
add bl, al
movzx eax, r13b
imul sil
add bl, al
mov byte [rsp + 0x62], bl
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
movsx ecx, byte [rsp + 0x60]
mov qword [rbp - 8], rax
imul ecx, edi
mov eax, esi
xor edx, edx
movzx r13d, r13b
mov dword [rsp + 0x64], ecx
imul eax, r15d
sub eax, ecx
mov qword [rbp], rdx
mov qword [rbp + 0x10], rdx
sub eax, r12d
sub eax, r14d
add eax, r13d
add eax, edi
mov dword [rbp + 8], eax
mov eax, ecx
imul eax, esi
sub eax, r13d
sub eax, r14d
mov dword [rbp + 0x18], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.mayor
movups xmm0, xmmword [rbp - 0x10]
movups xmm1, xmmword [rbp]
mov dword [rbp + 0x1c], eax
lea rax, [rbp + 0x20]
lea rdx, str.opera
movaps xmmword [rbp + 0x20], xmm0
movaps xmmword [rbp + 0x30], xmm1
movups xmm0, xmmword [rbp + 0x10]
movzx r9d, bl
mov rcx, rdi
mov qword [rsp + 0x20], rax
movaps xmmword [rbp + 0x40], xmm0
call fcn.14004c700
or r12, 0xffffffffffffffff
mov r14, rax
mov qword [rbp + 0x20], rax
cmp byte [rsp + 0x60], bl
jle 0x140009db9
lea r8d, [r12 + 0xe]
mov edx, 0x156
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, r12
mov qword [rbp + 0x50], rax
inc rcx
cmp byte [r14 + rcx], 0
jne 0x140009c80
movzx r11d, byte [rsp + 0x61]
movzx eax, bl
mov ebx, esi
imul cl
mov rcx, qword [rbp - 0x80]
movzx r8d, al
movzx eax, byte [rsp + 0x68]
imul cl
movzx ecx, al
movzx eax, sil
imul cl
movzx ecx, al
shl cl, 2
lea edx, [rcx + rax]
movzx eax, dil
imul byte [rbp - 0x70]
movzx ecx, al
movzx eax, dil
mov edi, r11d
sub cl, dl
mov rdx, r14
imul cl
movzx ecx, byte [rsp + 0x62]
movzx r15d, al
xor eax, eax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
movsx eax, byte [rsp + 0x60]
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x38], r11d
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x70]
sub r15b, r8b
lea r8, str.opera
mov r9d, eax
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea r8, str.opera
mov esi, eax
xor eax, eax
lea rdx, str.mayor
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], eax
mov r9d, eax
mov ecx, eax
mov dword [rsp + 0x20], r13d
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov ecx, r13d
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rcx, str.genetics
mov qword [rsp + 0x30], rcx
mov rcx, qword [rbp + 0x50]
mov qword [rsp + 0x28], rax
mov r9d, esi
mov r8, r14
movzx edx, r15b
mov qword [rsp + 0x20], rbx
call fcn.1400416a0
mov rsi, qword [rbp - 0x78]
mov r14, qword [rbp + 0x20]
mov rdi, qword [rsp + 0x78]
mov r15, qword [rsp + 0x70]
movzx ebx, byte [rsp + 0x62]
mov rax, r12
nop dword [rax]
inc rax
cmp byte [r14 + rax], 0
jne 0x140009dc0
imul r13d, dword [rsp + 0x68]
movzx ecx, bl
imul r13d, dword [rbp - 0x80]
imul eax, ecx
imul eax, dword [rbp + 0x1c]
lea ecx, [rax + rax*4]
mov rax, qword [rbp + 0xb8]
sub r13d, ecx
nop dword [rax]
inc r12
cmp byte [rax + r12], 0
jne 0x140009df0
movzx eax, byte [rsp + 0x61]
imul esi, r15d
imul r12d, eax
mov rax, qword [rbp - 0x70]
add r13d, r12d
imul eax, edi
add r13d, eax
lea eax, [rsi + rsi*2]
add eax, eax
sub r13d, eax
sub r13d, dword [rsp + 0x64]
lea eax, [r13 - 5]
add eax, edi
mov rcx, qword [rbp + 0x270]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x388
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret