Function at 0x1400d8970
Capabilities:
Copy file
Create thread
Extract resource via kernel32 functions
Query environment variable

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x48
movsxd r14, ecx
xor eax, eax
mov r12, r8
mov rbp, r9
mov qword [rsp + 0x28], rax
lea r8, [0x140001b00]
mov r9, r14
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea ebx, [r14 + r14*4]
mov esi, ebx
mov r15, rax
sub esi, ebp
sub esi, r12d
mov dword [rsp + 0x98], esi
call qword [sym.imp.USER32.dll_GetActiveWindow]
movzx edi, r14b
lea rdx, str.c0ret
lea rcx, [0x1400ed3f4]
mov r8d, edi
mov r13, rax
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_CopyFileA]
movzx ecx, r14b
lea r8d, [r14 - 5]
sub ebx, r13d
add cl, cl
lea r9d, [rbp + 2]
sub ebx, esi
lea edx, [rcx + r14]
add ebx, r15d
add dl, dl
add r9d, ebx
movzx ebx, al
sub dl, sil
mov dword [rsp + 0x90], r9d
imul r13b
add dl, 5
add dl, r8b
add dl, r15b
add dl, r12b
movzx ecx, dl
sub dl, 2
lea ebp, [rbx + rcx]
mov dword [rsp + 0xa0], ecx
movzx ecx, al
shl cl, 2
add ebp, r9d
add al, cl
movzx ecx, bpl
sub cl, al
add cl, r8b
add cl, sil
add cl, dl
mov edx, 0xc5
add cl, r14b
movsx r13d, cl
xor ecx, ecx
lea r8d, [rcx + 0x17]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, ebp
mov qword [rsp + 0x38], rax
imul ecx, dword [rsp + 0x90]
sub ecx, dword [rsp + 0x30]
sub ecx, esi
lea esi, [r14 - 2]
add ecx, r15d
add esi, ecx
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
cmp r13d, ebp
jne 0x1400d8ac4
xor ecx, ecx
mov edx, 0x1c8
lea r8d, [rcx + 0x13]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
mov edx, 0x2b2
lea r8d, [rcx + 8]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
cmp ebp, r14d
jg 0x1400d8b41
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
mov edx, 0x39a
lea r8d, [rcx + 0x19]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
xor ecx, ecx
mov edx, 0x352
lea r8d, [rcx + 7]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
lea r8d, [rcx + 0x1b]
mov edx, 0xaa
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
xor ecx, ecx
lea r8d, [rcx + 0xe]
mov edx, 0x37e
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
imul edi, dword [rsp + 0xa8]
imul ebx, dword [rsp + 0x30]
imul esi, r15d
mov ecx, 2
lea eax, [rsi + rsi*4]
sub ecx, eax
lea eax, [r14 - 5]
imul ebx, dword [rsp + 0x90]
imul ecx, r15d
imul edi, eax
mov eax, r13d
sub ecx, edi
sub ecx, ebx
imul eax, ebp
add ecx, eax
lea eax, [r12 + r12*4]
add ecx, eax
mov eax, dword [rsp + 0x98]
add eax, eax
sub ecx, eax
lea eax, [r14 + 0x29]
sub ecx, dword [rsp + 0x38]
add ecx, dword [rsp + 0xa0]
add ecx, r13d
add eax, ecx
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret