Function at 0x14009a0d0
Capabilities:
Extract resource via kernel32 functions
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc8
mov r13, r8
mov rbp, rdx
mov r14, rcx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rsi, rax
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
movzx edi, ax
mov word [rsp + 0x128], ax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, 0xffff
mov qword [rsp + 0xa8], rax
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
mov r15d, dword [r14 + 0x20]
mov ebx, eax
mov dword [rsp + 0xb0], eax
movzx eax, dil
sub r15d, esi
sub r15d, ebp
imul bl
lea edi, [rax - 8]
sub r15d, 3
add dil, r15b
add dil, r13b
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebp, eax
mov dword [rsp + 0x60], eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov ecx, dword [r14 + 0x28]
lea r12d, [r15 + 1]
mov edx, 0x174
mov qword [rsp + 0x68], rax
imul r12d, r13d
imul ecx, dword [rsp + 0x118]
add r12d, ecx
lea ecx, [rsi + rsi*8]
sub r12d, ecx
xor ecx, ecx
lea r8d, [rcx + 0x18]
add r12d, ebp
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r14d, dword [r14]
xor ecx, ecx
mov rsi, rax
movsx rax, dil
add r14d, 9
mov edx, eax
lea r8d, [rcx + 7]
mov qword [rsp + 0x98], rax
imul edx, r13d
lea r14d, [r14 + rdx*4]
mov edx, 0x315
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [0x1400ed7c8]
mov qword [rsp + 0x88], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
xor ecx, ecx
mov edx, 0xa0
lea r8d, [rcx + 0xa]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r8d, dword [rsp + 0x68]
movzx r9d, byte [rsp + 0x128]
imul r8d, dword [rsp + 0x60]
mov rbp, rax
lea ecx, [rsi + 1]
movsx rax, dil
imul edx, ecx, 7
sub r8d, edx
sub r8d, eax
mov rax, qword [rsp + 0x110]
sub r8d, dword [rsp + 0x88]
sub r8d, ebx
add r8d, r9d
add r8d, dword [rax]
add r8d, r13d
mov dword [rsp + 0x78], r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov qword [rsp + 0x90], rax
mov r8, qword [rsp + 0x118]
mov rdx, qword [rsp + 0x70]
mov dword [rsp + 0x124], eax
movzx ecx, bpl
sub cl, al
movzx eax, dl
mov byte [rsp + 0x120], cl
add cl, cl
imul sil
movzx ebx, al
mov al, 7
imul r8b
sub r8b, 0x65
sub bl, al
mov rax, qword [rsp + 0x110]
add bl, cl
xor ecx, ecx
add bl, byte [rax + 0x18]
sub bl, r15b
sub bl, dl
mov edx, 0x345
add bl, r14b
add bl, byte [rsp + 0x68]
add bl, r13b
add bl, r13b
add bl, r8b
lea r8d, [rcx + 0xd]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, 0xffff
mov qword [rsp + 0x80], rax
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
movsx ecx, dil
mov rdi, qword [rsp + 0x70]
mov r8d, eax
mov dword [rsp + 0x7c], eax
cmp r15d, ecx
jge 0x14009a38f
movzx eax, byte [rsp + 0x120]
xor r10d, r10d
lea ecx, [rsi + rsi*4]
mov qword [rsp + 0x58], r10
add ecx, ecx
mov qword [rsp + 0x50], r10
imul eax, ebp
imul eax, dword [rsp + 0x90]
mov qword [rsp + 0x48], r10
mov edx, 2
movsx r9d, bl
sub edx, ecx
lea ecx, [r12 + r15*8]
imul edx, r13d
imul ecx, edi
sub edx, ecx
or ecx, 0xffffffff
sub edx, eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax]
sub edx, esi
add eax, 0xfffffff6
sub edx, r14d
add edx, eax
movzx eax, byte [rsp + 0x128]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x38], r8d
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], edx
sub ecx, edx
lea rdx, str.fanny_pack
lea r8, str.worm
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov rdx, qword [rsp + 0x80]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
lea rcx, str.dresser
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, qword [rsp + 0x80]
mov eax, esi
imul ebp, dword [rsp + 0x78]
mov edx, 4
imul eax, dword [rsp + 0x68]
imul eax, r12d
imul eax, dword [rsp + 0x60]
sub edx, eax
movzx eax, byte [rsp + 0x128]
sub edx, eax
movzx eax, byte [rsp + 0x120]
add ecx, eax
mov eax, dword [rsp + 0x7c]
imul edx, edi
lea eax, [rcx + rax*2]
lea ecx, [rax + rax*4]
movsx rax, bl
sub edx, ecx
imul eax, esi
imul ecx, eax, 7
mov rax, qword [rsp + 0x110]
sub edx, ecx
mov eax, dword [rax + 0x28]
sub edx, ebp
add eax, 7
imul eax, dword [rsp + 0x118]
add edx, eax
mov rax, qword [rsp + 0x88]
lea ecx, [rdx + rax*4]
imul eax, r13d, 0x13
add ecx, eax
lea eax, [r15 + 9]
sub ecx, dword [rsp + 0xa8]
add ecx, dword [rsp + 0x98]
add ecx, r14d
add eax, ecx
add rsp, 0xc8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret