Function at 0x180009854
Capabilities:
Accept command line arguments
Extract resource via kernel32 functions
Get common file path
Query environment variable
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
xor edi, edi
mov ebx, 1
test edx, edx
jne 0x180009a1e
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapQueryInformation]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMemoryErrorHandlingCapabilities]
mov dword [rsp + 0x38], edi
xor r9d, r9d
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov qword [rsp + 0x28], rdi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationByHandleW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTapePartition]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlsAlloc]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
lea r8, [0x1800f79d8]
xor ecx, ecx
lea rdx, [0x1800f7a00]
call qword [sym.imp.KERNEL32.dll_NotifyUILanguageChange]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeServerSessionId]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadGroupAffinity]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClosePrivateNamespace]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUserGeoID]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumberFormatW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryThreadCycleTime]
xor r8d, r8d
lea rcx, [0x1800f7a40]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenFile]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PurgeComm]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteProfileStringW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFileIoOverlappedRange]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLargestConsoleWindowSize]
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetWaitableTimer]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetTapeParameters]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalFindAtomW]
call qword [sym.imp.KERNEL32.dll_FreeConsole]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThreadpoolWait]
call qword [sym.imp.KERNEL32.dll_IsSystemResumeAutomatic]
jmp 0x180009d9a
cmp edx, ebx
jne 0x180009d9a
cmp dword [0x1800df340], 0xcb0598f2
jne 0x180009b96
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadpoolThreadMinimum]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeSListHead]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaProximityNodeEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SearchPathW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadpoolTimer]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AddScopedPolicyIDAce]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsValidLanguageGroup]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFinalPathNameByHandleW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemTimes]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessAffinityMask]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrefetchVirtualMemory]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeSynchronizationBarrier]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SearchPathW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextVolumeW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov r9d, dword [rsp + 0x78]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ScrollConsoleScreenBufferW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockShared]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
mov ecx, 0x163
lea rax, [0x1800087b4]
mov dword [rsp + 0x58], ecx
add rax, rcx
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x50]
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
call fcn.18000e820
mov ecx, 0x1bf
lea rax, [0x18000543c]
mov dword [rsp + 0x58], ecx
add rax, rcx
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x50]
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
call fcn.18000e820
mov ecx, 0x207
lea rax, [0x180006934]
mov dword [rsp + 0x58], ecx
add rax, rcx
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x50]
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
call fcn.180011764
cmp dword [0x1800df340], 0x68dad2c1
mov ebx, eax
jne 0x180009d9a
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetWindowLongW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommConfig]
xor r9d, r9d
mov dword [rsp + 0x20], edi
lea r8, [0x1800f7a58]
xor edx, edx
lea rcx, [0x1800f7a88]
call qword [sym.imp.KERNEL32.dll_CompareStringOrdinal]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetDoubleClickTime]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_AdjustWindowRect]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PurgeComm]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClosePrivateNamespace]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFileIoOverlappedRange]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
mov qword [rsp + 0x40], rdi
lea rax, [0x1800f7ac8]
mov qword [rsp + 0x38], rdi
lea r8, [0x1800f7af8]
mov qword [rsp + 0x30], rdi
lea rcx, [0x1800f7b28]
mov dword [rsp + 0x28], edi
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CompareStringEx]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ChangeWindowMessageFilter]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
xor ecx, ecx
call qword [sym.imp.USER32.dll_UnregisterSuspendResumeNotification]
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetMessageExtraInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindVolumeMountPointClose]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCommTimeouts]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthW]
mov dword [rsp + 0x30], edi
xor r9d, r9d
mov qword [rsp + 0x28], rdi
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapViewOfFileExNuma]
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaProcessorNodeEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DeleteMenu]
lea rdx, [0x1800f7b68]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadDescription]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DdeCmpStringHandles]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret