Function at 0x140066fb0
Capabilities:
Copy file
Create thread
Extract resource via kernel32 functions
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x160
or rsi, 0xffffffffffffffff
mov r15d, r9d
mov rbx, rdx
mov rbp, rsi
inc rbp
cmp byte [rdx + rbp], 0
jne 0x140066fe3
mov r13, qword [rsp + 0x1c0]
mov rdi, rsi
sub ebp, r13d
sub ebp, r8d
lea r12d, [rbp + 8]
mov dword [rsp + 0x98], r12d
nop dword [rax]
inc rdi
cmp byte [rdx + rdi], 0
jne 0x140067010
xor ecx, ecx
add dil, 9
mov edx, 0x261
lea r8d, [rcx + 0x1b]
add dil, r13b
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rdx, str.thunderstorm
lea rcx, str.authority
mov r8d, r15d
mov qword [rsp + 0x80], rax
call qword [sym.imp.KERNEL32.dll_CopyFileA]
mov r14, rsi
mov dword [rsp + 0x78], eax
nop word [rax + rax]
inc r14
cmp byte [rbx + r14], 0
jne 0x140067060
imul r14d, r15d
sub r14d, r12d
sub r14d, 0x15
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rdx
mov dword [rsp + 0xac], eax
mov eax, dword [rsp + 0x1b0]
lea r8, [0x1400ed4d4]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], eax
lea rdx, str.thunderstorm
mov r9d, r12d
mov ecx, ebp
mov dword [rsp + 0x20], r12d
call qword [sym.imp.USER32.dll_CreateWindowExA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov r12, rsi
mov rcx, rax
mov qword [rsp + 0xa0], rax
movsx eax, dil
mov edx, eax
mov dword [rsp + 0xa8], eax
imul edx, dword [rsp + 0x80]
mov dword [rsp + 0xd0], edx
nop word [rax + rax]
inc r12
cmp byte [rbx + r12], 0
jne 0x140067100
lea eax, [rbp*8]
add r15d, 0xfffffffe
add eax, ebp
sub eax, edx
sub eax, r13d
add eax, ecx
add eax, r15d
add r12d, eax
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
movzx r13d, r12b
movzx eax, ax
mov r15, rsi
mov dword [rsp + 0x68], eax
sub r13b, al
nop dword [rax + rax]
inc r15
cmp byte [rbx + r15], 0
jne 0x140067140
mov r8d, dword [rsp + 0x1b8]
lea rdx, [0x1400ed4d4]
lea rcx, str.thunderstorm
add r15b, 0xb
add r15b, byte [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CopyFileA]
mov rdx, qword [rsp + 0xa0]
mov dword [rsp + 0x74], eax
movsx eax, al
movzx r13d, r13b
mov dword [rsp + 0x70], eax
lea eax, [rdx + rax*8]
mov dword [rsp + 0x6c], r13d
add eax, eax
mov dword [rsp + 0x7c], eax
cmp r13d, 0x10
jg 0x1400671d6
xor ecx, ecx
mov edx, 0x2c2
lea r8d, [rcx + 0x1a]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0xa6
lea r8d, [rcx + 0xf]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, rsi
mov dword [rsp + 0x64], eax
inc rcx
cmp byte [rbx + rcx], 0
jne 0x1400671e3
imul ecx, ebp
mov eax, r13d
imul eax, dword [rsp + 0x70]
imul ecx, dword [rsp + 0x1b8]
lea eax, [rax + rcx*2]
add eax, 8
sub eax, dword [rsp + 0x80]
mov dword [rsp + 0x8c], eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov r11d, dword [rsp + 0x70]
mov r8, qword [rsp + 0xa0]
mov r10d, dword [rsp + 0x64]
mov r9d, dword [rsp + 0x7c]
imul r11d, r8d
imul r10d, r9d
mov qword [rsp + 0x90], rax
mov rdx, rsi
mov dword [rsp + 0xd8], r10d
mov dword [rsp + 0xd4], r11d
cmp byte [rbx + rdx + 1], 0
lea rdx, [rdx + 1]
jne 0x140067253
mov eax, dword [rsp + 0x98]
mov ecx, 1
mov r13, rsi
add eax, eax
sub ecx, eax
imul ecx, r8d
lea eax, [r10 + rcx]
lea ecx, [rax + rdx*2]
lea eax, [r11 + 9]
add eax, ecx
movsx rcx, byte [rsp + 0x74]
mov dword [rsp + 0xcc], eax
nop
inc r13
cmp byte [rbx + r13], 0
jne 0x140067290
mov eax, ebp
mov edx, ecx
imul eax, dword [rsp + 0x1b8]
sub edx, eax
lea eax, [r9 - 0x3a]
sub edx, dword [rsp + 0x6c]
sub edx, dword [rsp + 0x68]
sub edx, r8d
add eax, edx
add r13d, eax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
lea rcx, str.thunderstorm
movsx rdi, dil
mov qword [rsp + 0xe8], rdi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r9, rdi
mov r8d, 0x10
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
mov r8d, dword [rsp + 0x68]
mov rcx, rsi
mov dword [rsp + 0xc4], eax
imul r8d, r12d
mov dword [rsp + 0xc0], r8d
nop dword [rax + rax]
inc rcx
cmp byte [rbx + rcx], 0
jne 0x140067310
mov rdx, qword [rsp + 0xa0]
mov eax, 1
sub eax, dword [rsp + 0x8c]
imul eax, edx
sub eax, dword [rsp + 0x6c]
sub eax, edi
mov rdi, rsi
sub eax, dword [rsp + 0x90]
add eax, r8d
add ecx, eax
lea eax, [rbp + 9]
add ecx, dword [rsp + 0x78]
add ecx, dword [rsp + 0x98]
add eax, ecx
mov dword [rsp + 0x60], eax
nop dword [rax]
inc rdi
cmp byte [rbx + rdi], 0
jne 0x140067360
movsx rax, byte [rsp + 0x74]
imul eax, dword [rsp + 0x7c]
imul eax, eax, 7
inc eax
imul eax, edx
sub eax, dword [rsp + 0x1b0]
add eax, 0xfffffe30
add eax, dword [rsp + 0x64]
add eax, dword [rsp + 0x1c0]
add eax, ebp
add edi, eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [rsp + 0x150], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rcx, rsi
mov r9, rax
mov qword [rsp + 0xb0], rax
movsx eax, r15b
mov r8d, eax
mov dword [rsp + 0x88], eax
imul r8d, dword [rsp + 0x6c]
mov dword [rsp + 0xc8], r8d
inc rcx
cmp byte [rbx + rcx], 0
jne 0x1400673d5
imul ecx, dword [rsp + 0x1b8]
imul eax, dword [rsp + 0x70], 0x68
mov rdx, qword [rsp + 0xa0]
add eax, edx
lea ecx, [rcx + rax*2]
mov eax, dword [rsp + 0x60]
imul eax, dword [rsp + 0x90]
add ecx, eax
mov eax, dword [rsp + 0x80]
imul eax, r12d
add ecx, eax
mov eax, dword [rsp + 0x68]
sub ecx, r8d
add eax, 5
sub ecx, edi
add ecx, r9d
add eax, ecx
mov dword [rsp + 0xf0], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r15, rsi
inc r15
cmp byte [rbx + r15], 0
jne 0x140067434
mov eax, dword [rsp + 0x8c]
lea r8, [0x140001b00]
imul eax, dword [rsp + 0x64]
imul ecx, eax, 0xd
mov rax, qword [rsp + 0x1c0]
lea edx, [rax*2 - 0xc]
mov rax, qword [rsp + 0x80]
sub edx, ecx
lea eax, [rax + rax*8]
xor ecx, ecx
add edx, eax
imul eax, r12d, 7
sub edx, eax
mov rax, qword [rsp + 0x90]
sub edx, dword [rsp + 0xa0]
sub edx, dword [rsp + 0xac]
add eax, edx
xor edx, edx
add r15d, eax
xor eax, eax
mov qword [rsp + 0x28], rax
lea r9d, [rax + 4]
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
movzx edi, byte [rsp + 0xf0]
mov rdx, qword [rsp + 0x80]
movzx ecx, dil
mov qword [rsp + 0xe0], rax
shl cl, 2
add dil, cl
xor ecx, ecx
sub dil, al
add dil, 0xd
add dil, byte [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov edx, 0x32
lea r8d, [rdx - 0x1b]
xor ecx, ecx
mov qword [rsp + 0xb8], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r10d, dword [rsp + 0x88]
mov r8, qword [rsp + 0xa0]
mov r11, rax
movzx r9d, dil
mov rdx, rsi
mov dword [rsp + 0x78], r9d
imul eax, dword [rsp + 0x8c], 0x1a0
imul r10d, r8d
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x88], r10d
nop dword [rax + rax]
inc rdx
cmp byte [rbx + rdx], 0
jne 0x140067540
mov eax, dword [rsp + 0xb0]
mov rdi, qword [rsp + 0xe0]
mov ecx, 0xfffffffe
imul eax, dword [rsp + 0x60]
imul eax, dword [rsp + 0xcc]
sub ecx, eax
mov eax, dword [rsp + 0xa8]
imul ecx, dword [rsp + 0x90]
imul eax, r8d
imul eax, dword [rsp + 0xac]
add eax, r9d
mov r9d, dword [rsp + 0x1b8]
imul eax, dword [rsp + 0x80]
shl eax, 2
sub ecx, eax
movsx rax, byte [rsp + 0x74]
sub ecx, eax
lea eax, [r9 - 0x3b]
sub ecx, r10d
mov r10d, dword [rsp + 0x98]
sub ecx, r11d
sub ecx, dword [rsp + 0xb8]
sub ecx, edi
sub ecx, r10d
sub ecx, ebp
sub ecx, dword [rsp + 0x1b0]
add ecx, dword [rsp + 0xc0]
add ecx, dword [rsp + 0xd8]
add ecx, dword [rsp + 0x6c]
add ecx, dword [rsp + 0x70]
add ecx, dword [rsp + 0x1c0]
add eax, ecx
add edx, eax
mov rax, qword [rsp + 0x1a0]
mov dword [rax], edx
mov rdx, rsi
mov qword [rax + 8], r11
inc rdx
cmp byte [rbx + rdx], 0
jne 0x140067600
imul edx, dword [rsp + 0x1b0]
mov ecx, dword [rsp + 0xd4]
mov eax, dword [rsp + 0x150]
lea ecx, [rcx*8]
imul eax, dword [rsp + 0x60]
sub ecx, ebp
add ecx, edi
add ecx, ecx
sub ecx, eax
mov eax, dword [rsp + 0xc4]
imul eax, dword [rsp + 0x90]
sub ecx, eax
mov eax, dword [rsp + 0x8c]
imul eax, dword [rsp + 0x64]
sub ecx, eax
lea eax, [r12 + 1]
add edx, ecx
mov rcx, qword [rsp + 0x1c0]
imul eax, r8d
add edx, eax
mov eax, dword [rsp + 0xa8]
imul eax, r10d
add edx, eax
lea eax, [r9 + 0x6b]
sub edx, dword [rsp + 0x78]
sub edx, dword [rsp + 0x88]
sub edx, dword [rsp + 0xb8]
sub edx, dword [rsp + 0xb0]
sub edx, dword [rsp + 0x68]
add edx, dword [rsp + 0x6c]
add edx, r11d
add edx, dword [rsp + 0xf0]
add edx, dword [rsp + 0x7c]
add edx, dword [rsp + 0x80]
add edx, ecx
add eax, edx
mov rdx, qword [rsp + 0x1a0]
mov dword [rdx + 0x10], eax
mov eax, dword [rsp + 0x60]
mov rdx, rsi
imul eax, r8d
imul ecx, ebp
mov qword [rsp + 0x1c0], rcx
mov dword [rsp + 0x60], eax
inc rdx
cmp byte [rbx + rdx], 0
jne 0x1400676d7
mov ecx, dword [rsp + 0x68]
mov eax, dword [rsp + 0x90]
mov rbp, qword [rsp + 0x1c0]
imul ecx, r12d
imul eax, r13d
sub ecx, dword [rsp + 0xc8]
mov r13d, dword [rsp + 0x1b0]
imul ecx, r8d
sub ecx, eax
mov eax, r13d
imul eax, r9d
sub ecx, eax
mov eax, dword [rsp + 0xd0]
imul eax, r10d
add ecx, eax
mov rax, qword [rsp + 0xb0]
add eax, eax
sub ecx, eax
movsx rax, byte [rsp + 0x74]
sub ecx, dword [rsp + 0x78]
sub ecx, eax
mov eax, dword [rsp + 0x60]
sub ecx, dword [rsp + 0xb8]
sub ecx, edi
sub ecx, dword [rsp + 0x7c]
sub ecx, dword [rsp + 0x80]
add eax, ecx
mov rcx, qword [rsp + 0x1a0]
add edx, eax
lea eax, [rbp + 0x6f]
add edx, dword [rsp + 0x70]
add edx, r11d
add edx, dword [rsp + 0x64]
add eax, edx
mov dword [rcx + 0x14], eax
inc rsi
cmp byte [rbx + rsi], 0
jne 0x140067775
mov rdx, qword [rsp + 0x80]
mov rax, qword [rsp + 0xe8]
mov rbx, qword [rsp + 0x1a0]
imul eax, edx
imul eax, r10d
imul eax, eax, 0x36
sub r14d, eax
lea eax, [r15 - 1]
add r14d, 0x18
imul eax, r8d
lea ecx, [rax + r14*4]
movsx rax, byte [rsp + 0x74]
sub ecx, dword [rsp + 0x78]
sub ecx, dword [rsp + 0x6c]
sub ecx, dword [rsp + 0x88]
sub ecx, r11d
sub ecx, dword [rsp + 0xb8]
sub ecx, dword [rsp + 0x90]
sub ecx, dword [rsp + 0x64]
sub ecx, dword [rsp + 0x7c]
sub ecx, r12d
sub ecx, r13d
sub ecx, r9d
add eax, ecx
add esi, eax
add esi, dword [rsp + 0x60]
add esi, dword [rsp + 0x70]
add esi, edi
add esi, dword [rsp + 0xb0]
add esi, dword [rsp + 0x68]
add esi, ebp
add esi, edx
mov dword [rbx + 0x18], esi
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [rbx + 0x20], rax
mov rax, rbx
mov rbx, qword [rsp + 0x1a8]
add rsp, 0x160
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret