Function at 0x1400c4ee0
Capabilities:
Extract resource via kernel32 functions
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x238
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x220], rax
mov r14, qword [rsp + 0x2a0]
mov rsi, r9
mov rbp, r8
mov r13, rdx
mov r15d, ecx
mov dword [rsp + 0x68], ecx
mov qword [rsp + 0x80], r14
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
lea r8d, [rcx + 0x12]
mov edx, 0x15b
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rbx, rax
mov qword [rsp + 0x98], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
or rdi, 0xffffffffffffffff
mov edx, eax
mov dword [rsp + 0x64], eax
mov rcx, rdi
inc rcx
cmp byte [rsi + rcx], 0
jne 0x1400c4f60
mov rax, rdi
nop dword [rax]
inc rax
cmp byte [rax + rbp], 0
jne 0x1400c4f70
imul cl
mov r8d, 0x140
movzx ecx, al
movzx eax, r13b
imul cl
lea r12d, [r15 + rax]
movzx eax, dl
add r12b, r14b
mov r14, qword [rsp + 0x78]
imul r12b
movzx ecx, al
shl cl, 2
lea edx, [rcx + rax]
movzx eax, r13b
lea rcx, [rsp + 0xe0]
add dl, dl
inc dl
imul dl
xor edx, edx
sub al, r14b
sub al, bl
mov byte [rsp + 0x60], al
call fcn.1400e27d0
lea rdx, [rsp + 0xe0]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea rcx, [rsp + 0xb8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov r8d, dword [rsp + 0x64]
cmp r8b, r12b
ja 0x1400c50d1
movzx eax, r13b
mov rcx, rdi
imul r15b
movzx edx, al
inc rcx
cmp byte [rsi + rcx], 0
jne 0x1400c5006
movzx eax, r12b
movzx r14d, dl
imul bl
sub r14b, al
add r14b, byte [rsp + 0x80]
add r14b, r13b
add r14b, byte [rsp + 0x70]
sub r14b, cl
mov rcx, rdi
add r14b, 9
inc rcx
cmp byte [rsi + rcx], 0
jne 0x1400c5036
movzx eax, r13b
imul cl
movzx ecx, al
movzx eax, bl
imul cl
mov rcx, rdi
movzx r15d, al
movzx eax, r8b
imul r12b
add r15b, al
add r15b, dl
inc rcx
cmp byte [rcx + rbp], 0
jne 0x1400c5061
sub r15b, cl
mov rcx, rbx
sub r15b, 0xc
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor eax, eax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
movzx edx, r12b
movzx r9d, r12b
movzx r8d, r14b
mov qword [rsp + 0x40], rdx
mov dword [rsp + 0x38], r9d
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], r8d
movzx ecx, r15b
mov rdx, rbp
mov r8, rbp
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov r15d, dword [rsp + 0x68]
mov r14, qword [rsp + 0x78]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor ecx, ecx
lea r8d, [rcx + 5]
mov edx, 0x365
call qword [sym.imp.KERNEL32.dll_FindResourceA]
movzx edx, r12b
mov rcx, rdi
mov qword [rsp + 0x90], rax
movzx eax, byte [rsp + 0x60]
mov dword [rsp + 0x88], edx
nop dword [rax]
inc rcx
cmp byte [rcx + rbp], 0
jne 0x1400c5110
mov r12, qword [rsp + 0x80]
imul eax, edx
imul r14d, eax
inc r14d
add r14d, ecx
xor ecx, ecx
imul r14d, r13d
add r14d, r12d
add r14d, r15d
add r14d, dword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rdi
mov rcx, rax
mov qword [rsp + 0xa0], rax
inc rbx
cmp byte [rsi + rbx], 0
jne 0x1400c5153
mov eax, dword [rsp + 0x98]
imul ebx, r15d
movzx r15d, cl
xor ecx, ecx
mov edx, 0x164
lea r8d, [rcx + 0xc]
imul eax, dword [rsp + 0x78]
inc eax
imul eax, r13d
add ebx, eax
mov al, 7
sub ebx, r12d
imul r14b
sub r15b, al
sub ebx, 2
add r15b, byte [rsp + 0x90]
add r15b, bl
add r15b, byte [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0xb0], rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov qword [rsp + 0xa8], rax
cmp byte [rsp + 0x64], bl
jb 0x1400c51c9
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov r12, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rdi
mov rdx, rax
nop
inc rcx
cmp byte [rcx + rbp], 0
jne 0x1400c51e0
mov r8, qword [rsp + 0x70]
imul edx, r12d
mov eax, r13d
imul eax, dword [rsp + 0x90]
imul eax, r8d
add eax, eax
sub edx, eax
movzx eax, byte [rsp + 0x64]
imul edx, r8d
imul eax, dword [rsp + 0x88]
imul eax, dword [rsp + 0x98]
add edx, eax
movzx eax, byte [rsp + 0x60]
inc eax
imul eax, r13d
add edx, eax
movzx eax, r15b
imul eax, ebx
add edx, eax
sub edx, dword [rsp + 0xa0]
sub edx, dword [rsp + 0x78]
add edx, dword [rsp + 0x80]
add edx, dword [rsp + 0x68]
add edx, dword [rsp + 0xb0]
add edx, dword [rsp + 0xa8]
add edx, r14d
sub edx, ecx
nop
inc rdi
cmp byte [rsi + rdi], 0
jne 0x1400c5260
lea eax, [rdx + 3]
add eax, edi
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x238
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret