Function at 0x100014f6
Capabilities:
Extract resource via kernel32 functions
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa8
mov esi, esp
mov eax, 0x14
call fcn.1013e9c0
mov eax, esp
and eax, 0xfffffff8
mov esp, eax
mov ecx, 8
mov dword [esi + 0x6c], eax
mov eax, ecx
call fcn.1013e9c0
mov eax, esp
and eax, 0xfffffff8
mov esp, eax
mov ecx, eax
mov dword [esi + 0x7c], 0xce9
sub esp, 0xc
mov edx, esp
lea edi, [esi + 0x7c]
mov dword [edx + 4], edi
lea edi, [esi + 0x70]
mov dword [edx], edi
mov dword [edx + 8], 0x967
mov edx, dword [sym.imp.USER32.dll_GetRawInputDeviceList]
mov dword [esi + 0x68], eax
mov dword [esi + 0x64], ecx
call edx
sub esp, 0x10
mov ecx, esp
lea edx, [esi + 0x80]
mov dword [ecx + 4], edx
mov dword [ecx + 0xc], 0x45d
mov dword [ecx + 8], 0x756
mov dword [ecx], 0x92a63
mov ecx, dword [sym.imp.USER32.dll_DrawFrameControl]
mov dword [esi + 0x60], eax
call ecx
xor ecx, ecx
mov dword [esi + 0x5c], eax
mov dword [esi + 0x58], ecx
jmp 0x1000161e
xor eax, eax
sub esp, 0x18
mov ecx, esp
mov dword [ecx + 0x14], 0xf25
mov dword [ecx + 0x10], 0x102920d6
mov dword [ecx + 0xc], 0xf25
mov dword [ecx + 8], 0x102920ea
mov dword [ecx + 4], 0xf69
mov dword [ecx], 0xc68
mov ecx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [esi + 0x54], eax
call ecx
xor ecx, ecx
mov edx, dword [esi + 0x50]
sub edx, 0xd
mov dword [esi + 0x4c], eax
mov dword [esi + 0x48], ecx
mov dword [esi + 0x44], edx
je 0x1000174c
jmp 0x100015ea
mov eax, dword [esi + 0x50]
sub eax, 0x30
mov ecx, dword [esi + 0x48]
mov dword [esi + 0x40], eax
mov dword [esi + 0x3c], ecx
je 0x1000170a
jmp 0x10001778
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [esi + 0x50]
add eax, 1
cmp eax, 0xc
mov dword [esi + 0x58], eax
je 0x10001604
mov eax, dword [esi + 0x58]
sub esp, 8
mov ecx, esp
mov dword [ecx + 4], 0x7c0
mov dword [ecx], 0x3ad
mov ecx, dword [sym.imp.ADVAPI32.dll_AreAllAccessesGranted]
mov dword [esi + 0x50], eax
call ecx
sub esp, 0x14
mov ecx, esp
mov dword [ecx + 0x10], 0x25b
mov dword [ecx + 0xc], 0xb56
mov dword [ecx + 8], 0xb56
mov dword [ecx + 4], 0x25b
mov dword [ecx], 0x8590
mov ecx, dword [sym.imp.USER32.dll_CopyImage]
mov dword [esi + 0x38], eax
call ecx
xor ecx, ecx
mov dword [esi + 0x34], eax
mov dword [esi + 0x30], ecx
mov eax, dword [esi + 0x30]
mov ecx, 0x38e38e39
mov dword [esi + 0x2c], eax
mul ecx
shr edx, 2
imul eax, edx, 0x12
mov ecx, dword [esi + 0x2c]
sub ecx, eax
mov eax, ecx
sub eax, 9
mov dword [esi + 0x28], ecx
mov dword [esi + 0x24], eax
je 0x100016d6
jmp 0x1000169f
mov eax, dword [esi + 0x28]
sub eax, 2
mov dword [esi + 0x20], eax
jne 0x100016ef
jmp 0x100016ac
sub esp, 0x10
mov eax, esp
mov dword [eax + 0xc], 0xbd5
mov dword [eax + 8], 1
mov dword [eax + 4], 0x950
mov dword [eax], 0xab5e7f
mov eax, dword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
call eax
mov dword [esi + 0x1c], eax
sub esp, 8
mov eax, esp
mov dword [eax + 4], 0x62b
mov dword [eax], 0xf0ea34
mov eax, dword [sym.imp.USER32.dll_SwitchToThisWindow]
call eax
mov eax, dword [esi + 0x2c]
add eax, 1
cmp eax, 0xa8
mov dword [esi + 0x30], eax
je 0x10001596
jmp 0x10001678
sub esp, 4
mov eax, esp
mov dword [eax], 0xd6fb2e
mov eax, dword [sym.imp.ole32.dll_CoTaskMemAlloc]
call eax
sub esp, 0x10
mov ecx, esp
lea edx, [esi + 0x90]
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], 0x110
mov dword [ecx + 4], 0x531637
mov dword [ecx], 0xd0aea8
mov ecx, dword [sym.imp.USER32.dll_DrawCaption]
mov dword [esi + 0x18], eax
call ecx
mov dword [esi + 0x14], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
call eax
sub esp, 8
mov ecx, esp
mov dword [ecx + 4], 0x426209
mov dword [ecx], 0x5d7a15
mov ecx, dword [sym.imp.USER32.dll_ValidateRgn]
mov dword [esi + 0x10], eax
call ecx
mov dword [esi + 0xc], eax
jmp 0x1000160c
mov eax, dword [esi + 0x3c]
sub esp, 4
mov ecx, esp
mov dword [ecx], 0x1a8
mov ecx, dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [esi + 8], eax
call ecx
sub esp, 4
mov eax, esp
mov dword [eax], 0x5e2ba9
mov eax, dword [sym.imp.KERNEL32.dll_LockResource]
call eax
mov ecx, dword [esi + 0x6c]
mov dword [ecx + 0x10], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 8], 0
mov dword [ecx + 4], 0
mov dword [ecx], 0
mov edx, dword [esi + 0x68]
mov dword [edx + 4], 0
mov dword [edx], 0
sub esp, 0x10
mov edi, esp
mov ebx, dword [esi + 0x64]
mov dword [edi + 8], ebx
mov dword [edi], ecx
mov dword [edi + 0xc], 0xbff
mov dword [edi + 4], 0x31b
mov edi, dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorSacl]
mov dword [esi + 4], eax
call edi
mov ecx, dword [esi + 8]
add ecx, 1
cmp ecx, 0xa
mov dword [esi], eax
mov dword [esi + 0x3c], ecx
je 0x1000160c
jmp 0x10001778