Function at 0x1400ab860
Capabilities:
Create thread
Extract resource via kernel32 functions
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb0
movzx ebp, r8b
movzx esi, cl
cmp r8b, cl
jg 0x1400ab88e
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call qword [sym.imp.USER32.dll_GetActiveWindow]
movzx r14d, sil
lea r15d, [rsi + rbp]
movsx edi, sil
sub r14b, bpl
mov qword [rsp + 0x108], rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor edx, edx
mov r12, rax
movsx eax, al
lea r13d, [rax*2 - 7]
mov dword [rsp + 0xf0], eax
cmp bpl, dil
jg 0x1400ab968
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rdx
movsx rcx, r12b
lea rdx, str.waitress
lea r8, str.nigeria
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x38], r13d
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], eax
movsx r9d, r14b
mov ecx, r13d
mov dword [rsp + 0x20], edi
call qword [sym.imp.USER32.dll_CreateWindowExA]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
xor ecx, ecx
mov edx, 0xac
lea r8d, [rcx + 9]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
lea rcx, str.baobab
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x60], rax
cmp sil, r12b
je 0x1400ab9cd
xor ecx, ecx
mov edx, 0x37f
lea r8d, [rcx + 0x1a]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x3d7
lea r8d, [rcx + 0x1a]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, str.typewriter
movzx ebx, r15b
movsx rdi, bpl
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.waitress
mov r9d, ebx
mov r8, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
movsx edi, sil
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor edx, edx
movsx ecx, r14b
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rdx
movzx eax, r15b
movsxd rbx, r13d
lea r8, str.typewriter
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x38], r13d
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ecx
lea rdx, str.waitress
mov r9d, edi
mov ecx, edi
mov dword [rsp + 0x20], 2
call qword [sym.imp.USER32.dll_CreateWindowExA]
movsx eax, bpl
imul eax, edi
sub eax, dword [rsp + 0xf0]
add eax, 0x41
mov dword [rsp + 0x90], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
lea rcx, str.typewriter
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
xor ecx, ecx
mov edx, 0x305
lea r8d, [rcx + 5]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
lea r8, [0x140001b00]
mov r9, rbx
mov qword [rsp + 0x68], rax
xor eax, eax
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
test sil, sil
jle 0x1400abad2
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
mov edx, 0x25f
lea r8d, [rcx + 0x1d]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x2c9
lea r8d, [rcx + 0x1a]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov al, 7
add bpl, 9
imul r15b
lea ecx, [rax + 2]
movzx eax, byte [rsp + 0x108]
imul cl
movzx ecx, al
movzx eax, byte [rsp + 0x90]
shl al, 2
add cl, al
mov rax, qword [rsp + 0xf8]
add cl, byte [rax + 4]
sub cl, byte [rsp + 0x60]
sub cl, dil
sub cl, r14b
lea eax, [rcx + r13]
add al, bl
mov rbx, qword [rsp + 0x100]
add al, byte [rsp + 0x68]
add al, r12b
add al, sil
add al, bpl
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret