Function at 0x14001e080
Capabilities:
Extract resource via kernel32 functions
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xd0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp - 9], rax
mov rax, qword [rbp + 0x6f]
mov r12, qword [rbp + 0x7f]
mov r13, qword [rbp + 0x67]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], r12
mov rbx, r9
mov qword [rsp + 0x48], r8
mov r15, rdx
mov qword [rbp - 0x49], rcx
call fcn.14006c390
xor edx, edx
mov rcx, rax
mov r14, rax
call fcn.14009c9f0
movzx esi, byte [rbp + 0x77]
or rdi, 0xffffffffffffffff
mov dword [rsp + 0x30], eax
cmp sil, al
jae 0x14001e1b1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, r15
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov ecx, dword [rsp + 0x38]
mov rsi, rax
imul ecx, r13d
sub r12d, ecx
mov rcx, rax
sub r12d, dword [rsp + 0x48]
add r12d, r15d
add r12d, r14d
mov edx, r12d
call fcn.1400808a0
mov eax, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
imul eax, edx
sub eax, esi
mov qword [rbp - 0x71], 0
mov rcx, rdi
sub eax, r12d
add eax, r15d
add eax, r14d
mov dword [rbp - 0x79], eax
inc rcx
cmp byte [rbx + rcx], 0
jne 0x14001e154
movzx eax, byte [rbp + 0x77]
imul esi, r12d
imul ecx, edx
imul eax, dword [rsp + 0x38]
imul esi, dword [rsp + 0x30]
sub esi, eax
lea eax, [r15 + rcx]
add esi, eax
mov dword [rbp - 0x69], esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea r8, [0x1400ed4fc]
movups xmm0, xmmword [rbp - 0x79]
movsd xmm1, qword [rbp - 0x69]
lea rcx, [rbp - 0x39]
movzx edx, al
movaps xmmword [rbp - 0x39], xmm0
movsd qword [rbp - 0x29], xmm1
call fcn.1400925e0
mov r12, qword [rsp + 0x40]
movzx esi, byte [rbp + 0x77]
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
mov qword [rbp - 0x31], 0
mov rcx, rdi
movzx eax, ax
mov dword [rbp - 0x39], eax
nop dword [rax + rax]
inc rcx
cmp byte [rbx + rcx], 0
jne 0x14001e1d0
imul ecx, r13d
movzx eax, sil
imul ecx, r15d
imul eax, r12d
sub ecx, eax
add ecx, r14d
add ecx, dword [rsp + 0x30]
mov dword [rbp - 0x29], ecx
mov rcx, rdi
nop dword [rax + rax]
inc rcx
cmp byte [rbx + rcx], 0
jne 0x14001e200
mov eax, r12d
imul eax, r14d
imul eax, r14d
add eax, r15d
sub eax, ecx
mov dword [rbp - 0x25], eax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov qword [rbp - 0x19], r14
movups xmm0, xmmword [rbp - 0x39]
mov dword [rbp - 0x21], eax
mov rax, rdi
movaps xmmword [rbp - 0x79], xmm0
movsd xmm0, qword [rbp - 0x19]
movsd qword [rbp - 0x59], xmm0
movups xmm1, xmmword [rbp - 0x29]
movaps xmmword [rbp - 0x69], xmm1
nop word [rax + rax]
cmp byte [rbx + rax + 1], 0
lea rax, [rax + 1]
jne 0x14001e250
sub r13b, sil
lea rdx, [rbp - 0x79]
mov ecx, 1
lea r8d, [rax + r13]
add r8b, r15b
call fcn.140068280
lea rax, [0x1400ed4fc]
mov qword [rbp - 0x79], r12
mov qword [rbp - 0x71], rax
mov rax, qword [rsp + 0x38]
mov qword [rbp - 0x69], rax
nop dword [rax + rax]
inc rdi
cmp byte [rbx + rdi], 0
jne 0x14001e290
movzx ebx, byte [rbp - 0x25]
movups xmm0, xmmword [rbp - 0x79]
movsd xmm1, qword [rbp - 0x69]
sub bl, al
lea rdx, str.rambler
lea rcx, [rbp - 0x39]
add bl, r15b
sub bl, dil
movaps xmmword [rbp - 0x39], xmm0
movsd qword [rbp - 0x29], xmm1
add bl, 9
movzx r8d, bl
call fcn.14007c050
lea rcx, [rbp - 0x39]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
movzx ecx, bl
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, qword [rbp - 0x49]
mov ecx, dword [rsp + 0x30]
mov qword [rbx], rax
mov qword [rbx + 8], r12
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rbx + 0x10], rax
mov rax, rbx
mov rcx, qword [rbp - 9]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x110]
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret