Function at 0x14009fa50
Capabilities:
Create thread
Extract resource via kernel32 functions
Query environment variable

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa8
mov r13, r8
mov r12, rdx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ecx, ecx
lea r8d, [rcx + 3]
mov edx, 0x3e6
mov qword [rsp + 0xf8], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rsi, qword [rsp + 0x118]
or rbp, 0xffffffffffffffff
mov rdx, rax
mov qword [rsp + 0x38], rax
mov rcx, rbp
inc rcx
cmp byte [rsi + rcx], 0
jne 0x14009fab2
mov eax, r15d
mov r14d, 1
shl eax, 6
mov ebx, r14d
sub ebx, eax
imul ebx, r13d
add ebx, edx
add ebx, r12d
sub ebx, ecx
mov dword [rsp + 0x80], ebx
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [rsp + 0x48], rax
cmp r15d, 0x10
jb 0x14009fb01
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, qword [rsp + 0x108]
mov r8, qword [rsp + 0x110]
mov rdx, qword [rsp + 0x120]
sub r14d, ebx
movzx eax, cl
movzx edi, r15b
shl r14d, 2
imul byte [rdx + 0x28]
mov rdx, qword [rsp + 0xf8]
sub dil, al
movzx eax, dl
imul r8b
sub dil, al
movzx eax, dl
mov dword [rsp + 0x100], eax
add dil, r13b
add dil, r12b
imul eax, r15d
sub r14d, eax
lea eax, [rcx + rcx*4]
sub r14d, eax
movzx eax, dil
sub r14d, r8d
sub r14d, dword [rsp + 0x38]
add r14d, r12d
imul r14b
movzx ebx, al
shl bl, 2
sub bl, cl
movsx ecx, bl
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
movsx r8, bl
movzx r9d, dil
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x68], r8
mov dword [rsp + 0x30], r9d
mov rcx, rbp
nop dword [rax + rax]
inc rcx
cmp byte [rsi + rcx], 0
jne 0x14009fba0
mov rdx, qword [rsp + 0x108]
mov eax, dword [rsp + 0x110]
mov rbx, qword [rsp + 0x38]
imul ecx, r13d
imul ecx, r15d
imul eax, edx
mov edi, r12d
sub edi, eax
sub edi, ecx
mov rcx, rdx
sub edi, r9d
sub edi, r8d
sub edi, ebx
call qword [sym.imp.KERNEL32.dll_LockResource]
lea rcx, str.alley
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, qword [rsp + 0x108]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [rsp + 0x58], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
lea r8d, [rcx + 5]
mov edx, 0x1be
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, rbp
mov qword [rsp + 0x50], rax
nop dword [rax]
inc rcx
cmp byte [rsi + rcx], 0
jne 0x14009fc30
movzx eax, cl
shl al, 2
add cl, al
sub bl, cl
sub bl, byte [rsp + 0x80]
add bl, 8
add bl, r13b
add bl, r12b
add bl, byte [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
mov word [rsp + 0xf8], ax
test r15d, r15d
je 0x14009fc79
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, qword [rsp + 0xf0]
mov qword [rcx], rax
mov qword [rcx + 8], 0
inc rbp
cmp byte [rsi + rbp], 0
jne 0x14009fc92
mov rax, qword [rsp + 0x58]
movzx ecx, byte [rsp + 0xf8]
add eax, eax
sub eax, dword [rsp + 0x100]
lea edx, [rax*2 + 0x1e]
mov rax, qword [rsp + 0x68]
imul eax, r14d
lea eax, [rax*4 + 1]
imul eax, dword [rsp + 0x108]
sub edx, eax
movzx eax, bl
mov rbx, qword [rsp + 0xf0]
imul ecx, eax
mov rax, qword [rsp + 0x40]
add edx, ecx
lea eax, [rax*4 - 3]
xor ecx, ecx
lea r8d, [rcx + 7]
imul eax, r13d
add edx, eax
mov rax, qword [rsp + 0x48]
imul eax, dword [rsp + 0x110]
add edx, eax
mov rax, qword [rsp + 0x120]
sub edx, dword [rsp + 0x30]
sub edx, dword [rsp + 0x50]
sub edx, dword [rsp + 0x60]
sub edx, edi
sub edx, r15d
add edx, dword [rax]
add edx, dword [rsp + 0x38]
add edx, r12d
sub edx, ebp
mov dword [rbx + 0x10], edx
mov edx, 0x1b1
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor edi, edi
lea r8, [0x140001b00]
lea r9d, [rdi + 0x10]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rdi
mov qword [rbx + 0x18], rax
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x28], rdi
mov qword [rbx + 0x20], rax
mov rax, rbx
add rsp, 0xa8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret