Function at 0x1400cdb60
Capabilities:
Create thread
Extract resource via kernel32 functions
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x10], edx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xf0
movzx edi, r8b
or rbp, 0xffffffffffffffff
mov r15d, r9d
mov r14d, edx
mov rbx, rcx
mov dword [rsp + 0x140], edi
mov rsi, rbp
nop dword [rax + rax]
inc rsi
cmp byte [rcx + rsi], 0
jne 0x1400cdba0
xor ecx, ecx
imul esi, edi
mov edx, 0x28f
lea r8d, [rcx + 0x1b]
imul esi, r14d
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r9, r14
xor r14d, r14d
lea r8, [0x140001b00]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r8, [0x140001b00]
mov r9, r15
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r13, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [rsp + 0x88], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea r8d, [r14 + 5]
mov edx, 0x2e3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r14, qword [rsp + 0x150]
mov qword [rsp + 0x78], rax
cmp r15d, esi
jb 0x1400cde7c
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
movzx eax, ax
mov dword [rsp + 0x6c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x68], eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0x90], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rdx, rbp
mov qword [rsp + 0x80], rax
nop dword [rax]
inc rdx
cmp byte [rbx + rdx], 0
jne 0x1400cdc90
mov r8, qword [rsp + 0x78]
mov eax, edi
mov rdi, rbp
imul eax, r15d
mov r15d, dword [rsp + 0x68]
imul ecx, r8d, 0xfffffff9
sub ecx, eax
mov eax, dword [rsp + 0x70]
add r15d, 3
imul eax, esi
sub ecx, eax
add r15d, ecx
add r15d, edx
inc rdi
cmp byte [rbx + rdi], 0
jne 0x1400cdcc5
mov ecx, dword [rsp + 0x140]
mov eax, dword [rsp + 0x60]
add r8d, 0xfffffff6
mov edx, 0x4f
imul eax, r12d
imul ecx, esi
imul ecx, dword [rsp + 0x148]
sub eax, ecx
xor ecx, ecx
add eax, r13d
add eax, r8d
lea r8d, [rdx - 0x3b]
add edi, eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, rbp
mov r8, rax
nop dword [rax]
inc rcx
cmp byte [r14 + rcx], 0
jne 0x1400cdd10
mov r13d, dword [rsp + 0x140]
imul dil
add al, r15b
movsx rdx, al
mov rax, qword [rsp + 0x80]
imul ecx, r13d
lea eax, [rax*8]
sub edx, ecx
sub edx, eax
mov rax, rbp
inc rax
cmp byte [rbx + rax], 0
jne 0x1400cdd46
imul eax, dword [rsp + 0x138]
lea r12d, [r8 + 4]
add edx, eax
sub edx, edi
sub edx, dword [rsp + 0x70]
add r12d, edx
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rcx, rbp
nop
inc rcx
cmp byte [rbx + rcx], 0
jne 0x1400cdd70
mov r9, qword [rsp + 0x80]
movzx eax, r15b
sub al, dil
sub al, byte [rsp + 0x70]
add cl, al
add cl, sil
add cl, r9b
add cl, byte [rsp + 0x88]
add cl, byte [rsp + 0x60]
movsx r8, cl
mov rcx, rbp
inc rcx
cmp byte [rbx + rcx], 0
jne 0x1400cdda6
mov edx, dword [rsp + 0x6c]
mov r11, qword [rsp + 0x78]
imul edi, r15d
shl edi, 2
imul ecx, esi
mov r10, rbp
sub edx, edi
add edx, 0xfffffffe
lea edx, [rcx + rdx*2]
sub edx, r11d
add edx, dword [rsp + 0x90]
nop word [rax + rax]
inc r10
cmp byte [rbx + r10], 0
jne 0x1400cdde0
mov eax, dword [rsp + 0x60]
imul r10d, r13d
mov ecx, 1
imul r10d, dword [rsp + 0x138]
imul eax, dword [rsp + 0x6c]
sub ecx, eax
mov eax, esi
imul ecx, r11d
add r10d, ecx
mov ecx, dword [rsp + 0x148]
imul eax, ecx
add r10d, eax
mov eax, dword [rsp + 0x68]
sub r10d, r9d
xor r9d, r9d
mov qword [rsp + 0x58], r9
mov qword [rsp + 0x50], r9
mov qword [rsp + 0x48], r9
mov qword [rsp + 0x40], r8
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], edx
sub r10d, eax
lea r8, str.c0a6
lea rdx, [0x1400ed4d4]
lea ecx, [r10 - 6]
mov r9d, r15d
mov dword [rsp + 0x20], r12d
call qword [sym.imp.USER32.dll_CreateWindowExA]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r15d, dword [rsp + 0x148]
jmp 0x1400cde7f
mov r13d, edi
xor ecx, ecx
mov edx, 0xe8
lea r8d, [rcx + 0x11]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, rbp
mov rdi, rax
inc rcx
cmp byte [r14 + rcx], 0
jne 0x1400cde96
imul ecx, esi
inc rbp
cmp byte [rbx + rbp], 0
jne 0x1400cdea3
mov r12, qword [rsp + 0x78]
sub ebp, ecx
sub ebp, r12d
sub ebp, dword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r9, qword [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x98]
mov r8d, ebp
mov rdx, rdi
mov qword [rsp + 0x20], r12
call fcn.1400dcc90
mov r8, qword [rsp + 0x60]
mov r12d, dword [rsp + 0x138]
mov rdx, qword [rsp + 0x70]
mov dword [rsp + 0x30], r12d
mov rcx, r8
xor r9d, r9d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor eax, eax
movsxd rdi, esi
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], r15d
mov r9d, ebp
mov r8, r14
mov rdx, rbx
mov ecx, esi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], r13d
call qword [sym.imp.USER32.dll_CreateWindowExA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor ecx, ecx
lea r8d, [rcx + 0xb]
mov edx, 0x367
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor eax, eax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x38], 0x20
mov dword [rsp + 0x30], r15d
mov r9d, r12d
mov r8, rbx
mov rdx, rbx
mov ecx, esi
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], r13d
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
movsx rcx, al
lea eax, [rbx + rbx]
lea edx, [rcx + rcx*4]
sub edx, eax
add edx, dword [rsp + 0x60]
cmp ebp, edx
jbe 0x1400cdfd5
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor eax, eax
mov rbx, qword [rsp + 0x130]
add rsp, 0xf0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret