Function at 0x1400cfd90
Capabilities:
Create thread
Extract resource via kernel32 functions
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1b0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rcx, [rsp + 0x90]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x90]
mov edx, 0x104
mov r14, rax
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rcx, str.racer
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
xor ecx, ecx
mov edx, 0x145
lea r8d, [rcx + 0x1c]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x384
lea r8d, [rcx + 6]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x2d2
lea r8d, [rcx + 0xc]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x35f
mov qword [rsp + 0x58], rax
lea eax, [r14 + 0x14]
lea r8d, [rcx + 6]
mov dword [rsp + 0x68], eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbp, rax
mov qword [rsp + 0x38], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
imul ecx, ebx, 7
mov esi, dword [rsp + 0x58]
xor ebx, ebx
lea r8, [0x140001b00]
sub esi, ecx
xor edx, edx
xor ecx, ecx
sub esi, eax
mov qword [rsp + 0x28], rbx
mov r15, rax
sub esi, r14d
mov dword [rsp + 0x20], ebx
sub esi, 3
mov r9d, esi
mov dword [rsp + 0x30], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
lea r8, [0x140001b00]
mov r9d, 0xfffffffc
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r8d, [rbx + 5]
mov edx, 0x324
xor ecx, ecx
mov r12, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
lea edx, [rbx + 0x32]
lea r8d, [rbx + 0x1d]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
movzx r13d, r14b
sub r13b, r12b
imul ebx, r14d, 0xfffffffb
mov ecx, ebp
lea eax, [rdi*4]
imul ecx, r15d
mov edx, 0x2d2
add r13b, 8
sub ebx, ecx
mov ecx, r15d
sub ecx, eax
sub ebx, 0x4b
sub ecx, r14d
lea r14d, [rsi + 0x22]
add r14d, ecx
xor ecx, ecx
lea r8d, [rcx + 9]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r9, qword [rsp + 0x40]
mov r8, qword [rsp + 0x38]
mov rdx, rax
lea ebp, [rdi + 2]
mov ecx, r14d
imul ecx, ebx
lea esi, [rcx + rcx*4]
lea ecx, [rbx + rbx*4]
imul ebp, r9d
sub esi, eax
add eax, 0x18
sub ebp, r15d
add ebp, eax
movzx eax, r13b
lea ebx, [r8 + 3]
imul r15d, r9d
sub ecx, r15d
mov r15d, dword [rsp + 0x30]
sub ecx, eax
movzx eax, r9b
add ecx, r14d
add ebx, ecx
imul r15b
movzx ecx, al
movzx eax, r8b
imul cl
movzx ecx, al
movzx eax, r9b
shl cl, 7
dec cl
imul cl
movzx edi, al
movzx eax, dl
imul sil
add dil, al
mov rax, qword [rsp + 0x48]
shl al, 2
add dil, al
sub dil, r14b
sub dil, 0xf
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
sub bpl, r12b
add bpl, bpl
add bpl, byte [rsp + 0x40]
add bpl, bpl
sub bpl, byte [rsp + 0x68]
sub bpl, bl
sub bpl, r14b
sub bpl, r15b
sub bpl, al
sub bpl, r13b
add bpl, 0x19
add bpl, sil
add bpl, byte [rsp + 0x38]
call qword [sym.imp.USER32.dll_GetActiveWindow]
cmp bpl, dil
je 0x1400d006c
xor ecx, ecx
mov edx, 0x2f1
lea r8d, [rcx + 0x16]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x320
lea r8d, [rcx + 0x12]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x90]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
mov edx, 0x3c1
lea r8d, [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret