Function at 0x1400964e0
Capabilities:
Copy file
Create thread
Extract resource via kernel32 functions
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x208
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
mov r12d, r8d
mov r13d, ecx
mov dword [rsp + 0x64], edx
mov dword [rsp + 0x7c], r8d
add r8d, ecx
mov r15, rcx
imul r13d, r12d
lea edx, [rcx + r13*2]
or rsi, 0xffffffffffffffff
mov rbx, r9
mov dword [rsp + 0x6c], edx
mov dword [rsp + 0x68], r8d
mov rcx, rsi
inc rcx
cmp byte [r9 + rcx], 0
jne 0x140096536
mov al, 7
imul cl
movzx ebp, al
mov rax, rsi
sub bpl, r13b
sub bpl, 2
add bpl, r15b
inc rax
cmp byte [r9 + rax], 0
jne 0x140096554
add eax, r15d
mov r14d, 0xfffffffb
lea ecx, [r8 + 7]
add ecx, eax
movzx eax, bpl
mov dword [rsp + 0x70], ecx
imul cl
sub r14b, al
sub r14b, dl
mov dword [rsp + 0x74], r14d
test r12b, r12b
je 0x1400966a7
xor ecx, ecx
mov edx, 0x30d
lea r8d, [rcx + 0x11]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
movzx r9d, al
xor eax, eax
lea r8, [0x140001b00]
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
lea r8d, [rcx + 0x19]
mov edx, 0x3e1
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdi, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
lea r8d, [rcx + 0x1b]
mov edx, 0x161
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor eax, eax
movsx r9d, bpl
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x28], r9d
lea r8, str.panties
lea rdx, str.subsidence
mov ecx, 0x10
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExA]
xor eax, eax
mov qword [rsp + 0x28], rax
lea r8, [0x140001b00]
lea r9d, [rax + 2]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor eax, eax
lea r8, [0x140001b00]
mov qword [rsp + 0x28], rax
lea r9d, [rax + 2]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdi, rsi
mov qword [rsp + 0x90], rax
mov eax, dword [rsp + 0x6c]
sub r12b, al
add r12b, r15b
add r12b, bpl
inc rdi
cmp byte [rbx + rdi], 0
jne 0x1400966c5
imul byte [rsp + 0x70]
movzx ecx, al
movzx eax, r14b
mov r14d, dword [rsp + 0x7c]
imul cl
movzx ecx, al
movzx eax, bpl
imul cl
movzx ecx, al
mov al, 7
imul cl
movzx ecx, r14b
sub cl, al
sub cl, byte [rsp + 0x64]
sub cl, byte [rsp + 0x68]
sub cl, r13b
add dil, cl
mov ecx, 0xffff
add dil, r15b
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
mov rdx, rsi
mov dword [rsp + 0x78], eax
nop dword [rax]
inc rdx
cmp byte [rbx + rdx], 0
jne 0x140096720
movsx rax, bpl
imul ecx, eax, 7
mov eax, r15d
sub eax, ecx
xor ecx, ecx
add eax, dword [rsp + 0x6c]
lea r8d, [rcx + 0xb]
add eax, dword [rsp + 0x68]
sub eax, edx
mov edx, 0x293
mov dword [rsp + 0x98], eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0xa0], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
lea r8d, [rcx + 0xa]
mov edx, 0x194
mov dword [rsp + 0x80], eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0xe0]
mov edx, 0x104
mov qword [rsp + 0xa8], rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea rcx, [rsp + 0xe0]
mov edx, 0x104
mov qword [rsp + 0x88], rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, dword [rsp + 0x64]
lea rdx, str.c7a2
lea rcx, str.turret
call qword [sym.imp.KERNEL32.dll_CopyFileA]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
movzx edx, byte [rsp + 0x78]
mov qword [rsp + 0xc0], rax
mov rax, rsi
nop word [rax + rax]
inc rax
cmp byte [rbx + rax], 0
jne 0x1400967f0
imul eax, dword [rsp + 0x64]
imul eax, r13d
imul eax, dword [rsp + 0x68]
imul ecx, eax, 0xfffffff9
movsx eax, bpl
imul eax, edx
mov edx, 0x104
imul eax, dword [rsp + 0x98]
imul eax, dword [rsp + 0x90]
sub ecx, eax
mov rax, qword [rsp + 0x88]
sub ecx, dword [rsp + 0xa0]
add eax, 9
sub ecx, dword [rsp + 0x80]
add ecx, r15d
add eax, ecx
lea rcx, [rsp + 0xe0]
mov dword [rsp + 0xc8], eax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov qword [rsp + 0xd0], rax
movzx eax, byte [rsp + 0xc8]
sub al, 4
mov byte [rsp + 0x60], al
test r14d, r14d
jne 0x140096888
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor ecx, ecx
mov edx, 0x3ad
lea r8d, [rcx + 0x14]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, 1
mov edx, 0x2cd
mov qword [rsp + 0x98], rax
movzx eax, dil
sub ecx, eax
movzx eax, byte [rsp + 0x60]
imul r14d, ecx, 7
mov ecx, dword [rsp + 0x78]
imul eax, dword [rsp + 0xd0]
sub r14d, eax
mov rax, qword [rsp + 0x88]
lea eax, [rax*4]
sub r14d, eax
movsx rax, byte [rsp + 0x74]
add r14d, eax
movzx eax, cl
xor ecx, ecx
sub r14d, eax
lea r8d, [rcx + 0x18]
sub r14d, dword [rsp + 0x70]
add r14d, r15d
add r14d, dword [rsp + 0x64]
add r14d, dword [rsp + 0x90]
add r14d, dword [rsp + 0x6c]
add r14d, r13d
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov edx, dword [rsp + 0x74]
mov r13, rax
cmp dil, dl
je 0x140096936
lea rcx, [rsp + 0xe0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov edx, dword [rsp + 0x74]
inc rsi
cmp byte [rbx + rsi], 0
jne 0x140096936
movzx eax, byte [rsp + 0x78]
imul byte [rsp + 0x90]
movzx ecx, al
movzx eax, dil
imul cl
movzx ecx, al
movzx eax, r12b
imul cl
lea ecx, [rdx + rax]
mov al, 7
imul cl
movzx ecx, al
movzx eax, byte [rsp + 0x7c]
imul byte [rsp + 0x64]
movzx edx, al
movzx eax, r13b
sub dl, cl
imul r14b
add dl, al
movzx eax, byte [rsp + 0xa8]
imul byte [rsp + 0x80]
add dl, al
movzx eax, byte [rsp + 0x88]
imul byte [rsp + 0xc0]
shl al, 4
sub dl, al
mov al, 0x1e
imul byte [rsp + 0xa0]
sub dl, al
sub dl, byte [rsp + 0x68]
sub dl, byte [rsp + 0x6c]
sub dl, bpl
add dl, byte [rsp + 0x70]
lea eax, [r15 + rdx]
sub al, 8
add al, byte [rsp + 0x98]
add al, sil
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x208
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret