Function at 0x140086ec0
Capabilities:
Create thread
Extract resource via kernel32 functions
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2b0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov r12, qword [rsp + 0x310]
mov rbp, qword [rsp + 0x318]
mov r15, qword [rsp + 0x320]
mov r14, r9
mov qword [rsp + 0x58], r8
mov rdi, rdx
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x90], rcx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r13, rax
mov qword [rsp + 0x70], rax
lea eax, [rdi + rdi]
mov dword [rsp + 0xc0], eax
add eax, r13d
mov dword [rsp + 0x48], eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
or rsi, 0xffffffffffffffff
mov rbx, rax
mov rcx, rsi
nop dword [rax + rax]
inc rcx
cmp byte [rcx + rbp], 0
jne 0x140086f50
mov r9, qword [rsp + 0x58]
mov r11d, dword [rsp + 0x48]
lea edx, [r13 + 1]
imul edx, edi
sub edx, r9d
mov rax, rsi
sub edx, r11d
sub edx, ecx
inc rax
cmp byte [r12 + rax], 0
jne 0x140086f75
add edx, eax
mov rax, rsi
inc rax
cmp byte [r14 + rax], 0
jne 0x140086f84
add edx, eax
mov dword [rsp + 0x50], edx
lea r13d, [rbx + rdx]
movsx eax, r13b
mov dword [rsp + 0x4c], eax
cmp r11d, eax
ja 0x140087029
mov rax, rsi
nop dword [rax]
inc rax
cmp byte [r14 + rax], 0
jne 0x140086fb0
lea edi, [rdi*2 + 2]
sub edi, r9d
sub edi, ebx
sub edi, dword [rsp + 0x70]
sub edi, eax
mov rax, rsi
nop
inc rax
cmp byte [r12 + rax], 0
jne 0x140086fd0
add edi, eax
mov rax, rsi
nop
inc rax
cmp byte [rax + rbp], 0
jne 0x140086fe0
add edi, eax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor eax, eax
mov qword [rsp + 0x28], rax
lea r8, [0x140001b00]
movsxd r9, edi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov edx, dword [rsp + 0x50]
mov rdi, qword [rsp + 0x68]
mov r9, qword [rsp + 0x58]
mov r11d, dword [rsp + 0x48]
movsx rax, r13b
mov r8d, edi
mov r10d, edi
mov qword [rsp + 0xc8], rax
mov rcx, rsi
imul r8d, edi
imul eax, dword [rsp + 0x70]
sub r10d, eax
add r10d, r10d
sub r8d, dword [rsp + 0x4c]
mov dword [rsp + 0x44], r8d
mov dword [rsp + 0x7c], r10d
nop dword [rax]
inc rcx
cmp byte [r15 + rcx], 0
jne 0x140087060
mov rax, rsi
nop dword [rax]
inc rax
cmp byte [r14 + rax], 0
jne 0x140087070
imul cl
movzx ecx, al
movzx eax, dil
imul cl
movzx ecx, al
movzx eax, bl
add cl, cl
imul r11b
sub cl, al
movzx eax, r13b
imul dl
mov edx, r10d
sub cl, al
lea rax, [0x1400ed3b8]
mov qword [rsp + 0x38], rax
mov byte [rsp + 0x30], cl
mov dword [rsp + 0x28], r8d
mov qword [rsp + 0x20], r9
mov byte [rsp + 0x40], cl
lea r8, str.crime
lea r9, [0x1400ed7c8]
lea rcx, [rsp + 0x120]
call fcn.1400db250
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rsp + 0xe0], xmm0
movaps xmmword [rsp + 0xf0], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmm1, xmmword [rax + 0x30]
movaps xmmword [rsp + 0x100], xmm0
movaps xmmword [rsp + 0x110], xmm1
cmp r13b, byte [rsp + 0x44]
jle 0x140087185
mov rcx, rsi
nop
inc rcx
cmp byte [rcx + rbp], 0
jne 0x140087110
sub cl, byte [rsp + 0x70]
movzx eax, dil
imul cl
movzx ecx, r13b
shl cl, 2
movzx edi, al
add r13b, cl
sub dil, r13b
sub dil, byte [rsp + 0x50]
sub dil, byte [rsp + 0x40]
sub dil, 0xc
add dil, bl
call qword [sym.imp.KERNEL32.dll_GetLastError]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r13, qword [rsp + 0x68]
movzx eax, dil
mov edi, dword [rsp + 0x4c]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], eax
xor r9d, r9d
mov r8, r13
mov rdx, r13
mov rcx, r13
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x14008718a
mov r13, qword [rsp + 0x68]
lea rcx, [rsp + 0x160]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
movzx ecx, bl
shl cl, 2
mov r8, rax
mov qword [rsp + 0xd0], rax
lea edx, [rcx + rbx]
mov rcx, rsi
mov byte [rsp + 0x41], dl
nop dword [rax + rax]
inc rcx
cmp byte [r14 + rcx], 0
jne 0x1400871c0
mov rax, rsi
nop dword [rax]
inc rax
cmp byte [rax + rbp], 0
jne 0x1400871d0
imul cl
lea edi, [rax - 2]
add dil, r13b
add dil, dl
movzx eax, dil
mov byte [rsp + 0x42], dil
mov dword [rsp + 0x80], eax
shl eax, 4
mov dword [rsp + 0x64], eax
add eax, r8d
mov dword [rsp + 0x60], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rsi
mov qword [rsp + 0xb8], rax
inc rcx
cmp byte [r15 + rcx], 0
jne 0x140087213
mov rax, rsi
inc rax
cmp byte [r14 + rax], 0
jne 0x140087220
imul cl
movzx ecx, al
mov rax, rsi
inc rax
cmp byte [rax + rbp], 0
jne 0x140087232
mov r9, qword [rsp + 0x58]
movzx r8d, byte [rsp + 0x40]
mov rdx, qword [rsp + 0x68]
imul cl
movzx r13d, al
lea ecx, [r9 + 2]
movzx eax, dil
add cl, cl
imul byte [rsp + 0xf0]
sub al, cl
mov rcx, rsi
add r13b, al
sub r13b, byte [rsp + 0x70]
sub r13b, r8b
add r13b, dl
add r13b, byte [rsp + 0x41]
nop word [rax + rax]
inc rcx
cmp byte [r15 + rcx], 0
jne 0x140087280
mov rax, rsi
nop dword [rax]
inc rax
cmp byte [rax + rbp], 0
jne 0x140087290
mov edi, dword [rsp + 0x50]
imul cl
movzx ecx, al
movzx eax, byte [rsp + 0x48]
imul cl
movzx ecx, al
movzx eax, dl
imul cl
movzx ecx, al
movzx eax, dl
imul r9b
sub al, cl
add al, 2
add al, dil
add al, r9b
add al, r8b
mov byte [rsp + 0x41], al
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, qword [rsp + 0x58]
lea eax, [rcx + rcx]
mov rcx, rsi
nop dword [rax]
inc rcx
cmp byte [r15 + rcx], 0
jne 0x1400872e0
imul ecx, dword [rsp + 0x68]
imul eax, edi
xor edx, edx
mov r8d, 0x140
sub ecx, eax
mov eax, dword [rsp + 0x60]
lea eax, [rcx + rax*4]
lea rcx, [rsp + 0x160]
sub eax, dword [rsp + 0x44]
mov dword [rsp + 0x78], eax
call fcn.1400e27d0
lea rdx, [rsp + 0x160]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea rcx, [0x1400ed3b4]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, qword [rsp + 0x58]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdi, rsi
mov dword [rsp + 0x84], eax
nop
inc rdi
cmp byte [r14 + rdi], 0
jne 0x140087350
movzx eax, r13b
mov edx, 0x95
imul byte [rsp + 0xb8]
movzx ecx, al
movzx eax, byte [rsp + 0x42]
imul cl
xor ecx, ecx
add al, al
sub dil, al
lea r8d, [rcx + 3]
sub dil, byte [rsp + 0x58]
sub dil, byte [rsp + 0x44]
sub dil, byte [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0x88], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rdx, qword [rsp + 0x88]
xor ecx, ecx
mov qword [rsp + 0xa0], rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rbp
mov qword [rsp + 0x98], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, qword [rsp + 0x58]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0xb0], rax
call qword [sym.imp.KERNEL32.dll_LockResource]
lea rcx, [rsp + 0x160]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor ecx, ecx
mov edx, 0x2da
lea r8d, [rcx + 2]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rax, qword [rsp + 0x90]
mov r11, qword [rsp + 0x98]
mov r9d, dword [rsp + 0x50]
mov qword [rax + 8], r11
lea rcx, str.attachment
mov qword [rax], rcx
mov eax, dword [rsp + 0xd0]
movsx rcx, r13b
mov qword [rsp + 0x98], rcx
mov r8, rsi
imul eax, dword [rsp + 0x64]
mov dword [rsp + 0xa8], eax
mov eax, dword [rsp + 0x4c]
imul eax, dword [rsp + 0x7c]
imul eax, r9d
mov dword [rsp + 0x4c], eax
movzx eax, dil
movzx edi, byte [rsp + 0x41]
mov dword [rsp + 0x64], eax
imul eax, dword [rsp + 0x84]
mov dword [rsp + 0xac], eax
inc r8
cmp byte [r12 + r8], 0
jne 0x140087482
mov rax, rsi
nop
inc rax
cmp byte [rax + rbp], 0
jne 0x140087490
movsx r10d, byte [rsp + 0x40]
mov r13, qword [rsp + 0x68]
imul r8d, eax
mov eax, r11d
mov edx, r10d
imul eax, dword [rsp + 0xa0]
imul edx, dword [rsp + 0x44]
imul eax, dword [rsp + 0x88]
imul eax, eax, 0xe
add edx, eax
lea eax, [rcx + rcx*2]
mov ecx, 1
sub edx, eax
mov rax, qword [rsp + 0x70]
add eax, eax
sub ecx, eax
mov eax, dword [rsp + 0x60]
imul ecx, r13d
lea edx, [rcx + rdx*2]
imul eax, dword [rsp + 0xa8]
sub edx, eax
mov rax, rsi
add r8d, edx
sub r8d, edi
sub r8d, dword [rsp + 0x4c]
sub r8d, dword [rsp + 0x78]
sub r8d, ebx
add r8d, dword [rsp + 0xac]
add r8d, dword [rsp + 0xb0]
add r8d, dword [rsp + 0xa0]
add r8d, dword [rsp + 0x48]
inc rax
cmp byte [r15 + rax], 0
jne 0x140087523
sub r8d, eax
mov rax, rsi
inc rax
cmp byte [r14 + rax], 0
jne 0x140087533
mov rcx, qword [rsp + 0x110]
add r8d, eax
mov rax, rsi
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140087550
mov rcx, qword [rsp + 0x90]
movsx rdx, r10b
mov r10d, dword [rsp + 0x80]
add eax, 0xd
mov qword [rsp + 0x68], rdx
add eax, r8d
mov dword [rcx + 0x10], eax
mov rcx, rsi
imul r10d, dword [rsp + 0xd0]
mov dword [rsp + 0x80], r10d
nop
inc rcx
cmp byte [r15 + rcx], 0
jne 0x140087590
mov r8, qword [rsp + 0xa0]
mov rax, qword [rsp + 0xb0]
imul ecx, r13d
add eax, r8d
add eax, eax
sub eax, r11d
sub eax, r8d
add eax, edx
lea edx, [rax*2 + 0x16]
mov eax, ebx
imul eax, dword [rsp + 0x48]
sub edx, eax
imul eax, dword [rsp + 0xb8], 7
sub edx, ecx
add edx, eax
mov rax, rsi
nop word [rax + rax]
inc rax
cmp byte [r12 + rax], 0
jne 0x1400875e0
mov rcx, rsi
nop dword [rax]
inc rcx
cmp byte [rcx + rbp], 0
jne 0x1400875f0
mov r8d, dword [rsp + 0x10c]
imul eax, ecx
mov rcx, rsi
sub edx, eax
sub edx, r10d
mov r10, qword [rsp + 0x58]
sub edx, edi
lea eax, [r10 + r10]
sub edx, dword [rsp + 0xac]
sub edx, r8d
sub edx, dword [rsp + 0x88]
sub edx, dword [rsp + 0x60]
sub edx, eax
sub edx, dword [rsp + 0x98]
inc rcx
cmp byte [r14 + rcx], 0
jne 0x140087635
mov eax, dword [rsp + 0x4c]
add eax, edx
mov rdx, rsi
add ecx, eax
mov rax, qword [rsp + 0x90]
add ecx, r10d
mov qword [rax + 0x18], r11
add ecx, r13d
add ecx, dword [rsp + 0xb8]
add ecx, dword [rsp + 0x44]
add ecx, dword [rsp + 0x70]
mov dword [rax + 0x14], ecx
imul r10d, r11d, 7
mov dword [rsp + 0x78], r10d
nop word [rax + rax]
inc rdx
cmp byte [r15 + rdx], 0
jne 0x140087680
mov eax, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x84]
inc edx
imul edx, r13d
shl eax, 4
sub ecx, eax
mov eax, edi
imul ecx, dword [rsp + 0xb8]
imul eax, dword [rsp + 0x98]
add edx, ecx
sub r8d, eax
lea ecx, [rdx + r8*2]
mov rdx, qword [rsp + 0x58]
lea eax, [rdx + rdx]
imul eax, dword [rsp + 0x44]
add ecx, eax
mov eax, ebx
imul eax, r9d
add ecx, eax
mov rax, rsi
sub ecx, dword [rsp + 0x64]
sub ecx, edx
sub ecx, dword [rsp + 0xa0]
sub ecx, dword [rsp + 0x88]
sub ecx, dword [rsp + 0xc8]
sub ecx, dword [rsp + 0x68]
sub ecx, dword [rsp + 0x7c]
sub ecx, dword [rsp + 0x70]
sub ecx, dword [rsp + 0x48]
add ecx, dword [rsp + 0x80]
add ecx, r10d
add ecx, dword [rsp + 0xb0]
inc rax
cmp byte [r14 + rax], 0
jne 0x140087711
sub ecx, eax
mov rax, rsi
inc rax
cmp byte [r12 + rax], 0
jne 0x140087720
add ecx, eax
mov rax, rsi
nop
inc rax
cmp byte [rax + rbp], 0
jne 0x140087730
inc ecx
add eax, ecx
mov rcx, qword [rsp + 0x90]
mov dword [rcx + 0x20], eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r8, qword [rsp + 0x90]
mov qword [r8 + 0x28], rax
mov rcx, rsi
nop dword [rax]
inc rcx
cmp byte [r15 + rcx], 0
jne 0x140087760
mov rax, rsi
nop dword [rax]
inc rax
cmp byte [rax + rbp], 0
jne 0x140087770
mov rdx, qword [rsp + 0xa0]
imul ecx, eax
imul edi, r13d
lea eax, [rdx*8]
sub edi, eax
mov rax, rsi
sub edi, ecx
inc rax
cmp byte [r12 + rax], 0
jne 0x140087796
mov rcx, rsi
inc rcx
cmp byte [r14 + rcx], 0
jne 0x1400877a3
imul eax, ecx
add edi, eax
mov rax, qword [rsp + 0x58]
sub edi, dword [rsp + 0xb0]
sub edi, dword [rsp + 0xc8]
sub edi, dword [rsp + 0x68]
sub edi, dword [rsp + 0x60]
sub edi, dword [rsp + 0xa8]
sub edi, dword [rsp + 0xc0]
sub edi, dword [rsp + 0x44]
sub edi, dword [rsp + 0x7c]
sub edi, dword [rsp + 0x70]
sub edi, dword [rsp + 0x48]
add edi, dword [rsp + 0x64]
add edi, eax
add edi, eax
mov rax, qword [rsp + 0xf8]
add edi, r13d
add edi, dword [rsp + 0x78]
add edi, edx
add edi, dword [rsp + 0x88]
add edi, dword [rsp + 0x84]
add edi, dword [rsp + 0x98]
add edi, ebx
add edi, dword [rsp + 0x50]
nop
inc rsi
cmp byte [rax + rsi], 0
jne 0x140087820
sub edi, esi
mov rax, r8
add edi, 0xf
mov dword [r8 + 0x30], edi
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x2f0]
add rsp, 0x2b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret