Function at 0x14008e700
Capabilities:
Extract resource via kernel32 functions
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x200
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
or r15, 0xffffffffffffffff
mov r13, rdx
mov rbx, rcx
mov r14, r15
inc r14
cmp byte [rcx + r14], 0
jne 0x14008e736
lea eax, [rdx - 0x18]
add r14d, eax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rax, r15
nop
inc rax
cmp byte [rbx + rax], 0
jne 0x14008e750
imul eax, r13d
xor edx, edx
xor ecx, ecx
sub eax, 3
mov dword [rsp + 0xbc], eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
mov edx, 0x39d
lea r8d, [rcx + 7]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, 0x14
mov qword [rsp + 0x68], rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rdi, rax
mov qword [rsp + 0x70], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
mov rbp, r15
mov dword [rsp + 0x80], eax
inc rbp
cmp byte [rbx + rbp], 0
jne 0x14008e7c6
imul ebp, r13d
lea eax, [r14 + r14*2]
shl eax, 4
sub ebp, eax
sub ebp, edi
dec ebp
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r12, r15
nop
inc r12
cmp byte [rbx + r12], 0
jne 0x14008e7f0
movzx eax, byte [rsp + 0x80]
mov edi, 9
sub al, r14b
sub al, byte [rsp + 0xbc]
sub al, byte [rsp + 0x68]
sub al, 2
add r12b, al
movsx rax, r12b
sub edi, eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [rsp + 0x68], rax
movzx eax, r14b
shl al, 2
lea ecx, [rax + r14]
mov eax, 0x18
sub al, cl
sub al, byte [rsp + 0x80]
sub al, dil
mov dword [rsp + 0x60], eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, dword [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
movzx ecx, sil
sub ecx, eax
add edx, 4
add edx, ecx
xor ecx, ecx
mov dword [rsp + 0x60], edx
lea r8d, [rcx + 0x18]
mov edx, 0x107
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rax, r15
cmp byte [rbx + rax + 1], 0
lea rax, [rax + 1]
jne 0x14008e883
imul ebp, dword [rsp + 0x70]
lea eax, [rax + rax*8]
xor ecx, ecx
lea r8d, [rcx + 2]
mov edx, 0x2b8
imul ebp, r14d
movsxd r14, dword [rsp + 0x60]
sub eax, ebp
lea ebp, [r14 - 0x47]
add ebp, eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
mov dword [rsp + 0xa0], eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
lea r8d, [rcx + 3]
mov edx, 0x2b5
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdi, rax
imul edi, dword [rsp + 0x68]
shl edi, 2
sub edi, ebp
nop
inc r15
cmp byte [rbx + r15], 0
jne 0x14008e8f0
movzx eax, r13b
imul r15b
movzx ebx, al
movzx eax, byte [rsp + 0xa0]
imul r14b
movzx ecx, al
movzx eax, sil
imul cl
movzx ecx, al
mov al, 7
imul cl
sub bl, al
sub bl, 0x7b
call qword [sym.imp.KERNEL32.dll_GetTickCount]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0xe0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor r8d, r8d
movsx edx, r12b
mov qword [rsp + 0x58], r8
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x38], r14d
mov dword [rsp + 0x30], edx
movzx ecx, bl
lea rdx, str.piracy
lea r9d, [rdi + 0xa]
mov dword [rsp + 0x28], ecx
lea r8, str.mixer
mov dword [rsp + 0x20], ebp
call qword [sym.imp.USER32.dll_CreateWindowExA]
xor ecx, ecx
mov edx, 0x179
lea r8d, [rcx + 0x12]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x34f
lea r8d, [rcx + 0xb]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
mov edx, 0x30f
lea r8d, [rcx + 6]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x250]
add rsp, 0x200
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret