Function at 0x1400b4140
Capabilities:
Extract resource via kernel32 functions
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x210
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x200], rax
mov rbx, qword [rsp + 0x278]
mov rsi, r9
mov qword [rsp + 0x78], r9
mov qword [rsp + 0x80], rbx
mov r15, rdx
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r13, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor edx, edx
mov r12, rax
mov al, 7
mov r8d, 0x140
lea rcx, [rsp + 0xc0]
imul r13b
movzx ebp, al
sub bpl, r12b
add bpl, r15b
add bpl, r14b
cmp bpl, r12b
jl 0x1400b4260
mov edi, ebx
imul edi, esi
add edi, r14d
neg edi
call fcn.1400e27d0
lea rdx, [rsp + 0xc0]
lea rcx, str.angora
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
imul ebx, edi
movsx ecx, bpl
mov r8d, 6
movzx esi, ax
sub r8d, ecx
lea eax, [r14 + r14*2]
imul r8d, r15d
sub r8d, ebx
lea ebx, [rax*2]
add ebx, r13d
lea edi, [r8 + r14]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0x30], rax
lea rax, str.c1a1
lea r9d, [rbx + 0xd]
mov qword [rsp + 0x28], rax
lea r8d, [rdi - 7]
lea rcx, [rsp + 0x88]
mov edx, esi
mov dword [rsp + 0x20], 0
call fcn.1400da770
jmp 0x1400b427a
call fcn.1400e27d0
lea rdx, [rsp + 0xc0]
lea rcx, str.washtub
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
lea rcx, [rsp + 0xc0]
mov edx, 0x104
mov dword [rsp + 0x68], eax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov edx, 0x2c
lea r8d, [rdx - 0x1e]
xor ecx, ecx
mov r13, rax
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea esi, [r13*4]
mov rdi, rax
add esi, r13d
imul eax, ebx
mov dword [rsp + 0x6c], eax
lea ecx, [rsi + rax]
mov dword [rsp + 0x64], ecx
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
mov word [rsp + 0x60], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor eax, eax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
movsx r9d, bpl
movsx rcx, r12b
movsx r10d, r12b
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x38], r9d
mov dword [rsp + 0x30], r9d
mov dword [rsp + 0x28], r9d
lea r8, str.minister
lea rdx, str.angora
mov ecx, r10d
mov dword [rsp + 0x20], r10d
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
mov rbp, qword [rsp + 0x80]
sub dil, 6
movzx eax, r14b
imul bpl
movzx ecx, al
movzx eax, r13b
imul bl
movzx ebx, r15b
add bl, bl
movzx r13d, al
sub bl, byte [rsp + 0x70]
sub r13b, cl
sub bl, r12b
sub r13b, r15b
sub r13b, r12b
mov r12d, dword [rsp + 0x64]
add bl, r12b
add r13b, 6
add bl, dil
movzx edi, word [rsp + 0x60]
cmp dil, r12b
jl 0x1400b43a5
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
imul esi, dword [rsp + 0x70]
movzx eax, bl
movsx ecx, dil
sub eax, 2
imul eax, r14d
imul ecx, r12d
lea eax, [rax + rcx*4]
movzx ecx, r13b
add eax, 4
add eax, esi
sub eax, ecx
movzx ecx, byte [rsp + 0x68]
sub eax, ecx
sub eax, r15d
sub eax, ebp
sub eax, dword [rsp + 0x78]
add eax, dword [rsp + 0x6c]
mov rcx, qword [rsp + 0x200]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x250]
add rsp, 0x210
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret