Function at 0x140064ce0
Capabilities:
Create thread

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x238
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x220], rax
mov r12d, dword [rsp + 0x2a0]
mov rbp, qword [rsp + 0x2a8]
mov rbx, qword [rsp + 0x2b0]
movsxd r13, ecx
mov r15, r9
mov qword [rsp + 0x90], r9
mov rsi, r8
mov qword [rsp + 0xb8], r8
mov rdi, rdx
mov qword [rsp + 0xa0], rdx
mov dword [rsp + 0x6c], r13d
mov dword [rsp + 0x74], r12d
cmp r13d, r12d
jge 0x140064daf
mov edx, 0x1d
xor ecx, ecx
lea r8d, [rdx - 9]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
lea rcx, [rsp + 0xe0]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0xe0]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rcx, [rsp + 0xe0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r14d, r13d
mov qword [rsp + 0x98], rax
imul r14d, r12d
imul r14d, dword [rdi + 0x18]
add r14d, 8
or rdi, 0xffffffffffffffff
mov rdx, rdi
mov dword [rsp + 0x78], r14d
nop dword [rax]
inc rdx
cmp byte [rbx + rdx], 0
jne 0x140064de0
mov rcx, qword [rsi + 0x18]
mov rax, rdi
inc rax
cmp byte [rcx + rax], 0
jne 0x140064df0
imul edx, eax
imul ecx, r15d, 0xb
mov rsi, rdi
add ecx, r13d
lea eax, [rcx + rdx*2]
mov dword [rsp + 0x64], eax
nop dword [rax]
inc rsi
cmp byte [rbx + rsi], 0
jne 0x140064e10
lea eax, [r15*2]
lea r8, [0x140001b00]
mov r9, r13
add eax, r13d
xor edx, edx
xor ecx, ecx
add esi, eax
xor eax, eax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
add esi, r12d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 2
mov qword [rsp + 0x80], rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rdi
mov qword [rsp + 0xb0], rax
inc rcx
cmp byte [rcx + rbp], 0
jne 0x140064e66
mov r8d, dword [rsp + 0x64]
lea edx, [r12 + r14*2]
mov r12, qword [rsp + 0xb8]
imul edx, r15d
sub edx, r8d
mov rax, rdi
add edx, r13d
sub edx, ecx
mov rcx, qword [r12 + 0x18]
inc rax
cmp byte [rcx + rax], 0
jne 0x140064e94
add eax, 7
mov r14, rdi
add eax, edx
mov dword [rsp + 0x68], eax
nop dword [rax]
inc r14
cmp byte [rbx + r14], 0
jne 0x140064eb0
mov rcx, qword [rsp + 0x98]
movzx eax, cl
add al, al
add cl, al
movzx eax, sil
add cl, cl
add cl, byte [rsp + 0x80]
imul r8b
shl cl, 2
sub al, cl
sub al, r15b
sub al, 5
add al, r13b
add r14b, al
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
mov rcx, rdi
movzx eax, ax
mov dword [rsp + 0x70], eax
nop dword [rax]
inc rcx
cmp byte [rcx + rbp], 0
jne 0x140064f00
movzx eax, r15b
imul cl
movzx r15d, al
movzx eax, byte [rsp + 0x98]
imul sil
add r15b, al
mov rax, qword [rsp + 0xa0]
add r15b, byte [r12 + 0x10]
mov r12, qword [rsp + 0xb0]
sub r15b, byte [rax + 0x18]
sub r15b, r12b
sub r15b, byte [rsp + 0x80]
add r15b, 0xd
add r15b, r13b
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rdi
mov r9, rax
mov qword [rsp + 0xd0], rax
inc rcx
cmp byte [rcx + rbp], 0
jne 0x140064f60
mov edx, dword [rsp + 0x64]
mov r8d, dword [rsp + 0x70]
add ecx, r12d
add ecx, ecx
lea eax, [rdx*4]
inc r9d
sub eax, r8d
inc eax
lea r12d, [rax + rax*4]
mov rax, qword [rsp + 0xa0]
mov eax, dword [rax]
sub r12d, ecx
mov rcx, qword [rsp + 0x90]
imul eax, ecx
sub r12d, eax
lea eax, [rcx + rcx]
xor ecx, ecx
add r12d, r13d
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rcx
add r12d, esi
mov ecx, esi
sub eax, r12d
add eax, r9d
mov r9d, r13d
mov dword [rsp + 0xc0], eax
mov eax, r12d
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r8d
lea r8, [0x1400ed7c8]
lea rdx, [0x1400ed7c8]
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [rsp + 0x88], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rdx, rdi
nop word [rax + rax]
inc rdx
cmp byte [rbx + rdx], 0
jne 0x140065020
imul edx, dword [rsp + 0x74]
mov eax, dword [rsp + 0x90]
mov r9d, dword [rsp + 0x68]
mov ecx, r12d
lea r8, str.c3a1
imul ecx, dword [rsp + 0x70]
add ecx, ecx
sub eax, ecx
mov ecx, dword [rsp + 0x64]
lea r13d, [rax*2 + 4]
mov rax, qword [rsp + 0xa0]
sub r13d, edx
lea rdx, [0x1400ed3f4]
sub r13d, dword [rax + 0x10]
xor eax, eax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x78]
sub r13d, ecx
mov qword [rsp + 0x40], 1
add r13d, dword [rsp + 0x6c]
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], ecx
add r13d, dword [rsp + 0x80]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
mov ecx, dword [rsp + 0x70]
add r13d, dword [rsp + 0xb0]
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov rax, qword [rsp + 0x88]
lea eax, [rax*4]
mov dword [rsp + 0xa8], eax
cmp r15b, byte [rsp + 0x68]
je 0x140065108
xor ecx, ecx
mov edx, 0x25f
lea r8d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor ecx, ecx
lea r8, [0x140001b00]
movzx r9d, r15b
mov qword [rsp + 0x28], rcx
xor edx, edx
mov dword [rsp + 0x20], ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rsp + 0xb8]
mov r8, rdi
mov rcx, qword [rcx + 8]
mov qword [rsp + 0xc8], rax
nop dword [rax]
inc r8
cmp byte [rcx + r8], 0
jne 0x140065140
mov rdx, qword [rsp + 0x90]
movzx eax, r15b
imul dl
movzx ecx, al
movzx eax, r14b
imul cl
movzx ecx, al
movzx eax, dl
shl cl, 2
inc cl
imul cl
movzx edx, al
movzx eax, sil
imul byte [rsp + 0x64]
movzx ecx, al
movzx eax, byte [rsp + 0x98]
imul cl
movzx ecx, al
mov al, 0xfb
imul cl
movzx ecx, byte [rsp + 0xd0]
movzx r9d, al
shl cl, 2
mov rax, rdi
sub r9b, dl
sub r9b, cl
sub r9b, byte [rsp + 0x68]
add r9b, byte [rsp + 0x6c]
add r9b, byte [rsp + 0x88]
add r9b, byte [rsp + 0x80]
sub r9b, r8b
sub r9b, 0x66
inc rax
cmp byte [rbx + rax], 0
jne 0x1400651c6
add r9b, al
mov byte [rsp + 0x60], r9b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
movsx rdx, byte [rsp + 0x60]
mov ecx, eax
mov dword [rsp + 0x88], eax
mov eax, dword [rsp + 0xc8]
sub eax, edx
xor edx, edx
mov r8d, 0x140
sub eax, ecx
lea rcx, [rsp + 0xe0]
add eax, 4
mov dword [rsp + 0xc4], eax
call fcn.1400e27d0
lea rdx, [rsp + 0xe0]
lea rcx, str.desk
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rsp + 0xd8], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rcx, rdi
mov r8, rax
mov rax, qword [rsp + 0xb8]
mov rdx, qword [rax + 8]
nop dword [rax + rax]
inc rcx
cmp byte [rdx + rcx], 0
jne 0x140065250
mov rdx, qword [rsp + 0x90]
movzx eax, r15b
imul eax, edx
sub ecx, eax
sub ecx, r12d
imul ecx, edx
mov rdx, rdi
inc rdx
cmp byte [rbx + rdx], 0
jne 0x140065273
movzx eax, r14b
imul eax, dword [rsp + 0x70]
add eax, eax
sub edx, eax
lea edx, [rcx + rdx*2]
nop dword [rax]
inc rdi
cmp byte [rdi + rbp], 0
jne 0x140065290
mov rax, qword [rsp + 0xa0]
imul edi, dword [rsp + 0x74]
mov eax, dword [rax]
sub edx, edi
imul eax, dword [rsp + 0x6c]
add edx, eax
mov rax, qword [rsp + 0x80]
imul eax, esi
add edx, eax
mov eax, dword [rsp + 0x78]
add eax, 8
lea ecx, [rax + rax*4]
movsx rax, byte [rsp + 0x60]
add edx, ecx
sub edx, r8d
sub edx, dword [rsp + 0xd8]
sub edx, dword [rsp + 0xc8]
sub edx, dword [rsp + 0xd0]
sub edx, dword [rsp + 0xc4]
sub edx, dword [rsp + 0xc0]
add edx, eax
mov eax, dword [rsp + 0xa8]
add edx, dword [rsp + 0x98]
add edx, dword [rsp + 0x88]
add edx, eax
add edx, r13d
add eax, edx
add eax, dword [rsp + 0xb0]
add eax, dword [rsp + 0x68]
add eax, dword [rsp + 0x64]
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x238
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret