Function at 0x1400abc00
Capabilities:
Create thread
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x290
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rbx, qword [rsp + 0x2f0]
mov r14, rcx
mov ecx, 2
mov rdi, r9
mov qword [rsp + 0xb0], r9
mov r12, rdx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor ecx, ecx
mov edx, 0x1de
lea r8d, [rcx + 8]
mov r13, rax
mov qword [rsp + 0xb8], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
or rsi, 0xffffffffffffffff
mov qword [rsp + 0x70], rax
mov rcx, rsi
inc rcx
cmp byte [rbx + rcx], 0
jne 0x1400abc75
imul r15d, ecx, 0xfffffffe
sub r15d, dword [rdi + 0x38]
sub r15d, 7
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rdi, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0x80], rax
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
movzx ebp, ax
mov dword [rsp + 0xa0], ebp
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
lea r8, str.payment
mov qword [rsp + 0x88], rax
xor eax, eax
lea rdx, str.blinker
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], r15d
mov dword [rsp + 0x30], eax
lea ecx, [rax + 2]
xor r9d, r9d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 2
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov r8, qword [rsp + 0x80]
mov r9, qword [rsp + 0x88]
mov rdx, rax
mov qword [rsp + 0x90], rax
lea ecx, [rax + r9]
lea eax, [rbp + 3]
lea r11d, [r9 + r9*2]
add eax, ecx
movsx rcx, r8b
mov r10d, r9d
mov dword [rsp + 0xa4], eax
sub r10d, edx
mov eax, 0x20
imul ecx, r8d
add r10d, 0x23
sub eax, r11d
mov ebp, r12d
sub eax, edx
mov dword [rsp + 0x68], r10d
mov dword [rsp + 0xa8], r11d
mov dword [rsp + 0x6c], eax
lea eax, [rcx + rcx*4]
sub ebp, eax
sub ebp, r10d
movsx r10d, r8b
sub ebp, edx
sub ebp, edi
sub ebp, r9d
sub ebp, 7
imul r10d, r8d
mov r8, rsi
mov dword [rsp + 0xac], r10d
nop dword [rax]
inc r8
cmp byte [rbx + r8], 0
jne 0x1400abd90
mov eax, r13d
mov r9d, r9d
imul eax, r15d
imul ecx, eax, 0x31
mov rax, qword [rsp + 0xb0]
mov edx, dword [rax + 0x48]
mov eax, r10d
shl eax, 5
sub edx, ecx
xor ecx, ecx
add edx, eax
lea eax, [rdi + rdi*4]
sub edx, eax
lea eax, [r12 + rdx]
xor edx, edx
add r8d, eax
lea eax, [r11 + 8]
add eax, r8d
lea r8, [0x140001b00]
mov dword [rsp + 0x64], eax
xor eax, eax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x78], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0x98], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
mov edx, 0x25
lea r8d, [rdx - 0xb]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, rsi
nop dword [rax]
inc rcx
cmp byte [rbx + rcx], 0
jne 0x1400abe20
mov eax, dword [rsp + 0x78]
imul ecx, r12d
mov edx, 0x1d
lea r8d, [rdx - 5]
imul eax, dword [rsp + 0x98]
sub ecx, eax
mov eax, dword [rsp + 0x6c]
sub ecx, dword [rsp + 0x70]
add eax, 9
sub ecx, dword [rsp + 0xa0]
add eax, ecx
xor ecx, ecx
mov dword [rsp + 0x118], eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rax, qword [rsp + 0x90]
add eax, 5
lea ecx, [rax + rax*2]
mov rax, qword [rsp + 0xb0]
add ecx, dword [rax + 0x20]
sub ecx, dword [rsp + 0x70]
add ecx, r12d
add ecx, dword [rsp + 0xac]
add ecx, dword [rsp + 0xa4]
add ecx, dword [rsp + 0x98]
add ecx, dword [rsp + 0x64]
add ecx, r15d
mov dword [rsp + 0x130], ecx
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
mov rcx, rsi
inc rcx
cmp byte [rbx + rcx], 0
jne 0x1400abeb3
mov eax, dword [rsp + 0x70]
imul ecx, r12d
add ecx, ecx
imul eax, r13d
imul eax, edi
imul eax, r15d
imul eax, eax, 7
sub ecx, eax
mov rax, qword [rsp + 0x78]
sub ecx, dword [rsp + 0x68]
add eax, 9
add eax, ecx
mov ecx, ebp
mov dword [rsp + 0xc0], eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor ecx, ecx
lea r8d, [rcx + 0x1a]
mov edx, 0x2ce
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdi, qword [rsp + 0x80]
mov al, 7
imul r15b
movzx ecx, dil
mov edx, 0x100
shl cl, 3
add cl, al
sub cl, byte [rsp + 0x88]
sub cl, bpl
sub cl, byte [rsp + 0x90]
sub cl, 2
mov byte [rsp + 0x60], cl
xor ecx, ecx
lea r8d, [rcx + 8]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
movzx ecx, dil
add cl, cl
mov qword [rsp + 0x80], rax
add dil, cl
movzx ecx, r15b
shl cl, 2
lea r13d, [rcx + r15]
mov rcx, rsi
sub r13b, dil
sub r13b, r12b
sub r13b, 2
add r13b, byte [rsp + 0x64]
inc rcx
cmp byte [rbx + rcx], 0
jne 0x1400abf71
movzx eax, byte [rsp + 0xb8]
movzx edi, byte [rsp + 0x118]
imul cl
movzx ecx, al
movzx eax, bpl
imul byte [rsp + 0x68]
sub dil, al
sub dil, cl
sub dil, byte [rsp + 0x88]
sub dil, byte [rsp + 0x78]
sub dil, 0x50
add dil, byte [rsp + 0xc0]
add dil, byte [rsp + 0x70]
add dil, byte [rsp + 0x60]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r8, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x78]
movzx eax, r13b
imul r8b
movzx ecx, al
add cl, cl
add al, cl
add al, al
movsx rcx, al
mov eax, dword [rsp + 0x6c]
imul eax, dword [rsp + 0x64]
imul eax, ebp
add ecx, eax
mov eax, r12d
imul eax, edx
sub ecx, eax
movsx eax, r13b
imul eax, r8d
add ecx, eax
imul eax, r15d, 7
sub ecx, eax
mov eax, dword [rsp + 0xa8]
sub ecx, dword [rsp + 0x70]
add eax, 0xfffffff7
add eax, ecx
mov dword [rsp + 0xd0], eax
inc rsi
cmp byte [rbx + rsi], 0
jne 0x1400ac024
movzx eax, byte [rsp + 0x98]
mov rbx, qword [rsp + 0xb8]
add sil, 0x2f
add sil, sil
imul dl
movzx ecx, al
movzx eax, byte [rsp + 0xd0]
imul dil
movzx edx, al
mov al, 0x37
sub dl, cl
sub dl, sil
imul bl
sub dl, al
sub dl, r8b
sub dl, byte [rsp + 0x130]
add dl, byte [rsp + 0x88]
add dl, r12b
add dl, r13b
cmp dl, r15b
jne 0x1400ac104
lea rcx, [rsp + 0x140]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x140]
lea rcx, str.c0ret
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
xor ecx, ecx
mov edx, 0x107
lea r8d, [rcx + 0x12]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
lea r8d, [rcx + 0xe]
mov edx, 0x15c
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x140]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x140]
lea rcx, str.methodology
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rax, qword [rsp + 0x90]
mov qword [r14], 0
mov qword [r14 + 0x10], rbx
mov qword [r14 + 8], rax
mov rax, r14
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x2d0]
add rsp, 0x290
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret