Function at 0x14007f8c0
Capabilities:
Create thread
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x248
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x230], rax
movsxd r12, dword [rsp + 0x2b0]
mov rsi, qword [rsp + 0x2b8]
mov eax, r8d
or rbx, 0xffffffffffffffff
mov r14, rcx
mov qword [rsp + 0x80], rcx
mov dword [rsp + 0x64], eax
mov rdi, r9
mov rbp, rdx
mov rcx, rbx
inc rcx
cmp byte [r9 + rcx], 0
jne 0x14007f915
imul eax, dword [r14 + 0x28]
add ecx, eax
mov dword [rsp + 0xa8], ecx
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea r8, [0x140001b00]
mov qword [rsp + 0xc8], rax
xor eax, eax
mov r9, r12
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, r12d
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rbx
mov r13, rax
nop
inc rcx
cmp byte [rcx + rbp], 0
jne 0x14007f970
movzx eax, byte [r14 + 0x2c]
imul cl
movzx r15d, al
mov rax, rbx
inc rax
cmp byte [rsi + rax], 0
jne 0x14007f987
add r15b, al
mov rax, rbx
inc rax
cmp byte [rdi + rax], 0
jne 0x14007f996
add r15b, al
movzx ecx, r13b
add cl, cl
movzx eax, r15b
mov byte [rsp + 0x60], cl
imul cl
movzx r14d, al
mov ecx, 0xffff
sub r14b, byte [rsp + 0x78]
add r14b, byte [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
mov rcx, rbx
mov dword [rsp + 0xe0], eax
nop dword [rax + rax]
inc rcx
cmp byte [rcx + rbp], 0
jne 0x14007f9e0
mov rax, qword [rsp + 0x80]
mov eax, dword [rax + 0x10]
sub eax, r13d
add eax, r12d
sub eax, ecx
mov dword [rsp + 0xe4], eax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
movsx r13, r14b
mov rdx, rdi
xor ecx, ecx
mov r9, r13
mov r8, r13
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
xor ecx, ecx
mov edx, 0x150
lea r8d, [rcx + 0x11]
mov dword [rsp + 0x6c], eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r9, qword [rsp + 0xe0]
mov edx, dword [rsp + 0x64]
shr r9, 0x20
mov r8, rax
mov qword [rsp + 0x90], rax
imul r9d, dword [rsp + 0x6c]
add r9d, 3
lea r9d, [rax + r9*2]
mov dword [rsp + 0x68], r9d
cmp r14b, dl
jl 0x14007fb1a
xor eax, eax
movsx ecx, r14b
lea rdx, [0x1400ed3f4]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], 2
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], ecx
mov r9d, r12d
mov r8, rdi
mov dword [rsp + 0x20], 1
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov eax, dword [rsp + 0x68]
xor ecx, ecx
movsx r8d, r15b
lea rdx, [0x1400ed3f4]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], r8d
lea r8, str.helmet
mov r9d, r12d
mov ecx, 2
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov edx, dword [rsp + 0x64]
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x90]
mov rcx, rbx
nop dword [rax]
inc rcx
cmp byte [rsi + rcx], 0
jne 0x14007fb20
add r8d, r8d
movsx rax, r15b
sub r8d, eax
sub r8d, r13d
mov r13, qword [rsp + 0x80]
sub r8d, edx
mov edx, 0x1e
sub r8d, r12d
sub r8d, dword [rsp + 0x78]
sub r8d, r9d
sub r8d, ecx
xor ecx, ecx
add r8d, dword [r13 + 0x28]
mov dword [rsp + 0x70], r8d
lea r8d, [rdx - 0x17]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [rsp + 0x38], 0
lea rcx, [0x1400ed3b8]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x88], rax
mov eax, dword [rsp + 0x70]
lea r9, str.caravan
lea rdx, str.brian
lea rcx, [rsp + 0xd0]
xor r8d, r8d
mov dword [rsp + 0x20], eax
call fcn.1400dc490
movsx eax, r15b
movsx edx, r14b
imul ecx, dword [rsp + 0x88], 7
imul edx, eax
mov eax, dword [r13 + 0x10]
mov r13d, 6
inc eax
mov r8d, r13d
imul edx, dword [rsp + 0x78]
sub ecx, edx
mov edx, 0x2d1
sub ecx, dword [rsp + 0x68]
add ecx, eax
mov dword [rsp + 0xd8], ecx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov ecx, dword [rsp + 0x64]
mov qword [rsp + 0x98], rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r8, rax
mov qword [rsp + 0xa0], rax
cmp r14b, r15b
jge 0x14007fc3c
lea rcx, [rsp + 0x120]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov r8, qword [rsp + 0xa0]
mov rcx, rbx
nop
inc rcx
cmp byte [rsi + rcx], 0
jne 0x14007fc40
mov rax, rbx
nop dword [rax]
inc rax
cmp byte [rdi + rax], 0
jne 0x14007fc50
imul cl
movzx ecx, al
movzx eax, r12b
imul cl
movzx edx, al
inc rbx
cmp byte [rbx + rbp], 0
jne 0x14007fc67
movzx eax, byte [rsp + 0x64]
dec r14b
imul bl
add dl, al
movzx eax, byte [rsp + 0x88]
imul byte [rsp + 0x70]
sub r13b, al
movzx eax, r8b
add r13b, r13b
imul byte [rsp + 0xd8]
movzx ecx, al
movzx eax, byte [rsp + 0x98]
imul cl
add r13b, al
movzx eax, byte [rsp + 0x78]
imul r14b
add r13b, al
movzx eax, byte [rsp + 0x90]
imul byte [rsp + 0x68]
movzx ecx, al
shl cl, 2
add al, cl
sub r13b, al
mov rax, qword [rsp + 0x80]
add dl, r13b
sub dl, byte [rsp + 0x6c]
sub dl, byte [rsp + 0x60]
sub dl, r15b
add dl, byte [rax + 0x2c]
add dl, byte [rsp + 0xc8]
movzx eax, dl
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x248
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret