Function at 0x1400a8220
Capabilities:
Create thread
Extract resource via kernel32 functions
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x1c0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov ebp, dword [rsp + 0x228]
mov r15d, dword [rsp + 0x230]
mov rbx, r9
mov rdi, r8
mov r12d, edx
mov rsi, rcx
cmp ebp, edx
jl 0x1400a8269
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
or rcx, 0xffffffffffffffff
mov r14, rax
inc rcx
cmp byte [rbx + rcx], 0
jne 0x1400a8276
mov edi, dword [rdi + 0x28]
add edi, esi
add edi, r12d
add edi, ebp
sub edi, ecx
mov ecx, 5
sub edi, 6
imul eax, edi
shl eax, 2
sub ecx, eax
mov dword [rsp + 0x60], ecx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
lea rcx, [rsp + 0xa0]
mov edx, 0x104
mov qword [rsp + 0x68], rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
cmp dword [rsp + 0x220], ebp
jae 0x1400a8386
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, str.c2a2
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
lea rcx, [rsp + 0xa0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor ecx, ecx
mov edx, 0x1b6
lea r8d, [rcx + 1]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, qword [rsp + 0x68]
xor edx, edx
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rdx
mov eax, ecx
lea r8, str.c2a2
lea rdx, [0x1400ed3b8]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x30], edi
mov ecx, r15d
mov r9d, r15d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
call qword [sym.imp.USER32.dll_CreateWindowExA]
xor ecx, ecx
lea r8d, [rcx + 0xc]
mov edx, 0x118
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
mov edx, 0x122
lea r8d, [rcx + 5]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea r8, [0x140001b00]
xor r9d, r9d
mov rbx, rax
xor eax, eax
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
lea r8, [0x140001b00]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [rsp + 0x220], ebp
ja 0x1400a8486
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
imul r15d, dword [rsp + 0x220]
mov ebp, dword [rsp + 0x60]
add r15d, r15d
sub esi, r15d
sub esi, eax
sub esi, ebp
add esi, r12d
add esi, ebx
lea ebx, [rdi - 7]
add esi, r14d
add ebx, esi
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
movsxd r9, ebx
xor ebx, ebx
lea r8, [0x140001b00]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea r8, [0x140001b00]
mov r9d, ebp
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov edx, 0x2e
xor ecx, ecx
lea r8d, [rdx - 0x25]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rax, r14
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x1c0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret