Function at 0x140093f70
Capabilities:
Create thread

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2d8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
mov r12, qword [rsp + 0x340]
mov rdi, r9
mov r14, r8
movsx r15d, dl
mov rbx, rcx
mov qword [rsp + 0x38], rcx
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
mov ecx, r15d
movzx ebp, ax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r13, rax
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
xor ecx, ecx
movzx eax, ax
lea r8d, [rcx + 0xc]
mov edx, 0x107
mov dword [rsp + 0x58], eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
lea rcx, [rsp + 0xa0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
mov qword [rsp + 0x30], rax
movzx eax, r13b
imul r13b
movzx esi, al
sub sil, byte [r14 + 0x18]
add sil, byte [rbx + 8]
add sil, dil
movzx edx, sil
imul edx, r13d
lea ebx, [rcx + rdx*4]
add edx, 4
add ebx, edx
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rcx, qword [rsp + 0x38]
movzx r8d, byte [rcx]
mov qword [rsp + 0x40], rax
movzx eax, r12b
imul bpl
movzx ecx, al
movzx eax, dil
movzx edi, bl
shl bl, 2
add dil, bl
movzx ebx, byte [r14 + 8]
imul cl
movzx ecx, al
movzx eax, r15b
imul cl
sub dil, al
mov rax, qword [rsp + 0x30]
add dil, 4
add dil, r8b
add r8b, 5
add dil, al
imul byte [rsp + 0x58]
movzx ecx, al
lea edx, [rax + 1]
shl cl, 2
movzx eax, r13b
add dl, cl
imul dl
sub bl, al
sub bl, bpl
add bl, r15b
add bl, r8b
add bl, sil
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov edx, 0x3c
lea r8d, [rdx - 0x1f]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x2f7
lea r8d, [rcx + 0x1a]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x1b0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp dil, bl
jne 0x140094190
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
movsx rcx, bl
sub ecx, dword [rsp + 0x30]
xor ebx, ebx
add ecx, r13d
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
lea r8d, [rcx*4 + 4]
movzx ecx, dil
lea edx, [rcx + rcx*4]
xor ecx, ecx
lea eax, [rax + rdx*4]
xor edx, edx
imul eax, r13d
sub r8d, eax
movsx eax, r15b
imul r12d, eax
mov rax, qword [rsp + 0x38]
sub r8d, r12d
add r8d, dword [rax]
add r8d, dword [rsp + 0x40]
movsxd r9, r8d
lea r8, [0x140001b00]
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea r8, [0x140001b00]
movzx r9d, dil
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rax, str.contribution
mov rcx, qword [rsp + 0x2c0]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x2d8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret