Function at 0x1400a84d0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x210
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x200], rax
mov esi, dword [rsp + 0x270]
mov r13d, dword [rsp + 0x278]
movzx ebx, r9b
mov r15, r8
mov qword [rsp + 0x78], r8
mov rbp, rdx
mov dword [rsp + 0x64], esi
mov r14, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0xc8], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, ebp
sub edi, ebx
mov dword [rsp + 0x70], ebx
add edi, esi
add edi, r13d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
mov esi, dword [rsp + 0xc8]
movzx r12d, al
sub esi, r12d
mov ecx, r12d
mov dword [rsp + 0x8c], r12d
add esi, r15d
mov dword [rsp + 0x68], esi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, esi
mov qword [rsp + 0x90], rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rcx, [rsp + 0xf0]
mov edx, 0x104
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea r8, [0x140001b00]
mov r9d, ebx
mov ecx, eax
mov r15, rax
mov eax, 0xfffffffe
xor edx, edx
imul ecx, esi
sub eax, ecx
mov ecx, r12d
mov dword [rsp + 0x6c], eax
xor eax, eax
mov r12d, ebp
imul ecx, r15d
imul r12d, dword [rsp + 0x64]
imul ecx, esi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
imul ecx, dword [rsp + 0x90]
shl ecx, 3
sub r12d, ecx
xor ecx, ecx
add r12d, 0xc
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, qword [rsp + 0x78]
lea ecx, [rax*4]
mov qword [rsp + 0x98], rax
mov eax, ebx
mov dword [rsp + 0x80], ecx
imul eax, r12d
sub eax, ecx
add eax, 0x78
mov dword [rsp + 0x60], eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov ecx, dword [rsp + 0x60]
lea ecx, [rcx*4]
shl ebx, 4
mov edx, esi
sub edx, ecx
mov ecx, dword [rsp + 0x70]
mov qword [rsp + 0xa0], rax
lea r8d, [rdx + rdx*2]
imul ecx, dword [rsp + 0x64]
add r8d, r8d
sub r8d, ecx
mov ecx, ebx
imul ecx, r12d
sub r8d, ecx
sub r8d, edi
add r8d, ebp
mov eax, dword [rsp + 0x68]
add r8d, r13d
xor ecx, ecx
add eax, 0xfffffffe
mov edx, 0x2c2
add eax, r8d
lea r8d, [rcx + 0x18]
mov dword [rsp + 0x88], eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdi, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
lea r8d, [rcx + 0xc]
mov edx, 0x3d1
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov eax, dword [rsp + 0x60]
lea edx, [rax + r12*2]
mov eax, ebp
add edx, r12d
shl edx, 2
sub eax, edx
sub eax, r13d
inc eax
mov dword [rsp + 0x84], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rax, qword [rsp + 0x78]
lea eax, [rax + rax*4]
add esi, 0xffffffde
mov ecx, ebp
imul ecx, r13d
add ecx, eax
mov rax, qword [rsp + 0x98]
lea eax, [rax + rax*2]
shl eax, 3
sub ecx, eax
sub ecx, ebx
mov ebx, 4
sub ecx, dword [rsp + 0x60]
sub ebx, dword [rsp + 0xa0]
sub ecx, r12d
sub ecx, dword [rsp + 0x6c]
add ecx, esi
movsxd rsi, dword [rsp + 0x88]
sub ebx, esi
mov dword [rsp + 0x74], ecx
cmp dword [rsp + 0x6c], esi
ja 0x1400a870f
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov ecx, dword [rsp + 0x64]
mov edx, dword [rsp + 0x8c]
mov r8d, dword [rsp + 0x70]
imul r15d, dword [rsp + 0x6c]
imul edi, esi
mov eax, edx
xor r9d, r9d
mov qword [rsp + 0x58], r9
mov qword [rsp + 0x50], r9
mov qword [rsp + 0x48], r9
imul eax, ecx
imul eax, r13d
imul eax, dword [rsp + 0x90]
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x38], ecx
imul eax, dword [rsp + 0x68]
shl eax, 4
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], r8d
sub ebp, eax
mov eax, ebx
mov dword [rsp + 0x20], edx
inc ebp
lea rdx, str.c1a1
mov r9d, r13d
imul eax, dword [rsp + 0x74]
mov ecx, r12d
imul ebp, dword [rsp + 0x78]
sub ebp, eax
mov rax, qword [rsp + 0xa0]
sub ebp, r15d
lea eax, [rax*4]
add ebp, edi
sub ebp, eax
mov eax, dword [rsp + 0x60]
sub ebp, dword [rsp + 0x80]
add eax, 0xffffff2f
sub ebp, dword [rsp + 0x84]
sub ebp, r12d
add ebp, r8d
lea r8, str.lentil
add eax, ebp
mov dword [r14], eax
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [r14 + 8], rax
mov rax, qword [rsp + 0x98]
mov qword [r14 + 0x10], rax
mov rax, r14
mov rcx, qword [rsp + 0x200]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x250]
add rsp, 0x210
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret