Function at 0x1400c0eb0
Capabilities:
Create thread
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xe0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0xd8], rax
mov r15d, r9d
or rbp, 0xffffffffffffffff
mov r14, r8
mov rbx, rdx
mov qword [rsp + 0x90], rcx
mov dword [rsp + 0x60], r15d
mov rdi, rbp
inc rdi
cmp byte [rdx + rdi], 0
jne 0x1400c0ef6
lea eax, [r8 + r8*4]
xor ecx, ecx
lea r8, [0x140001b00]
mov qword [rsp + 0x28], rcx
mov r9, r15
xor edx, edx
add edi, eax
mov qword [rsp + 0xa8], r15
mov dword [rsp + 0x20], ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [rsp + 0xb0]
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
movsx r13, dil
mov rdx, rbp
mov qword [rsp + 0xc8], rax
nop dword [rax + rax]
inc rdx
cmp byte [rbx + rdx], 0
jne 0x1400c0f60
mov ecx, r14d
mov eax, r13d
mov rsi, rbp
imul ecx, r15d
sub eax, ecx
add eax, 2
add eax, edi
add eax, edx
mov dword [rsp + 0x34], eax
inc rsi
cmp byte [rbx + rsi], 0
jne 0x1400c0f83
movzx eax, dil
shl al, 2
lea ecx, [rax + rdi]
add cl, cl
add sil, cl
add sil, r14b
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rbp
mov qword [rsp + 0x48], rax
nop dword [rax]
inc rcx
cmp byte [rbx + rcx], 0
jne 0x1400c0fb0
add ecx, 5
mov eax, r14d
sub eax, r13d
add eax, dword [rsp + 0xc8]
add eax, ecx
movsx ecx, dil
mov dword [rsp + 0x70], ecx
mov dword [rsp + 0x38], eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r12, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0x58], rax
cmp dword [rsp + 0x38], edi
jg 0x1400c100d
xor ecx, ecx
mov edx, 0x24c
lea r8d, [rcx + 9]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
mov rax, rbp
inc rax
cmp byte [rbx + rax], 0
jne 0x1400c1010
imul r15d, eax
xor ecx, ecx
mov edx, 0x17a
add r15d, 3
lea r8d, [rcx + 0x19]
add r15d, r12d
mov dword [rsp + 0x3c], r15d
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, rax
mov qword [rsp + 0x50], rax
movzx eax, r14b
imul r15b
sub al, cl
mov byte [rsp + 0x30], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rdx, rbp
mov qword [rsp + 0x98], rax
movzx eax, sil
mov dword [rsp + 0x40], eax
nop dword [rax + rax]
inc rdx
cmp byte [rbx + rdx], 0
jne 0x1400c1070
mov ecx, eax
imul ecx, dword [rsp + 0x34]
lea eax, [rdi + rcx*4]
add ecx, eax
add ecx, edx
mov edx, 0x1c4
lea eax, [rcx + r14*2]
xor ecx, ecx
lea r8d, [rcx + 0xe]
mov dword [rsp + 0x34], eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x12c
lea r8d, [rcx + 0x1c]
mov rsi, rax
mov qword [rsp + 0x88], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0x80], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [rsp + 0x68], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, 0xffff
mov qword [rsp + 0xa0], rax
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rcx, rbp
inc rcx
cmp byte [rbx + rcx], 0
jne 0x1400c10f7
mov r10, qword [rsp + 0x50]
movzx eax, dil
imul cl
movzx r15d, al
movzx ecx, sil
add cl, cl
movzx eax, r10b
mov rsi, rbp
sub r15b, cl
mov rcx, qword [rsp + 0x48]
imul r14b
add r15b, r15b
sub r15b, al
mov al, 7
imul cl
sub r15b, al
sub r15b, 0xd
add r15b, r12b
add r15b, byte [rsp + 0xc8]
inc rsi
cmp byte [rbx + rsi], 0
jne 0x1400c1143
lea eax, [r12 + r12*4]
shl eax, 4
sub eax, dword [rsp + 0xa0]
lea eax, [rax*2 + 6]
sub eax, r10d
add eax, r13d
add esi, eax
mov eax, dword [rsp + 0x34]
add esi, r14d
add esi, edi
cmp eax, 2
jne 0x1400c11bc
lea rcx, str.cash
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r8, qword [rsp + 0xa8]
lea rdx, [0x1400ed3f4]
mov rcx, rax
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r10, qword [rsp + 0x50]
mov eax, dword [rsp + 0x34]
mov r11d, dword [rsp + 0x60]
mov r9d, dword [rsp + 0x98]
mov rdx, rbp
lea r8d, [r11 + r11*4]
imul r9d, eax
inc rdx
cmp byte [rbx + rdx], 0
jne 0x1400c11d4
mov eax, r12d
imul eax, dword [rsp + 0x38]
imul ecx, eax, 0x1c
mov eax, dword [rsp + 0x80]
add ecx, r14d
add ecx, ecx
imul eax, dword [rsp + 0x68]
sub ecx, eax
mov eax, dword [rsp + 0x70]
imul eax, edi
sub ecx, eax
mov eax, r10d
movsx r10, byte [rsp + 0x30]
imul eax, dword [rsp + 0x3c]
sub ecx, eax
mov rax, qword [rsp + 0x48]
lea eax, [rax + rax*4]
add ecx, eax
mov eax, dword [rsp + 0xc8]
sub ecx, r10d
add eax, 0xffffffdb
sub ecx, r9d
sub ecx, dword [rsp + 0x40]
sub ecx, dword [rsp + 0x88]
add ecx, r8d
mov r8, rbp
add ecx, dword [rsp + 0x58]
add ecx, esi
add ecx, dword [rsp + 0x78]
add eax, ecx
add edx, eax
mov rax, qword [rsp + 0x90]
mov dword [rax], edx
nop word [rax + rax]
inc r8
cmp byte [rbx + r8], 0
jne 0x1400c1260
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x48]
lea ecx, [rax + rcx*2]
mov eax, r14d
imul eax, r10d
imul eax, dword [rsp + 0x50]
imul eax, dword [rsp + 0x3c]
lea eax, [rax + rax*4]
lea ecx, [rax + rcx*2]
movsx rax, r15b
sub ecx, esi
sub ecx, dword [rsp + 0x34]
lea edx, [rax + rcx*2]
mov rcx, qword [rsp + 0x80]
lea eax, [r11*4 + 0x1f]
sub edx, r13d
add eax, r11d
sub edx, r14d
sub edx, ecx
sub edx, dword [rsp + 0x58]
sub edx, dword [rsp + 0x98]
sub edx, dword [rsp + 0x78]
sub edx, r12d
add eax, edx
mov rdx, qword [rsp + 0x88]
add eax, r8d
mov r8, qword [rsp + 0x90]
add eax, dword [rsp + 0x40]
add eax, dword [rsp + 0x68]
add eax, edx
add eax, dword [rsp + 0x38]
add eax, edi
mov dword [r8 + 4], eax
inc rbp
cmp byte [rbx + rbp], 0
jne 0x1400c12f4
sub ecx, dword [rsp + 0x48]
sub ebp, dword [rsp + 0x3c]
imul r10d, dword [rsp + 0x50]
lea ecx, [rcx*2 - 0x12]
movsx eax, r15b
imul r12d, dword [rsp + 0x38]
imul r13d, edi
imul ebp, r14d
add ecx, ebp
imul eax, esi
add ecx, eax
lea eax, [r13*4]
add ecx, r10d
add eax, r13d
add ecx, r12d
add ecx, eax
mov rax, r8
sub ecx, dword [rsp + 0x58]
sub ecx, dword [rsp + 0x40]
sub ecx, dword [rsp + 0x68]
add ecx, r11d
add ecx, r9d
add ecx, edx
add ecx, dword [rsp + 0x78]
add ecx, dword [rsp + 0xc8]
mov dword [r8 + 8], ecx
mov rcx, qword [rsp + 0xd8]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x120]
add rsp, 0xe0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret