Function at 0x1400a40f0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x100
mov rbp, r9
mov r15, rdx
mov r13, rcx
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [rsp + 0xa0], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [rsp + 0xa8], rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rsi, rax
mov qword [rsp + 0x38], rax
imul ebx, r15d
imul r14d, ebx, 0xe
add r14d, eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbx, rax
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
or rdi, 0xffffffffffffffff
mov r12, rax
mov rcx, rdi
inc rcx
cmp byte [rcx + rbp], 0
jne 0x1400a4171
mov rdx, qword [rsp + 0x150]
mov eax, ebx
imul eax, esi
mov esi, dword [rdx]
mov edx, 0xc4
imul eax, r14d
imul eax, eax, 7
sub esi, eax
add esi, r15d
sub esi, ecx
xor ecx, ecx
lea r8d, [rcx + 0x13]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x24], eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, 0xffff
mov qword [rsp + 0x30], rax
mov eax, r12d
imul eax, ebx
mov dword [rsp + 0x40], eax
add eax, 0xfffffffe
add eax, r15d
mov dword [rsp + 0x148], eax
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
mov r8, qword [rsp + 0x150]
mov r9, qword [rsp + 0x30]
mov dword [rsp + 0x58], eax
mov eax, dword [r8]
imul eax, dword [rsp + 0xa8]
mov ecx, r12d
imul ecx, r14d
lea edx, [rcx + rcx*2]
mov rcx, qword [r8 + 0x10]
shl edx, 2
sub eax, edx
mov edx, ebx
sub eax, r9d
add eax, r15d
mov dword [rsp + 0x2c], eax
mov rax, rdi
imul edx, r14d
inc rax
cmp byte [rcx + rax], 0
jne 0x1400a4226
mov rcx, rdi
inc rcx
cmp byte [rcx + rbp], 0
jne 0x1400a4232
mov r8, qword [rsp + 0x38]
imul eax, ecx
mov ecx, dword [rsp + 0x70]
imul eax, r15d
sub eax, r12d
lea ebx, [r8 - 7]
imul ecx, r9d
add eax, edx
mov dword [rsp + 0x20], ecx
add eax, r9d
add ebx, eax
mov eax, dword [rsp + 0x148]
imul eax, esi
add eax, edx
mov edx, 0x25f
add eax, r12d
neg eax
mov dword [rsp + 0x28], eax
mov eax, r8d
sub eax, ecx
xor ecx, ecx
sub eax, ebx
lea r8d, [rcx + 0x1d]
add eax, 5
mov dword [rsp + 0xd0], eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
movsxd rsi, dword [rsp + 0x148]
mov eax, ebx
mov rcx, rbp
imul eax, dword [rsp + 0x2c]
imul eax, dword [rsp + 0x50]
sub eax, r14d
add eax, dword [rsp + 0x38]
add eax, r15d
mov dword [rsp + 0x48], eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x1400ed4fc]
mov r9, rsi
mov r8d, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
movzx esi, byte [rsp + 0xd0]
movzx ecx, al
mov dword [rsp + 0x44], eax
movzx eax, r12b
shl cl, 2
dec cl
imul cl
mov rcx, rdi
add al, sil
mov byte [rsp + 0x140], al
mov rax, qword [rsp + 0x150]
mov rdx, qword [rax + 0x20]
nop
inc rcx
cmp byte [rdx + rcx], 0
jne 0x1400a4310
mov rax, rdi
nop dword [rax]
inc rax
cmp byte [rax + rbp], 0
jne 0x1400a4320
shl sil, 5
imul cl
add sil, r12b
add sil, sil
movzx ecx, al
movzx eax, byte [rsp + 0x30]
imul r14b
add sil, al
sub sil, cl
mov rcx, rdi
sub sil, byte [rsp + 0x38]
add sil, byte [rsp + 0x58]
add sil, r15b
inc rcx
cmp byte [rdx + rcx], 0
jne 0x1400a4356
mov rax, rdi
inc rax
cmp byte [rax + rbp], 0
jne 0x1400a4362
mov edx, dword [rsp + 0x20]
imul ecx, eax
mov eax, r12d
imul edx, dword [rsp + 0x50]
imul edx, r14d
sub eax, edx
sub eax, ecx
lea ecx, [r15 + 0x14c]
sub eax, dword [rsp + 0xa8]
add ecx, eax
mov dword [rsp + 0x20], ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, qword [rsp + 0x150]
mov r8, rdi
mov rax, qword [rdx + 0x10]
nop
inc r8
cmp byte [rax + r8], 0
jne 0x1400a43c0
mov r9, qword [rsp + 0x50]
mov r11, qword [rsp + 0x38]
movsx r10d, sil
mov eax, ebx
mov ecx, r15d
imul eax, dword [rsp + 0x58]
shl eax, 2
sub ecx, eax
mov eax, dword [rsp + 0x70]
imul eax, r9d
add eax, 2
imul eax, r12d
lea edx, [rax + rcx*2]
movsx rcx, byte [rsp + 0x140]
mov eax, dword [rsp + 0x28]
lea eax, [rax + rax*4]
sub eax, r14d
imul eax, r11d
add edx, eax
mov eax, dword [rsp + 0x20]
imul eax, r10d
imul r10d, r10d
add edx, eax
movsx rax, sil
movsxd rsi, dword [rsp + 0x44]
sub edx, ecx
add edx, eax
movsx rax, sil
add edx, eax
mov eax, dword [rsp + 0x148]
sub edx, dword [rsp + 0x30]
add eax, 0xfffffea7
sub edx, r9d
add eax, edx
mov edx, ecx
mov rcx, rdi
add r8d, eax
movsx eax, sil
mov rsi, qword [rsp + 0x150]
mov dword [r13], r8d
imul edx, eax
mov rax, qword [rsi + 0x20]
inc rcx
cmp byte [rax + rcx], 0
jne 0x1400a4467
mov eax, dword [rsp + 0xa0]
mov r8d, dword [rsp + 0x48]
imul ecx, r15d
add eax, eax
sub ecx, eax
mov rax, rdi
sub ecx, edx
sub ecx, r10d
sub ecx, r8d
sub ecx, ebx
mov ebx, dword [rsp + 0x148]
sub ecx, r12d
sub ecx, dword [rsp + 0x24]
sub ecx, r9d
sub ecx, r14d
add ecx, dword [rsp + 0x2c]
add ecx, ebx
add ecx, r11d
nop
inc rax
cmp byte [rax + rbp], 0
jne 0x1400a44b0
add eax, 0xffffff9f
add eax, ecx
mov dword [r13 + 4], eax
lea rax, str.vixen
mov qword [r13 + 8], rax
nop dword [rax]
inc rdi
cmp byte [rdi + rbp], 0
jne 0x1400a44d0
imul edi, dword [rsi]
mov eax, dword [rsp + 0x28]
imul r8d, r12d
mov qword [r13 + 0x18], 0
mov qword [r13 + 0x20], r12
lea eax, [rax + rax*4]
imul edi, r15d
add edi, r8d
add edi, eax
lea eax, [r15 + 0x150]
sub edi, r10d
sub edi, dword [rsp + 0x40]
sub edi, r12d
sub edi, ebx
mov rbx, qword [rsp + 0x158]
sub edi, dword [rsp + 0x24]
sub edi, r9d
sub edi, r14d
add edi, edx
add edi, dword [rsp + 0x30]
add edi, dword [rsp + 0x58]
add edi, r11d
add eax, edi
mov dword [r13 + 0x10], eax
lea rax, str.c0a3
mov qword [r13 + 0x28], rax
mov rax, r13
add rsp, 0x100
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret