Function at 0x14005f440
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x190
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov r13, rcx
mov rbp, rdx
mov qword [rsp + 0x60], rdx
lea rcx, [rsp + 0x70]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov r8, qword [rbp + 0x20]
or rbx, 0xffffffffffffffff
mov r14, rax
mov qword [rsp + 0x58], rax
inc rbx
cmp byte [r8 + rbx], 0
jne 0x14005f494
imul ebx, r13d
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r15, rax
mov qword [rsp + 0x48], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r12, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
movzx ecx, r12b
mov qword [rsp + 0x40], rax
shl cl, 2
movzx esi, r13b
lea eax, [rcx + r12]
add al, al
sub sil, al
mov byte [rsp + 0x30], al
sub sil, byte [rbp]
add sil, r14b
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [rsp + 0x50], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rdx, qword [rsp + 0x50]
movzx ecx, sil
mov edi, r13d
imul ecx, dword [rsp + 0x40]
imul edi, ebx
sub edi, edx
sub edi, r12d
sub edi, r15d
mov r15d, r12d
imul r15d, r12d
imul ecx, edx
sub r15d, ecx
sub r15d, eax
mov eax, r13d
sub eax, dword [rbp]
sub r15d, r14d
sub eax, r12d
sub r15d, ebx
sub eax, dword [rsp + 0x48]
add r15d, r13d
lea ebp, [rax - 0xa]
add ebp, r14d
mov dword [rsp + 0x34], ebp
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [rsp + 0x38], rax
cmp ebx, ebp
jl 0x14005f69e
xor ecx, ecx
mov edx, 0x36d
lea r8d, [rcx + 9]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea r8, [0x140001b00]
movsxd r9, edi
mov rbp, rax
movzx eax, r15b
xor edx, edx
xor ecx, ecx
imul dil
movzx r14d, al
xor eax, eax
sub r14b, byte [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
sub r14b, byte [rsp + 0x58]
add r14b, 0xa
add r14b, bl
add r14b, r13b
add r14b, byte [rsp + 0x48]
add r14b, sil
call qword [sym.imp.KERNEL32.dll_CreateThread]
movzx edi, bpl
mov rdx, rax
movzx eax, byte [rsp + 0x38]
shl dil, 2
imul byte [rsp + 0x40]
movzx ecx, al
movzx eax, sil
imul cl
movzx ecx, r13b
shl al, 2
sub cl, al
movzx eax, dl
mov edx, 0x8d
sub cl, byte [rsp + 0x30]
lea r8d, [rdx - 0x7a]
add cl, r12b
imul cl
xor ecx, ecx
sub dil, al
sub dil, r14b
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
lea r8d, [rcx + 0xd]
mov edx, 0x108
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rax, qword [rsp + 0x60]
movzx esi, byte [rax + 8]
sub sil, bl
mov rbx, qword [rsp + 0x38]
sub sil, bpl
sub sil, byte [rsp + 0x50]
sub sil, dil
sub sil, bl
sub sil, 5
add sil, byte [rsp + 0x34]
add sil, r15b
add sil, r13b
add sil, r14b
call qword [sym.imp.USER32.dll_GetForegroundWindow]
movsx r8d, sil
add r8d, ebx
lea rcx, str.chard
add eax, r8d
movsxd rdi, eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.c0a1
mov r9d, r15d
mov r8, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
lea rcx, [rsp + 0x70]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov edx, 0x9c
lea r8d, [rdx - 0x7f]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rax, r12
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x1e0]
add rsp, 0x190
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret