Function at 0x140084fb0
Capabilities:
Create thread

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1d8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov r14, qword [rsp + 0x240]
or rbx, 0xffffffffffffffff
mov rbp, r9
mov rsi, r8
mov qword [rsp + 0x70], rdx
mov r15, rcx
mov qword [rsp + 0x68], r14
mov rax, rbx
nop dword [rax + rax]
inc rax
cmp byte [r8 + rax], 0
jne 0x140085000
imul eax, edx
mov edi, ecx
sub edi, eax
mov dword [rsp + 0x60], edi
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea r13d, [r14 + r15]
mov r12, rax
add r13d, eax
mov rcx, rbx
nop dword [rax + rax]
inc rcx
cmp byte [rsi + rcx], 0
jne 0x140085030
imul ecx, edi
mov r14d, r15d
mov rdi, rbx
sub r14d, ecx
sub r14d, eax
dec r14d
nop dword [rax + rax]
inc rdi
cmp byte [rsi + rdi], 0
jne 0x140085050
add dil, byte [rsp + 0x68]
xor ecx, ecx
mov edx, 0x31f
add dil, byte [rsp + 0x70]
lea r8d, [rcx + 0x14]
add dil, r15b
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0x68], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor r8d, r8d
cmp dword [rsp + 0x60], r13d
je 0x1400850c3
mov edx, dword [rsp + 0x70]
mov qword [rsp + 0x28], r8
lea ecx, [r12 + r12*2]
add ecx, ecx
mov dword [rsp + 0x20], r8d
lea r8, [0x140001b00]
sub edx, ecx
mov rcx, qword [rsp + 0x68]
add ecx, 2
add edx, r15d
add ecx, edx
xor edx, edx
movsxd r9, ecx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rbx
inc rcx
cmp byte [rcx + rbp], 0
jne 0x1400850c6
mov rdx, qword [rsp + 0x70]
mov eax, r14d
imul eax, r12d
lea r12d, [r15 + 2]
imul ecx, edx
imul eax, r13d
add ecx, eax
sub ecx, dword [rsp + 0x68]
add r12d, ecx
nop
inc rbx
cmp byte [rbx + rbp], 0
jne 0x1400850f0
imul ebx, edx
movzx eax, dil
add ebx, r15d
cmp r13d, eax
je 0x140085202
lea rcx, [rsp + 0x80]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0x22
xor ecx, ecx
lea r8d, [rdx - 0x12]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
movsxd rax, dword [rsp + 0x60]
xor edi, edi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], ebx
mov r9d, ebx
mov r8, rsi
mov rdx, rsi
mov ecx, r13d
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea r8d, [rdi + 1]
mov edx, 0x1b1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea r8, [0x140001b00]
movsxd r9, ebx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [rsp + 0x80]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea r8d, [rdi + 9]
mov edx, 0x275
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x80]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x80]
lea rcx, [0x1400ed4fc]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
jmp 0x140085204
xor edi, edi
lea r8, [0x140001b00]
movsxd r9, r12d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rax, str.himalayan
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x1d8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret