Function at 0x1400c7230
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1e0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov qword [rsp + 0x50], rcx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r14, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x90]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x90]
mov edx, 0x104
mov rbx, rax
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
movzx esi, bl
mov r13d, 8
shl sil, 3
mov qword [rsp + 0x30], rax
sub r13d, ebx
sub sil, al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
mov edi, eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
movzx ebp, dil
mov r12, rax
mov qword [rsp + 0x48], rax
sub bpl, al
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov ebx, dword [rsp + 0x30]
mov r15, rax
mov qword [rsp + 0x60], rax
movsx eax, bpl
xor ecx, ecx
mov edx, 0x380
imul eax, r12d
sub ebx, eax
lea r8d, [rcx + 0xb]
mov dword [rsp + 0x38], eax
add ebx, 0x31
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x90]
xor edx, edx
mov r8d, 0x140
mov qword [rsp + 0x80], rax
call fcn.1400e27d0
lea rdx, [rsp + 0x90]
lea rcx, str.fisherman
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [rsp + 0x20]
imul ecx, ebx
neg ecx
mov dword [rsp + 0x28], eax
movsx eax, r15b
shl ecx, 3
movzx r15d, dil
mov edx, r15d
movzx edi, sil
lea esi, [rdi + 8]
imul edx, eax
add edx, 0xc
imul edx, r12d
sub ecx, edx
sub ecx, dword [rsp + 0x30]
add esi, ecx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ecx, ecx
lea r8d, [rcx + 0x1b]
mov edx, 0x300
mov r12, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea ecx, [r12 + r12*4]
imul r14d, dword [rsp + 0x40]
lea edx, [r14 + rcx*4]
mov r8, rax
movsx r9, bpl
shl edx, 3
mov r11, qword [rsp + 0x60]
mov ebp, dword [rsp + 0x28]
mov r14, qword [rsp + 0x58]
movsx r10d, r11b
lea eax, [r9 + r9*8]
mov ecx, r10d
imul ecx, dword [rsp + 0x20]
sub edx, ecx
mov ecx, ebp
imul ecx, dword [rsp + 0x48]
sub edx, ecx
add edx, eax
mov eax, dword [rsp + 0x80]
lea ecx, [rax + rax*2]
shl ecx, 2
sub edx, ecx
mov rcx, qword [rsp + 0x50]
sub edx, ebx
sub edx, edi
sub edx, r14d
sub edx, r13d
mov r13, qword [rsp + 0x20]
lea eax, [r8 + rdx]
mov rdx, qword [rsp + 0x48]
add eax, 0x7b
add eax, r15d
add eax, esi
mov dword [rcx], eax
lea eax, [rbp*4]
mov ecx, 1
sub ecx, eax
mov eax, dword [rsp + 0x40]
sub eax, r12d
shl eax, 5
imul ecx, edx
add ecx, eax
lea eax, [r13*8]
add eax, r13d
add ecx, eax
movsx rax, r11b
mov r11, qword [rsp + 0x30]
sub ecx, eax
sub ecx, r8d
sub ecx, edi
mov rdi, qword [rsp + 0x50]
lea eax, [rbx + rcx]
imul r8d, ebx
lea ecx, [r10 + r10*2]
add eax, 0x1e
shl ecx, 4
mov qword [rdi + 8], r11
add eax, r15d
add ecx, 0xa1
mov qword [rdi + 0x20], 0
add eax, dword [rsp + 0x38]
mov qword [rdi + 0x28], r13
imul ecx, edx
add eax, esi
sub ecx, r8d
mov dword [rdi + 4], eax
lea rax, str.c6a1
mov qword [rdi + 0x10], rax
lea rax, str.rambler
mov qword [rdi + 0x18], rax
lea eax, [rsi + r13]
lea edx, [rcx + rax*2]
mov rax, rdi
sub edx, r9d
sub edx, r12d
sub edx, ebp
sub edx, dword [rsp + 0x40]
add edx, r14d
add edx, r11d
mov dword [rdi + 0x30], edx
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret