Function at 0x140041ac0
Capabilities:
Create thread
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x3c8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x3b0], rax
mov r14, qword [rsp + 0x438]
mov rbp, qword [rsp + 0x440]
movzx r12d, cl
mov byte [rsp + 0x60], cl
xor ecx, ecx
mov r15d, r8d
mov dword [rsp + 0x64], r8d
mov byte [rsp + 0x61], dl
lea r8d, [rcx + 0xb]
mov edx, 0x27c
mov qword [rsp + 0x78], r9
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r13, rax
mov qword [rsp + 0x98], rax
call fcn.1400c4d40
mov rsi, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, str.mallet
mov rdx, rax
mov qword [rsp + 0x70], rax
call fcn.1400a3b10
or rbx, 0xffffffffffffffff
mov byte [rsp + 0x62], al
mov rdi, rbx
nop dword [rax + rax]
inc rdi
cmp byte [r14 + rdi], 0
jne 0x140041b60
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
movzx eax, dl
imul r15b
sub al, cl
sub al, 0xb
add al, r12b
add dil, al
movzx eax, r12b
mov dword [rsp + 0x68], eax
imul eax, edx
sub eax, ecx
movzx ecx, dil
lea r12d, [rax + 0x20]
lea rax, [0x1400ed7c8]
add r12d, r13d
mov qword [rsp + 0x20], rax
mov r8d, r12d
call fcn.1400c7b40
mov rcx, rax
mov qword [rsp + 0x80], rax
cmp dword [rsp + 0x430], r15d
jb 0x140041c1a
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [r8 + rbp], 0
jne 0x140041bd0
movzx eax, r8b
shl al, 2
add r8b, al
movzx eax, cl
imul r12b
movzx ecx, al
shl cl, 3
lea edx, [rcx + rax]
movzx eax, byte [rsp + 0x62]
imul byte [rsp + 0x70]
sub al, dl
xor edx, edx
sub al, r8b
lea r8, str.c0a1
sub al, byte [rsp + 0x78]
add al, byte [rsp + 0x60]
lea ecx, [rax - 6]
call fcn.1400b8a80
mov rcx, qword [rsp + 0x70]
lea rax, str.c0ret
mov qword [rsp + 0xc8], 0
movsd xmm1, qword [rsp + 0xc8]
movsd qword [rsp + 0xe0], xmm1
mov qword [rsp + 0xb8], rcx
mov qword [rsp + 0xc0], rax
movzx eax, dil
movups xmm0, xmmword [rsp + 0xb8]
movzx edi, byte [rsp + 0x61]
lea rdx, [rsp + 0xd0]
mov r9d, 0x40
imul cl
movaps xmmword [rsp + 0xd0], xmm0
movzx ecx, byte [rsp + 0x78]
add cl, cl
lea r15d, [rcx + rax]
lea rcx, [rsp + 0x140]
sub r15b, dil
sub r15b, byte [rsp + 0x80]
sub r15b, 9
add r15b, byte [rsp + 0x60]
movzx r8d, r15b
call fcn.140099a40
mov edx, dword [rsp + 0x64]
mov r8d, edi
mov dword [rsp + 0x90], edi
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rsp + 0xf0], xmm0
movaps xmmword [rsp + 0x100], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmm1, xmmword [rax + 0x30]
movaps xmmword [rsp + 0x110], xmm0
movaps xmmword [rsp + 0x120], xmm1
movsd xmm0, qword [rax + 0x40]
movsd qword [rsp + 0x130], xmm0
cmp edx, edi
jne 0x140041eb1
xor r9d, r9d
movzx ecx, r15b
movzx eax, dil
mov qword [rsp + 0x58], r9
mov qword [rsp + 0x50], r9
mov qword [rsp + 0x48], r9
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], ecx
mov ecx, dword [rsp + 0x68]
mov dword [rsp + 0x20], edx
lea rdx, str.wrist
lea r8, [0x1400ee018]
mov r9d, edi
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov rcx, rax
mov rdi, rax
call fcn.140091e90
mov rdx, rbx
mov r13, rax
nop dword [rax + rax]
inc rdx
cmp byte [r14 + rdx], 0
jne 0x140041d60
mov r8d, dword [rsp + 0x68]
mov r10, qword [rsp + 0x98]
mov r11d, dword [rsp + 0x430]
mov eax, 3
sub eax, dword [rsp + 0x70]
lea ecx, [rax + rax*2]
mov eax, r8d
sub ecx, r10d
imul eax, dword [rsp + 0x64]
lea r9d, [rax + rcx*2]
mov eax, edi
imul eax, dword [rsp + 0x128]
add r9d, eax
mov rax, rbx
sub r9d, dword [rsp + 0x78]
sub r9d, r11d
sub r9d, edx
inc rax
cmp byte [rsi + rax], 0
jne 0x140041db5
add r9d, eax
mov rcx, rbx
inc rcx
cmp byte [rcx + rbp], 0
jne 0x140041dc4
imul ecx, r8d
lea eax, [r12 + r12*8]
lea r8d, [r10 - 0x3c]
imul ecx, r11d
sub ecx, eax
lea rax, str.c0ret
add r8d, ecx
lea rcx, str.trust
mov edx, r9d
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call fcn.1400d6650
mov rdx, rax
mov rcx, rbx
nop dword [rax + rax]
inc rcx
cmp byte [r14 + rcx], 0
jne 0x140041e10
mov rax, rbx
nop dword [rax]
inc rax
cmp byte [rax + rbp], 0
jne 0x140041e20
imul cl
movzx ecx, dil
shl cl, 2
add dil, cl
shl dil, 2
sub dil, al
mov rax, rbx
sub dil, dl
sub dil, r13b
mov r13, qword [rsp + 0x98]
sub dil, byte [rsp + 0x70]
sub dil, 0x3f
add dil, byte [rsp + 0x430]
add dil, r12b
add dil, byte [rsp + 0x60]
add dil, r13b
add dil, r15b
nop dword [rax]
cmp byte [rsi + rax + 1], 0
lea rax, [rax + 1]
jne 0x140041e70
lea edx, [rax + rdi]
lea rcx, str.c6a0
call fcn.1400a57a0
mov r15, qword [rsp + 0x80]
lea r9, str.meaning
lea r8, str.c7ret
lea rdx, [0x1400ee168]
mov rcx, r15
call fcn.1400c8ef0
jmp 0x140041eb9
mov r15, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rdi, rbx
mov dword [rsp + 0xac], eax
nop dword [rax]
inc rdi
cmp byte [rdi + rbp], 0
jne 0x140041ed0
imul edi, dword [rsp + 0x68]
mov rax, rbx
imul edi, dword [rsp + 0x64]
add edi, r15d
add edi, r13d
nop dword [rax]
inc rax
cmp byte [rsi + rax], 0
jne 0x140041ef0
sub edi, eax
dec edi
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
lea r8d, [rcx + 0xc]
mov edx, 0x3bd
mov r15d, eax
mov dword [rsp + 0x88], eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea r9d, [r15 + 6]
mov qword [rsp + 0xa0], rax
xor eax, eax
lea r8, [0x140001b00]
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x190]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor ecx, ecx
mov edx, 0x2be
lea r8d, [rcx + 0x12]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x2a0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call fcn.1400a8080
lea rdx, str.c9ret
lea rcx, [0x1400ed4b8]
mov qword [rsp + 0xb0], rax
call fcn.1400834e0
mov rcx, rbx
mov dword [rsp + 0x8c], eax
nop dword [rax]
inc rcx
cmp byte [rsi + rcx], 0
jne 0x140041fc0
movzx edx, byte [rsp + 0x61]
movzx eax, r12b
sub dl, 7
add al, al
add r12b, al
add cl, r12b
movzx r12d, byte [rsp + 0x78]
add cl, cl
sub r12b, cl
sub r12b, byte [rsp + 0xac]
add r12b, dl
mov rdx, qword [rsp + 0x80]
add r12b, byte [rsp + 0x60]
movzx ecx, r12b
call fcn.14006b330
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov ecx, eax
mov r13, rax
call fcn.1400757e0
mov rcx, rbx
mov r8, rax
inc rcx
cmp byte [rcx + rbp], 0
jne 0x140042022
mov r10, qword [rsp + 0x98]
mov rdx, qword [rsp + 0x118]
mov rax, rbx
imul ecx, r10d
inc rax
cmp byte [rdx + rax], 0
jne 0x140042042
shl eax, 6
add ecx, eax
mov rax, rbx
cmp byte [r15 + rax + 1], 0
lea rax, [rax + 1]
jne 0x140042053
lea eax, [rax + rax*2]
lea edx, [rcx + rax*2]
movsx ecx, byte [rsp + 0x62]
movzx eax, r12b
imul eax, dword [rsp + 0x80]
imul ecx, dword [rsp + 0x70]
sub ecx, eax
mov rax, qword [rsp + 0x78]
imul eax, dword [rsp + 0x64]
sub ecx, eax
mov eax, dword [rsp + 0x90]
add edx, ecx
imul eax, dword [rsp + 0x68]
add edx, eax
imul eax, dword [rsp + 0xb0], 0xf
add edx, eax
mov rax, qword [rsp + 0xa0]
lea eax, [rax + rax*4]
lea ecx, [rdx + rax*2]
mov rax, rbx
sub ecx, r8d
sub ecx, dword [rsp + 0x88]
sub ecx, edi
sub ecx, dword [rsp + 0x430]
add ecx, r13d
add ecx, dword [rsp + 0x8c]
inc rax
cmp byte [rsi + rax], 0
jne 0x1400420d1
sub ecx, eax
nop dword [rax]
inc rbx
cmp byte [r14 + rbx], 0
jne 0x1400420e0
lea eax, [rcx - 0xb]
add eax, ebx
mov rcx, qword [rsp + 0x3b0]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x3c8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret