Function at 0x1400c83e0
Capabilities:
Create thread
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x280
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov r14d, ecx
mov rdi, rdx
mov qword [rsp + 0x80], rdx
lea esi, [r14 + rdx]
mov byte [rsp + 0x60], sil
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x108], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x110], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x130]
mov edx, 0x104
mov qword [rsp + 0x120], rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov ecx, r14d
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r15d, r15d
lea r8, [0x140001b00]
mov r9d, r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r15
mov qword [rsp + 0xf0], rax
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [rsp + 0x110]
movsx r9, r14b
movzx r8d, sil
lea edx, [rdi*4]
lea ecx, [rax + rax*8]
lea r12d, [r8 + 3]
mov qword [rsp + 0xb0], r9
sub edx, ecx
mov dword [rsp + 0x70], r8d
sub edx, r9d
add edx, r14d
add r12d, edx
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rsi, rax
mov qword [rsp + 0xb8], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
movzx r13d, r12b
mov rbp, rax
mov qword [rsp + 0xa0], rax
sub r13b, al
add r13b, sil
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
lea r9d, [r15 + 0x40]
lea r8, [0x140001b00]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateThread]
movsx eax, r14b
lea r15d, [r14 + r14*8]
lea rcx, str.vein
add r15d, eax
sub r15d, edi
sub r15d, edi
sub r15d, esi
add r15d, r14d
add r15d, ebp
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
movzx ebp, r14b
shl bpl, 2
mov dword [rsp + 0x6c], eax
sub bpl, bl
add bpl, r12b
add bpl, sil
movzx esi, byte [rsp + 0x60]
add bpl, 3
add bpl, sil
movsx ebx, bpl
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x88], rax
cmp r12d, 0x40
jne 0x1400c861c
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor eax, eax
movzx ecx, r13b
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], ecx
lea r8, str.vein
lea rdx, str.inspector
mov r9d, ebx
mov dword [rsp + 0x20], r12d
call qword [sym.imp.USER32.dll_CreateWindowExA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x130]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
lea r8d, [r12 - 0x2d]
mov edx, 0x280
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov ecx, edi
mov rdi, qword [rsp + 0xb0]
mov eax, 1
sub eax, r12d
imul ecx, r14d
lea edx, [rax + rax*8]
movzx eax, sil
add eax, ecx
lea rcx, str.c0ret
add edx, eax
mov al, 0x7f
add edx, edi
add edx, dword [rsp + 0x6c]
imul r14b
movzx ebx, al
mov rax, qword [rsp + 0x88]
shl al, 3
mov dword [rsp + 0x64], edx
sub bl, al
sub bl, sil
add bl, 0xa
add bl, r13b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.c0a6
mov r9, rdi
mov r8, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
movzx ecx, bl
movsxd rdi, eax
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x6c], ecx
movsx rdx, dil
movsx esi, dil
sub eax, edx
mov qword [rsp + 0xe8], rdx
movzx edx, r13b
sub eax, ecx
mov dword [rsp + 0x90], edx
add eax, 0x14
mov dword [rsp + 0x78], eax
mov eax, esi
imul eax, ecx
imul ecx, dword [rsp + 0x70], 0xfffffff9
sub ecx, eax
lea eax, [r12 - 0xea]
add ecx, dword [rsp + 0x80]
add ecx, r14d
add ecx, edx
mov edx, 0x350
add ecx, r15d
add eax, ecx
xor ecx, ecx
lea r8d, [rcx + 0x12]
mov dword [rsp + 0x68], eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x112
lea r8d, [rcx + 0x1c]
mov r15, rax
mov qword [rsp + 0xc8], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x39d
lea r8d, [rcx + 0xb]
mov qword [rsp + 0xc0], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0xd0], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
movzx r9d, byte [rsp + 0x60]
mov r11, rax
mov qword [rsp + 0xa8], rax
movzx eax, byte [rsp + 0x120]
mov r8d, 1
imul r12b
movzx ecx, al
movzx eax, r13b
imul cl
mov ecx, r8d
movzx edx, al
sub cl, r9b
sub bl, 0x38
movzx eax, r14b
imul cl
movzx r10d, al
sub r10b, dl
mov rdx, qword [rsp + 0x88]
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
movzx eax, dil
sub r10b, cl
imul byte [rsp + 0x78]
add r10b, al
mov eax, dword [rsp + 0xd0]
add r10b, bl
movzx ecx, r10b
mov byte [rsp + 0x60], r10b
imul eax, r11d
mov r11d, dword [rsp + 0xc0]
mov dword [rsp + 0x74], ecx
imul r11d, r15d
mov r15, qword [rsp + 0x80]
sub r11d, eax
sub r11d, ecx
movzx eax, r15b
sub r11d, 4
mov dword [rsp + 0x94], r11d
imul byte [rsp + 0x108]
movzx ecx, al
movzx eax, r12b
imul cl
movzx ecx, al
movzx eax, byte [rsp + 0xa0]
imul cl
movzx ecx, al
movzx eax, r9b
imul cl
mov ecx, r8d
sub cl, al
movzx eax, r14b
imul cl
mov ecx, dword [rsp + 0x64]
movzx ebx, al
movzx eax, dil
mov edi, dword [rsp + 0x68]
imul cl
movzx ecx, al
movzx eax, dl
imul cl
add bl, al
sub bl, r11b
sub bl, dil
sub bl, 0xb
add bl, r10b
add bl, bpl
add bl, r13b
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [rsp + 0x80], rax
movsx eax, bl
mov ecx, eax
mov dword [rsp + 0x9c], eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, dword [rsp + 0xa8]
lea edx, [r14 + r14*8]
imul ecx, dword [rsp + 0x74]
shl edx, 8
mov qword [rsp + 0xd8], rax
imul ecx, edi
sub edx, ecx
movsx rcx, bl
sub edx, ecx
sub edx, eax
movzx eax, r13b
mov r13, qword [rsp + 0xb8]
sub edx, eax
mov rax, qword [rsp + 0x88]
sub edx, r13d
add eax, 0xffffffdb
add edx, dword [rsp + 0x80]
add edx, dword [rsp + 0x64]
add eax, edx
xor ecx, ecx
mov edx, 0xac
mov dword [rsp + 0x98], eax
lea r8d, [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r9d, dword [rsp + 0x9c]
mov edx, dword [rsp + 0xc0]
imul edx, dword [rsp + 0xa8]
mov r8d, dword [rsp + 0x64]
mov rbx, rax
movsx rax, bpl
imul edx, dword [rsp + 0x74]
mov ecx, eax
mov qword [rsp + 0xe0], rax
mov eax, dword [rsp + 0xd8]
imul edx, dword [rsp + 0x94]
imul ecx, dword [rsp + 0x88]
lea ecx, [rdx + rcx*4]
mov r10d, edi
imul eax, dword [rsp + 0x80]
lea edx, [rcx + rcx*4]
movsx edi, r10b
imul eax, r9d
mov ecx, edi
imul ecx, dword [rsp + 0xc8]
sub edx, ecx
add edx, eax
mov rax, qword [rsp + 0xf0]
imul eax, dword [rsp + 0x108]
add edx, eax
mov eax, dword [rsp + 0xa0]
imul eax, r13d
add edx, eax
lea eax, [r12 + r12*2]
lea ecx, [rdx + r8*4]
mov edx, dword [rsp + 0x90]
sub ecx, eax
mov rax, qword [rsp + 0xb0]
add edx, 0xfffffffc
sub ecx, dword [rsp + 0x6c]
sub ecx, eax
add ecx, r14d
add ecx, edx
xor edx, edx
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], r9d
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], r8d
mov r9d, r8d
mov dword [rsp + 0xb8], ecx
lea r8, str.duplexer
lea rdx, str.c3a4
mov ecx, r10d
mov dword [rsp + 0x20], r10d
call qword [sym.imp.USER32.dll_CreateWindowExA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rbp, rax
cmp r14d, esi
jb 0x1400c8a68
movzx ecx, byte [rsp + 0x60]
mov esi, dword [rsp + 0x90]
mov r9d, dword [rsp + 0x98]
xor eax, eax
lea r8, str.inspector
lea rdx, [0x1400ed51c]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x70]
mov qword [rsp + 0x40], rcx
mov ecx, dword [rsp + 0x68]
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea rcx, [rsp + 0x130]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x130]
lea rcx, str.vein
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
imul ebx, dword [rsp + 0xd8]
imul edi, dword [rsp + 0xd0]
mov rax, qword [rsp + 0xe0]
mov ecx, dword [rsp + 0x64]
add eax, eax
sub ebp, eax
mov eax, 1
sub ebp, dword [rsp + 0x94]
imul ebx, dword [rsp + 0x80]
imul edi, dword [rsp + 0xc8]
add ebp, dword [rsp + 0x70]
imul edi, dword [rsp + 0x68]
imul ebx, dword [rsp + 0x9c]
sub eax, edi
imul eax, dword [rsp + 0xc0]
imul ebx, dword [rsp + 0x98]
lea edx, [rax + rbp*4]
mov eax, dword [rsp + 0x120]
sub edx, ebx
lea ecx, [rax + rcx*4]
add ecx, dword [rsp + 0x88]
lea eax, [rcx + rcx*4]
add edx, eax
lea eax, [r12 - 0x43]
sub edx, dword [rsp + 0xe8]
sub edx, r15d
sub edx, dword [rsp + 0x74]
add edx, r14d
add edx, dword [rsp + 0xb8]
add edx, dword [rsp + 0xa8]
add edx, dword [rsp + 0x78]
add edx, dword [rsp + 0x6c]
add edx, dword [rsp + 0xb0]
add edx, dword [rsp + 0xa0]
add edx, r13d
add eax, edx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x2d0]
add rsp, 0x280
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret