Function at 0x1400a9c50
Capabilities:
Create thread
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov ecx, 0xffff
mov r12, r8
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
movsxd r14, eax
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
xor r13d, r13d
lea r8, [0x140001b00]
lea r9d, [r13 + 2]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r13
movzx edi, ax
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea edx, [r13 + 0x4c]
lea r8d, [r13 + 6]
xor ecx, ecx
mov rsi, rax
mov qword [rsp + 0xc0], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0x60], rax
lea eax, [r12 + r12]
lea ecx, [rax + 0x18]
mov dword [rsp + 0xc8], eax
mov dword [rsp + 0x68], ecx
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
movzx ebx, r12b
mov dword [rsp + 0xd8], eax
imul byte [rsp + 0x68]
sub bl, al
sub bl, r14b
sub bl, sil
sub bl, dil
add bl, 5
cmp bl, dil
jae 0x1400a9d4a
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea ecx, [r13 + 2]
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r8d, [r13 + 2]
mov edx, 0xbb
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x38], r14d
movzx ebp, dil
mov dword [rsp + 0x30], 2
movzx r15d, bl
lea r8, str.couch
lea rdx, str.c6a1
mov r9d, ebp
mov ecx, ebp
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 2
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov r13, rax
cmp bl, dil
je 0x1400a9db3
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov edi, dword [rsp + 0x60]
mov ecx, r15d
imul ecx, r13d
lea edx, [rcx + rcx*2]
lea ebx, [rdi - 2]
mov rsi, rax
sub edx, ebp
sub edx, dword [rsp + 0xd8]
add edx, dword [rsp + 0xc8]
add edx, dword [rsp + 0xc0]
add ebx, edx
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor eax, eax
mov qword [rsp + 0x28], rax
lea r8, [0x140001b00]
lea r9d, [rax + 1]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r8, qword [rsp + 0xc0]
mov eax, ebp
imul ebx, esi
mov ecx, r15d
imul eax, r8d
imul ebp, r8d
imul r15d, dword [rsp + 0xd8]
imul eax, r14d
imul ebp, r14d
lea eax, [rax + rax*2]
lea edx, [rax*8 - 2]
lea eax, [r12 + r12]
imul ecx, r13d
imul ecx, dword [rsp + 0xd8]
dec ecx
imul ecx, r12d
add edx, ecx
mov ecx, dword [rsp + 0x70]
sub ecx, eax
lea eax, [r12 + 6]
sub ecx, esi
add eax, ebp
add ecx, 0xf
imul eax, r12d
imul ecx, ecx
imul ecx, edx
sub ecx, eax
lea eax, [r13*2]
sub ecx, r15d
add eax, r13d
sub ecx, ebx
mov rbx, qword [rsp + 0xd0]
add ecx, eax
lea eax, [rdi - 5]
sub ecx, edx
add eax, ecx
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret