Function at 0x140078f20
Capabilities:
Create thread
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x348
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x330], rax
mov rax, qword [rsp + 0x3b8]
mov rbp, qword [rsp + 0x3b0]
mov r13d, ecx
mov edi, edx
mov dword [rsp + 0x64], edx
lea rcx, [rsp + 0x220]
mov edx, 0x104
mov qword [rsp + 0xa0], rax
mov rsi, r9
mov dword [rsp + 0x6c], r8d
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
or rbx, 0xffffffffffffffff
mov qword [rsp + 0xe0], rax
mov r14, rbx
inc r14
cmp byte [rsi + r14], 0
jne 0x140078f91
mov eax, r13d
sub eax, edi
add r14d, eax
mov dword [rsp + 0xe8], r14d
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor ecx, ecx
mov edi, r13d
sub edi, dword [rsp + 0x3c0]
lea r8d, [rcx + 8]
mov edx, 0x1a6
mov dword [rsp + 0x90], edi
mov qword [rsp + 0xf8], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r15d, dword [rsp + 0xe0]
mov r12, rax
mov qword [rsp + 0xa8], rax
sub r15d, edi
mov rdi, rbx
inc r15d
add r15d, eax
mov dword [rsp + 0x84], r15d
nop dword [rax + rax]
inc rdi
cmp byte [rdi + rbp], 0
jne 0x140079010
mov rcx, qword [rsp + 0xa0]
imul edi, dword [rcx + 0x20]
imul edi, r13d
add edi, eax
mov eax, dword [rsp + 0x6c]
add edi, r15d
imul eax, r12d
add eax, 5
add eax, r13d
add eax, r15d
mov dword [rsp + 0x68], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
mov edx, eax
mov dword [rsp + 0x78], eax
inc rcx
cmp byte [rcx + rbp], 0
jne 0x140079052
lea eax, [r15 + r15*2]
mov r8d, r13d
add eax, eax
sub r8d, eax
mov eax, edx
mov edx, dword [rsp + 0x64]
sub r8d, ecx
imul eax, dword [rsp + 0x68]
mov dword [rsp + 0x8c], r8d
imul eax, edi
add eax, r8d
imul edx, r13d
mov dword [rsp + 0x94], eax
imul eax, r8d
sub edx, eax
mov rax, qword [rsp + 0xa0]
mov eax, dword [rax]
lea ecx, [rax + rax*2]
lea eax, [rdx + rcx*2]
xor ecx, ecx
mov edx, 0x272
sub eax, dword [rsp + 0x68]
lea r8d, [rcx + 0xe]
sub eax, edi
sub eax, r15d
dec eax
mov dword [rsp + 0x88], eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0xc8], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
lea r8d, [rcx + 1]
mov edx, 0x318
mov qword [rsp + 0xb0], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r9d, dword [rsp + 0x6c]
xor eax, eax
mov qword [rsp + 0x28], rax
lea r8, [0x140001b00]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
mov edx, 0x1c2
lea r8d, [rcx + 0x15]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, 0xffff
mov qword [rsp + 0xd0], rax
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
mov r15, rbx
mov dword [rsp + 0x98], eax
nop dword [rax]
inc r15
cmp byte [rsi + r15], 0
jne 0x140079140
mov eax, dword [rsp + 0x8c]
mov ecx, 0xfffffffd
sub ecx, r12d
mov r12d, dword [rsp + 0x6c]
imul eax, dword [rsp + 0x78]
add ecx, ecx
sub ecx, eax
mov eax, dword [rsp + 0x64]
sub ecx, r12d
sub ecx, edi
add eax, ecx
add r15d, eax
mov rax, rbx
add r15d, r13d
nop dword [rax + rax]
inc rax
cmp byte [rax + rbp], 0
jne 0x140079180
mov ecx, dword [rsp + 0x94]
imul eax, r13d
mov edx, 0x104
imul eax, dword [rsp + 0x90]
add ecx, 5
imul eax, dword [rsp + 0x3c0]
sub eax, edi
sub eax, dword [rsp + 0x84]
add eax, ecx
lea rcx, [rsp + 0x110]
mov dword [rsp + 0x70], eax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov qword [rsp + 0xb8], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, rbx
mov dword [rsp + 0x80], eax
movzx eax, byte [rsp + 0x78]
imul byte [rsp + 0x8c]
movzx edx, al
mov byte [rsp + 0x60], al
inc rcx
cmp byte [rsi + rcx], 0
jne 0x1400791f4
movzx eax, r12b
movzx r12d, dl
lea r8, [0x140001b00]
xor edx, edx
imul cl
movzx ecx, al
movzx eax, byte [rsp + 0xf8]
imul cl
xor ecx, ecx
sub r12b, al
movzx eax, byte [rsp + 0xc8]
imul byte [rsp + 0x70]
sub r12b, al
xor eax, eax
sub r12b, byte [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea r9d, [rax + 8]
sub r12b, byte [rsp + 0xa8]
mov dword [rsp + 0x20], eax
add r12b, 3
add r12b, byte [rsp + 0x90]
add r12b, r13b
add r12b, byte [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0xc0], rax
cmp r15d, dword [rsp + 0x80]
jl 0x140079294
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x110]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov rcx, rax
mov qword [rsp + 0x78], rax
movsx eax, r12b
cmp dword [rsp + 0x80], eax
jne 0x140079322
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
xor ecx, ecx
mov edx, 0x23c
lea r8d, [rcx + 0xa]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
movsxd r9, dword [rsp + 0x64]
xor eax, eax
mov qword [rsp + 0x28], rax
lea r8, [0x140001b00]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
mov edx, 0x375
lea r8d, [rcx + 0x1c]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rcx, qword [rsp + 0x78]
mov edx, dword [rsp + 0x68]
dec r14d
xor r8d, r8d
mov qword [rsp + 0x58], r8
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x48], r8
imul r14d, dword [rsp + 0xa8]
mov eax, edx
mov r9d, edx
lea r8, [0x1400ee534]
imul eax, dword [rsp + 0x84]
sub r14d, eax
mov rax, qword [rsp + 0xb0]
imul eax, dword [rsp + 0xb8]
add r14d, eax
lea eax, [rcx + rcx*4]
mov ecx, dword [rsp + 0x70]
mov qword [rsp + 0x40], rcx
shl eax, 2
mov dword [rsp + 0x38], r15d
sub r14d, eax
mov dword [rsp + 0x30], edx
movsx eax, r12b
sub r14d, eax
mov eax, dword [rsp + 0x8c]
lea rdx, str.hail
sub r14d, dword [rsp + 0x64]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 8
sub r14d, dword [rsp + 0x88]
sub r14d, dword [rsp + 0x3c0]
add r14d, r13d
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov r11, qword [rsp + 0x78]
shl r11b, 2
mov qword [rsp + 0xb0], rax
mov r9, rbx
mov qword [rsp + 0x78], r11
inc r9
cmp byte [r9 + rbp], 0
jne 0x1400793e1
mov rcx, qword [rsp + 0xa0]
movzx eax, byte [rsp + 0xe8]
mov r10, qword [rsp + 0xa8]
imul byte [rcx + 0x18]
movzx ecx, byte [rsp + 0xc0]
movzx edx, al
movzx eax, r10b
inc cl
imul cl
movzx r8d, al
mov rax, rbx
sub r8b, dl
sub r8b, r11b
mov r11d, dword [rsp + 0x90]
sub r8b, r14b
mov r14d, dword [rsp + 0x68]
sub r8b, dil
add r8b, byte [rsp + 0x94]
add r8b, byte [rsp + 0x98]
add r8b, byte [rsp + 0x88]
add r8b, r14b
add r8b, r11b
add r8b, byte [rsp + 0x70]
add r8b, r13b
sub r8b, r9b
inc rax
cmp byte [rsi + rax], 0
jne 0x140079462
add r8b, al
mov rcx, rbx
inc rcx
cmp byte [rcx + rbp], 0
jne 0x140079471
mov rax, qword [rsp + 0xa0]
movzx eax, byte [rax + 0x10]
imul cl
movzx edx, al
movzx eax, r11b
imul byte [rsp + 0xe8]
movzx ecx, al
movzx eax, r10b
add cl, cl
add cl, byte [rsp + 0x78]
imul cl
movzx ecx, al
movzx eax, byte [rsp + 0x6c]
imul byte [rsp + 0x64]
movzx r9d, al
movzx eax, byte [rsp + 0x70]
sub r9b, cl
sub r9b, dl
imul r15b
sub r9b, al
movzx eax, byte [rsp + 0xc8]
imul byte [rsp + 0x88]
add r9b, al
mov al, 0x41
imul r8b
sub r9b, al
sub r9b, byte [rsp + 0x94]
sub r9b, byte [rsp + 0x80]
sub r9b, byte [rsp + 0x98]
sub r9b, byte [rsp + 0x3c0]
sub r9b, byte [rsp + 0xc0]
sub r9b, 0x69
add r9b, byte [rsp + 0x60]
add r9b, dil
add r9b, r14b
add r9b, byte [rsp + 0x84]
add r9b, r13b
add r9b, byte [rsp + 0xb0]
add r9b, byte [rsp + 0xd0]
add r9b, byte [rsp + 0xb8]
add r9b, r12b
nop dword [rax]
cmp byte [rsi + rbx + 1], 0
lea rbx, [rbx + 1]
jne 0x140079540
lea eax, [rbx + r9]
mov rcx, qword [rsp + 0x330]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x348
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret