Function at 0x1400909c0
Capabilities:
Create thread
Query environment variable

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov byte [rsp + 8], cl
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
movzx esi, r9b
mov rbp, r8
movzx edi, cl
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov r12d, dword [rsp + 0xc8]
xor r15d, r15d
mov r14, rax
mov qword [rsp + 0xc0], rax
mov r13d, esi
cmp r12d, esi
je 0x140090aa5
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
movsx rdi, dil
mov ecx, r14d
shl edi, 2
mov ebx, eax
imul ecx, r12d
sub edi, ecx
lea ecx, [rsi*8]
add ecx, esi
sub edi, ecx
add edi, ebp
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x48], r15
movsxd rax, edi
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], ebx
lea r8, str.legal
lea rdx, str.c1a2
mov r9d, edi
mov ecx, esi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_CreateWindowExA]
movzx edi, byte [rsp + 0xa0]
cmp sil, r12b
jne 0x140090abb
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
xor ecx, ecx
mov edx, 0x2f0
lea r8d, [rcx + 2]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rbx, rax
mov qword [rsp + 0xa8], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
cmp sil, r12b
jae 0x140090b35
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x48], r15
movsx rcx, dil
movsx r9d, dil
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], r9d
lea r8, str.c1a0
lea rdx, str.c1a0
mov ecx, r12d
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea eax, [rbx + rbx*2]
movsx r15, dil
lea r14d, [r13*4]
add eax, eax
mov ecx, r15d
lea ebx, [r12 - 2]
sub ecx, eax
mov eax, dword [rsp + 0xa8]
lea esi, [r12 - 0xd]
sub ecx, r14d
lea r8, [0x140001b00]
xor edx, edx
imul eax, ebp
sub ecx, ebp
shl eax, 4
lea ebp, [r15 + r15*8]
add ebx, ecx
shl ebp, 2
xor ecx, ecx
sub ebp, eax
xor eax, eax
add sil, dil
mov qword [rsp + 0x28], rax
lea r9d, [rax + 0x10]
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, 0x3b
xor ecx, ecx
lea r8d, [rdx - 0x1e]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r10, qword [rsp + 0xc0]
movsx edx, byte [rsp + 0xa0]
imul r14d, dword [rsp + 0xb0]
mov r9, rax
mov rax, qword [rsp + 0xa8]
lea ecx, [r12 + r12*8]
add edx, 0xffffffee
movsx r8d, sil
imul r8d, ebx
mov rbx, qword [rsp + 0xb8]
add r8d, ecx
mov ecx, edi
sub ecx, r9d
sub r8d, r13d
sub r8d, r10d
add r8d, eax
add r8d, edx
imul r9d, edi
sub ecx, r8d
add ecx, ebp
add ecx, r10d
imul eax, r12d
imul eax, eax, 0x36
inc eax
add ecx, eax
movsx rax, sil
imul ecx, r10d
sub eax, ecx
sub eax, r9d
sub eax, r14d
sub eax, r8d
sub eax, ebp
add eax, 0xffffffe7
add eax, r15d
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret