Function at 0x1400811e0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x400
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x3f0], rax
mov ebx, r8d
mov esi, r9d
mov r12, rdx
mov rbp, rcx
mov qword [rsp + 0x58], rcx
mov dword [rsp + 0x48], ebx
cmp r9d, r8d
jb 0x140081247
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x1d0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
lea rcx, [rsp + 0x1d0]
mov edx, 0x104
movzx edi, ax
mov dword [rsp + 0x40], edi
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov ecx, 0xffff
mov r14, rax
mov qword [rsp + 0x60], rax
mov eax, r12d
imul eax, r14d
mov dword [rsp + 0x44], eax
add edi, eax
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
lea rcx, [rsp + 0x2e0]
mov edx, 0x104
mov dword [rsp + 0x50], eax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov ecx, r12d
imul ecx, ebp
mov r15d, esi
mov r13, rax
imul r15d, r14d
mov r14d, r12d
imul r15d, edi
add r15d, ecx
sub r14d, r15d
add r14d, eax
add r14d, dword [rsp + 0x50]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0x68], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebp, esi
imul ebp, dword [rsp + 0x58]
mov ecx, esi
imul ebp, r13d
dec ebp
imul ebp, r12d
mov dword [rsp + 0x78], ebp
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov eax, dword [rsp + 0x68]
inc eax
imul eax, r12d
sub eax, 4
mov dword [rsp + 0x4c], eax
cmp r14d, ebx
jg 0x140081320
lea rcx, [rsp + 0x90]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r8d, dword [rsp + 0x40]
cmp r8d, esi
ja 0x1400813bf
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor eax, eax
lea r8, [0x140001b00]
mov qword [rsp + 0x28], rax
mov r9, rsi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
lea r8d, [rcx + 0xf]
mov edx, 0x222
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rbx, qword [rsp + 0x60]
mov dword [rsp + 0x30], r14d
mov rcx, rbx
xor r9d, r9d
mov r8, r13
mov rdx, r13
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
lea rcx, [rsp + 0x90]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x90]
lea rcx, str.c9a0
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov r8d, dword [rsp + 0x40]
jmp 0x1400813c4
mov rbx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
movzx edi, byte [rsp + 0x78]
movzx eax, r12b
sub dil, r14b
add al, al
lea ecx, [r14 + 1]
shl dil, 2
sub dil, al
mov eax, dword [rsp + 0x44]
sub dil, sil
add eax, r8d
sub dil, r15b
sub dil, bl
add dil, 5
add dil, al
movzx eax, r12b
add dil, dl
add dl, 0xd
imul cl
movzx ecx, byte [rsp + 0x4c]
movzx ebx, al
shl cl, 2
sub bl, cl
sub bl, byte [rsp + 0x48]
sub bl, sil
add bl, r8b
add bl, dl
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r11d, dword [rsp + 0x44]
mov r8d, dword [rsp + 0x4c]
mov r10d, dword [rsp + 0x40]
mov edx, r12d
imul edx, r14d
lea ecx, [r8*4]
lea r9d, [r11 + r10]
sub edx, ecx
movzx ecx, bl
imul ecx, eax
imul edx, r12d
mov eax, r11d
imul eax, r9d
lea edx, [rdx*4 + 0xf88]
sub edx, ecx
imul eax, dword [rsp + 0x48]
sub edx, eax
mov eax, dword [rsp + 0x50]
imul eax, r9d
add edx, eax
movzx eax, dil
sub edx, eax
mov rax, qword [rsp + 0x58]
sub edx, r11d
sub edx, dword [rsp + 0x68]
sub edx, r10d
add edx, esi
add edx, eax
add eax, edx
add eax, r8d
add eax, ebp
add eax, r13d
add eax, r15d
add eax, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x3f0]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x450]
add rsp, 0x400
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret