Function at 0x1400bab40
Capabilities:
Create thread

Disassembly:
push rbp
push rsi
push r14
push r15
sub rsp, 0x1b8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, 0xffff
mov r15, rax
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
movsxd r14, eax
mov ebp, 5
mov esi, 8
sub ebp, r14d
mov dword [rsp + 0x6c], r14d
add ebp, ebp
sub ebp, r15d
sub esi, ebp
mov dword [rsp + 0x64], ebp
lea eax, [rsi + 4]
mov dword [rsp + 0x68], esi
movsx ecx, al
mov byte [rsp + 0x60], al
mov dword [rsp + 0x70], ecx
cmp r14d, ecx
jg 0x1400bae26
mov qword [rsp + 0x1e0], rbx
mov qword [rsp + 0x1e8], rdi
mov qword [rsp + 0x1f0], r12
mov qword [rsp + 0x1b0], r13
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor r8d, r8d
mov edx, 0x156
xor ecx, ecx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea r8, [0x140001b00]
mov r9, r14
mov rbx, rax
mov qword [rsp + 0x88], rax
xor eax, eax
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea ecx, [r14*8]
lea r14d, [rbx + 0xa]
mov edx, 0x333
sub ecx, esi
mov qword [rsp + 0x80], rax
sub ecx, ebp
add ecx, eax
add r14d, ecx
xor ecx, ecx
lea r8d, [rcx + 2]
mov dword [rsp + 0x74], r14d
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x2bb
lea r8d, [rcx + 0x1d]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x338
lea r8d, [rcx + 0x13]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rcx, [rsp + 0x90]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov ecx, 4
mov rsi, rax
sub ecx, edi
movzx eax, r15b
sub ecx, r15d
sub ecx, ebp
imul cl
movzx ecx, al
movzx eax, sil
imul cl
movzx r12d, al
movzx eax, r14b
shl r12b, 3
imul bl
add r12b, al
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
movsx r13d, dil
mov ebp, r13d
mov r15d, esi
imul ebp, dword [rsp + 0x78]
imul r15d, eax
add ebp, 6
add ebp, r15d
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, 1
mov rdx, rax
sub cl, dil
movzx eax, sil
imul cl
movzx edi, al
mov eax, dword [rsp + 0x6c]
mov r9, qword [rsp + 0x78]
movsx r8, byte [rsp + 0x60]
movzx ecx, r8b
sub dl, 6
shl cl, 2
sub dil, cl
sub dil, al
sub dil, bl
add dil, r14b
add dil, r9b
add dil, dl
mov edx, dword [rsp + 0x64]
imul dl
add edx, 0x10
movzx ecx, al
movzx eax, r9b
imul cl
movzx ecx, al
add cl, cl
lea r14d, [rcx + rax]
lea ecx, [r9 + r8]
shl r14b, 3
sub r14b, bpl
lea ebp, [rcx + r15*8]
sub r14b, byte [rsp + 0x68]
add ebp, edx
sub r14b, r12b
add r14b, 4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [rsp + 0x74]
mov esi, eax
mov eax, dword [rsp + 0x70]
movzx ecx, r14b
movzx edi, dil
add ebx, 9
imul edx, ecx, 0xfffffffe
imul eax, dword [rsp + 0x80]
imul eax, dword [rsp + 0x88]
sub edx, eax
sub edx, edi
add ebx, edx
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor eax, eax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
movzx ecx, r14b
lea r8, str.whirlpool
lea rdx, str.c1a0
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], ebx
mov r9d, ebp
mov ecx, esi
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], edi
call qword [sym.imp.USER32.dll_CreateWindowExA]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
mov ebp, dword [rsp + 0x64]
mov esi, dword [rsp + 0x68]
mov r14d, dword [rsp + 0x6c]
mov r15, qword [rsp + 0x78]
mov r13, qword [rsp + 0x1b0]
mov r12, qword [rsp + 0x1f0]
mov rdi, qword [rsp + 0x1e8]
mov rbx, qword [rsp + 0x1e0]
movzx eax, r15b
sub sil, 2
imul r14b
movzx ecx, al
add cl, cl
add al, cl
add al, al
sub al, bpl
sub al, byte [rsp + 0x60]
add al, sil
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x1b8
pop r15
pop r14
pop rsi
pop rbp
ret