Function at 0x140068280
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1e0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
movzx edi, r8b
mov al, 7
mov qword [rsp + 0x80], rdx
mov r13d, ecx
imul dil
movzx ebx, al
add bl, byte [rdx + 0x14]
add bl, cl
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rbp, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
movzx r8d, bl
mov r15, rax
add eax, 0xffffffc0
mov ecx, r8d
mov dword [rsp + 0x74], r8d
lea esi, [r13 + 0xa]
lea r14d, [rbp*4]
imul ecx, r15d
add sil, bl
add r14d, ebp
mov r12d, edi
movsx rdx, sil
movsx ebx, sil
add r12d, r12d
sub r14d, edx
add edx, 0xffffffdb
mov r9d, ebx
add r14d, eax
mov eax, r12d
mov dword [rsp + 0x70], r12d
mov dword [rsp + 0x64], r14d
mov dword [rsp + 0x78], ebx
imul eax, r13d
sub eax, ecx
xor ecx, ecx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x38], r8d
add eax, edx
mov dword [rsp + 0x30], r13d
lea r8, [0x1400ed3b4]
lea rdx, str.spite
mov ecx, 0x20
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea edi, [rax + rax*4]
mov eax, dword [rsp + 0x60]
sub eax, edi
mov dword [rsp + 0x6c], eax
cmp sil, 0x20
jg 0x1400683c3
mov edx, 0x68
xor ecx, ecx
lea r8d, [rdx - 0x66]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x90]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x90]
lea rcx, str.c1a5
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov eax, ebx
mov ebx, r12d
imul eax, ebp
sub ebx, eax
mov rax, qword [rsp + 0x80]
sub ebx, dword [rax + 0x20]
sub ebx, dword [rsp + 0x60]
add ebx, r13d
add ebx, r14d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
xor ecx, ecx
lea r8d, [rcx + 0xe]
mov edx, 0x135
mov dword [rsp + 0x68], eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, str.c0ret
mov qword [rsp + 0x88], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rsi, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor ecx, ecx
mov edx, 0x34f
lea r8d, [rcx + 0xf]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
movzx r12d, bpl
mov r14, rax
mov eax, dword [rsp + 0x64]
sub r12b, r15b
cmp dword [rsp + 0x68], eax
jb 0x140068467
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov eax, dword [rsp + 0x64]
imul edi, dword [rsp + 0x6c]
imul esi, dword [rsp + 0x88]
mov ecx, dword [rsp + 0x78]
mov edx, dword [rsp + 0x68]
add ecx, ecx
sub ecx, esi
imul edi, dword [rsp + 0x60]
imul r14d, ebp
imul ebp, r15d
lea edx, [rdx + rcx*4]
imul edi, eax
movsx eax, r12b
imul eax, r15d
lea ecx, [rdi + rdx*4]
sub ecx, r14d
add ecx, eax
sub ecx, ebp
imul eax, dword [rsp + 0x74], 7
sub ecx, eax
mov rax, qword [rsp + 0x80]
add ecx, dword [rax + 0x18]
lea eax, [r13 - 0x11]
sub ecx, dword [rsp + 0x70]
sub ecx, ebx
add eax, ecx
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x238]
add rsp, 0x1e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret