Function at 0x14006fd10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x168]
sub rsp, 0x268
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x150], rax
movsx rax, dl
or rsi, 0xffffffffffffffff
mov rbx, rcx
mov byte [rsp + 0x30], al
mov r15, rax
mov qword [rsp + 0x38], rax
mov rdi, rsi
inc rdi
cmp byte [rcx + rdi], 0
jne 0x14006fd53
imul edi, r15d
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [rsp + 0x68], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov r14, rax
mov qword [rsp + 0x78], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rbp - 0x78], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rbp + 0x40]
mov edx, 0x104
mov qword [rbp - 0x80], rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov eax, r14d
mov r14, rsi
imul eax, edi
mov dword [rsp + 0x64], eax
nop
inc r14
cmp byte [rbx + r14], 0
jne 0x14006fdc0
imul r14d, r15d
add r14d, eax
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x50], rax
cmp dil, 0x20
je 0x140070185
mov qword [rsp + 0x2b0], r12
mov rcx, rsi
mov qword [rsp + 0x260], r13
nop dword [rax]
inc rcx
cmp byte [rbx + rcx], 0
jne 0x14006fe00
movzx eax, r14b
mov r12, rsi
imul cl
movzx ecx, al
movzx eax, dil
imul cl
mov byte [rsp + 0x31], al
nop
inc r12
cmp byte [rbx + r12], 0
jne 0x14006fe20
sub r12b, 0xb
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
lea r13d, [r12 + 3]
add r13b, r13b
movzx r15d, ax
sub r13b, al
add r13b, byte [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rcx, rsi
mov rdx, rax
mov qword [rsp + 0x48], rax
imul r8d, eax, 7
mov dword [rsp + 0x34], r8d
nop dword [rax]
inc rcx
cmp byte [rbx + rcx], 0
jne 0x14006fe70
movzx eax, byte [rsp + 0x30]
mov r9, qword [rsp + 0x78]
imul cl
movzx ecx, al
movzx eax, r9b
imul cl
movzx ecx, al
movzx eax, r12b
imul cl
movzx ecx, al
movzx eax, r15b
imul dl
add cl, al
movzx eax, r15b
mov r15, rsi
sub cl, r8b
mov dword [rsp + 0x60], eax
add cl, 2
mov byte [rsp + 0x30], cl
nop word [rax + rax]
inc r15
cmp byte [rbx + r15], 0
jne 0x14006fec0
imul eax, dword [rsp + 0x40]
xor ecx, ecx
imul eax, dword [rsp + 0x50]
lea eax, [rax + rax*8]
shl eax, 6
add eax, edx
mov edx, 0x311
add r15d, eax
add r15d, r8d
lea r8d, [rcx + 0x14]
add r15d, dword [rsp + 0x38]
add r15d, r9d
add r15d, edi
call qword [sym.imp.KERNEL32.dll_FindResourceA]
movzx ecx, byte [rsp + 0x31]
mov rdi, rsi
inc rdi
cmp byte [rbx + rdi], 0
jne 0x14006ff06
imul edi, dword [rsp + 0x38]
mov eax, dword [rsp + 0x48]
imul eax, dword [rsp + 0x34]
add edi, eax
lea eax, [rcx + rcx*8]
shl eax, 6
add edi, eax
sub edi, dword [rsp + 0x68]
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
lea r8d, [rcx + 0x13]
mov edx, 0x17e
mov qword [rbp - 0x70], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r8, qword [rsp + 0x48]
lea rcx, str.c1a0
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x60]
xor r9d, r9d
mov rdx, rax
mov qword [rsp + 0x58], rax
call fcn.1400dceb0
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rbp - 0x10], xmm0
movaps xmmword [rbp], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmm1, xmmword [rax + 0x30]
movaps xmmword [rbp + 0x10], xmm0
movaps xmmword [rbp + 0x20], xmm1
movsd xmm0, qword [rax + 0x40]
movsd qword [rbp + 0x30], xmm0
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r8, rsi
mov r9, rax
mov qword [rsp + 0x70], rax
inc r8
cmp byte [rbx + r8], 0
jne 0x14006ffa5
imul ecx, dword [rsp + 0x34], 0x23
mov rdx, qword [rsp + 0x48]
lea eax, [rdx + rdx*2]
add edx, 5
sub ecx, eax
mov rax, qword [rsp + 0x38]
sub ecx, dword [rsp + 0x40]
add eax, 2
add ecx, dword [rbp + 0x18]
add r8d, ecx
lea rcx, [rbp + 0x40]
add r8d, dword [rsp + 0x58]
add r8d, dword [rbp - 0x70]
add eax, r8d
imul eax, dword [rsp + 0x50]
sub eax, r9d
add eax, edx
mov edx, 0x104
mov dword [rsp + 0x34], eax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
movsx rdx, byte [rsp + 0x30]
mov r8, rax
movzx r12d, r12b
mov rcx, rsi
nop dword [rax]
inc rcx
cmp byte [rbx + rcx], 0
jne 0x140070010
movsx eax, r13b
add eax, eax
sub eax, r8d
mov r8, qword [rbp - 0x78]
sub eax, dword [rsp + 0x58]
sub eax, dword [rsp + 0x40]
sub eax, r15d
add eax, r8d
add ecx, eax
movzx eax, byte [rsp + 0x31]
add ecx, r12d
add ecx, eax
lea eax, [rdx + 0xb]
add ecx, dword [rsp + 0x64]
add ecx, dword [rsp + 0x34]
add eax, ecx
mov dword [rbp - 0x60], eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rdx, rsi
mov qword [rbp - 0x58], rax
lea rax, str.c1a0
mov qword [rbp - 0x50], rax
nop dword [rax + rax]
inc rdx
cmp byte [rbx + rdx], 0
jne 0x140070070
mov eax, dword [rbp + 0x30]
mov r11, qword [rsp + 0x58]
imul edx, dword [rsp + 0x38]
mov r9, qword [rsp + 0x40]
mov r8, qword [rsp + 0x48]
movsx r10, byte [rsp + 0x30]
imul eax, r11d
imul r12d, r9d
lea ecx, [r12 + r12*8]
movzx r12d, byte [rsp + 0x31]
mov qword [rbp - 0x38], r11
shl ecx, 2
mov qword [rbp - 0x30], r8
sub ecx, eax
shl ecx, 2
imul eax, dword [rsp + 0x50], 0x3f
sub ecx, eax
lea eax, [rcx + rdx]
sub eax, dword [rsp + 0x70]
sub eax, dword [rsp + 0x68]
sub eax, r8d
sub eax, r10d
add eax, 0xfffffffb
add eax, dword [rbp - 0x80]
add eax, r12d
add eax, dword [rsp + 0x60]
add eax, edi
mov dword [rbp - 0x48], eax
lea rax, str.observatory
mov qword [rbp - 0x40], rax
nop dword [rax]
inc rsi
cmp byte [rbx + rsi], 0
jne 0x1400700f0
mov eax, dword [rbp + 8]
imul esi, dword [rsp + 0x38]
movaps xmm0, xmmword [rbp - 0x60]
movaps xmm1, xmmword [rbp - 0x50]
shl r14d, 6
movaps xmmword [rbp - 0x10], xmm0
lea ecx, [rax + rax*4]
sub r9d, r14d
movsx rax, r13b
add r9d, 0xfffffffd
movaps xmm0, xmmword [rbp - 0x40]
movaps xmmword [rbp], xmm1
lea edx, [rsi + r9*2]
lea r9, str.c7a3
add edx, ecx
lea rcx, [rbp - 0x60]
movaps xmmword [rbp + 0x10], xmm0
add edx, eax
sub edx, r12d
sub edx, r10d
sub edx, dword [rsp + 0x78]
add edx, dword [rsp + 0x70]
add edx, dword [rsp + 0x34]
add edx, dword [rsp + 0x68]
add edx, r8d
lea r8, str.cattle
add edx, r15d
mov dword [rbp - 0x28], edx
lea rdx, [rbp - 0x10]
movaps xmm1, xmmword [rbp - 0x30]
movaps xmmword [rbp + 0x20], xmm1
call fcn.1400db620
mov r13, qword [rsp + 0x260]
mov r12, qword [rsp + 0x2b0]
xor ecx, ecx
mov edx, 0x28a
lea r8d, [rcx + 0xe]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov edx, 0x86
xor ecx, ecx
lea r8d, [rdx - 0x77]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rax, str.c1a0
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x268
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret