Function at 0x140097820
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1f0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
mov rsi, qword [rsp + 0x240]
movsx r15d, dl
mov qword [rsp + 0x38], rcx
mov eax, r15d
mov r13d, r15d
lea rcx, [rsp + 0xd0]
mov edx, 0x104
mov rbp, r9
mov qword [rsp + 0x40], r9
imul eax, r8d
imul r13d, esi
sub eax, esi
mov qword [rsp + 0x30], r8
mov byte [rsp + 0x20], r15b
mov r14d, r15d
mov dword [rsp + 0x5c], r13d
mov dword [rsp + 0x24], eax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov r12, rax
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
movsxd rdi, eax
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
lea rcx, [rsp + 0xd0]
mov edx, 0x104
movzx ebx, ax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
lea r8d, [rcx + 0xf]
mov edx, 0x17c
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
lea rdx, str.c1ret
mov r9d, ebx
mov r8, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
xor ecx, ecx
mov edx, 0x344
lea r8d, [rcx + 0x19]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0xd0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor ecx, ecx
mov edx, 0x17d
lea r8d, [rcx + 9]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0x68], rax
lea eax, [rsi + rsi*4]
add eax, eax
sub r13d, eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rdx, qword [rbp + 0x30]
mov r8, rax
mov qword [rsp + 0x48], rax
or rcx, 0xffffffffffffffff
inc rcx
cmp byte [rdx + rcx], 0
jne 0x140097966
movzx eax, r15b
mov edx, 0x1de
imul cl
movzx ecx, sil
movzx edi, al
shl cl, 2
movzx eax, r15b
sub dil, r12b
imul byte [rbp]
movzx ebx, al
sub bl, cl
xor ecx, ecx
sub bl, byte [rsp + 0x5c]
sub bl, dil
add bl, r8b
lea r8d, [rcx + 1]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x267
lea r8d, [rcx + 0xe]
mov qword [rsp + 0x98], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
movsx r12, dil
mov ebp, 2
sub ebp, r12d
add ebp, ebp
sub ebp, dword [rsp + 0x28]
sub ebp, esi
add ebp, r14d
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
lea r8d, [rcx + 0x1d]
mov edx, 0x162
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
mov r15, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r8, qword [rsp + 0x38]
movzx r14d, bl
mov qword [r8], rax
mov rax, qword [rsp + 0x48]
movsx ebx, dil
mov rdi, qword [rsp + 0x240]
mov ecx, r15d
lea esi, [r14 + r14*2]
imul ebx, eax
imul ecx, eax
mov rax, qword [rsp + 0x40]
add ecx, 2
mov eax, dword [rax + 8]
add esi, esi
imul ecx, edi
imul eax, dword [rsp + 0x30]
add ecx, eax
mov eax, esi
imul eax, dword [rsp + 0x98]
add ecx, eax
imul eax, r13d, 7
add ecx, eax
mov eax, dword [rsp + 0x24]
lea eax, [rax + rax*4]
sub ecx, eax
movsx eax, byte [rsp + 0x20]
sub ecx, dword [rsp + 0x28]
add eax, 0xfffffffe
add ecx, ebx
add eax, ecx
lea rcx, str.tourist
mov dword [r8 + 8], eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, r15
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov r10, qword [rsp + 0x28]
movsx r8d, byte [rsp + 0x20]
mov qword [r9 + 0x10], rax
mov eax, dword [rcx + 0x10]
imul r10d, edi
mov r11, qword [rsp + 0x48]
imul eax, r8d
mov edx, r8d
mov r8, qword [rsp + 0x30]
mov qword [r9 + 0x28], rdi
mov qword [r9 + 0x40], r15
imul eax, r8d
dec eax
imul eax, edi
sub eax, dword [rsp + 0x68]
add eax, 0x12
add eax, r10d
add eax, esi
add eax, ebx
add eax, r15d
add eax, r11d
add eax, ebp
mov dword [r9 + 0x18], eax
lea rax, str.patio
mov qword [r9 + 0x20], rax
lea rax, str.c8a0
mov qword [r9 + 0x30], rax
mov eax, dword [rcx + 0x18]
mov ecx, r15d
imul ecx, r11d
imul eax, edi
imul eax, r8d
sub ecx, eax
mov eax, dword [rsp + 0x24]
lea eax, [rax + rax*4]
add eax, eax
sub ecx, eax
lea eax, [rdi + 0xd]
sub ecx, r14d
sub ecx, r13d
add ecx, r10d
add ecx, edx
add ecx, r11d
add ecx, r12d
add eax, ecx
mov dword [r9 + 0x38], eax
mov rax, r9
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret