Function at 0x1400b2b70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x360
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x350], rax
or r14, 0xffffffffffffffff
mov rdi, r9
mov qword [rsp + 0x80], r9
mov rsi, r8
mov rbx, rdx
mov qword [rsp + 0x78], rcx
mov rax, r14
inc rax
cmp byte [r8 + rax], 0
jne 0x1400b2bb6
mov ecx, r9d
sub ecx, eax
mov rax, r14
nop dword [rax + rax]
inc rax
cmp byte [rdx + rax], 0
jne 0x1400b2bd0
add ecx, eax
mov dword [rsp + 0xf0], ecx
mov dword [rsp + 0x108], ecx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbp, r14
inc rbp
cmp byte [rbx + rbp], 0
jne 0x1400b2bf2
imul ebp, edi
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
movzx r13d, ax
call qword [sym.imp.USER32.dll_GetActiveWindow]
movzx edx, dil
mov qword [rsp + 0x90], rax
add dl, dl
mov byte [rsp + 0x68], dl
imul byte [rsp + 0x108]
movzx ecx, al
movzx eax, bpl
imul cl
movzx ecx, al
movzx eax, r13b
imul cl
movzx r15d, al
add r15b, r15b
add r15b, dl
cmp r13b, r15b
jb 0x1400b2c54
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x240]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov qword [rsp + 0xf8], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rcx, [rsp + 0x130]
mov edx, 0x104
mov qword [rsp + 0xd8], rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov edx, 0x36
xor ecx, ecx
lea r8d, [rdx - 0x20]
mov qword [rsp + 0xe0], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdi, rax
mov qword [rsp + 0xd0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea r12d, [rax - 4]
mov qword [rsp + 0xe8], rax
add r12b, dil
cmp r12b, bpl
je 0x1400b2cd9
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
mov rcx, rbx
movsxd rdi, ebp
mov dword [rsp + 0x60], eax
movsx rax, r15b
mov qword [rsp + 0x100], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x1400ed4d4]
mov r9, rdi
movsx r8, r15b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
movzx edi, r12b
movzx eax, ax
mov ecx, edi
mov dword [rsp + 0x64], edi
mov dword [rsp + 0xa0], eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
movsxd rax, dword [rsp + 0x60]
xor r8d, r8d
movsx ecx, r15b
movzx edx, r13b
mov qword [rsp + 0x58], r8
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x70], edx
mov dword [rsp + 0x74], ecx
lea r8, str.c0a5
mov ecx, ebp
mov r9d, ebp
mov rdx, rsi
mov dword [rsp + 0x20], edi
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov rdi, r14
mov qword [rsp + 0xa8], rax
inc rdi
cmp byte [rbx + rdi], 0
jne 0x1400b2d93
movzx eax, byte [rsp + 0xd8]
mov r12, qword [rsp + 0x80]
shl al, 2
sub al, r12b
add dil, al
add dil, r13b
movzx eax, dil
mov ecx, eax
mov dword [rsp + 0x6c], eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, r14
mov qword [rsp + 0xb8], rax
inc rcx
cmp byte [rbx + rcx], 0
jne 0x1400b2dd3
mov rax, r14
nop
inc rax
cmp byte [rsi + rax], 0
jne 0x1400b2de0
mov rdx, qword [rsp + 0xd0]
mov r8, qword [rsp + 0xe8]
imul cl
movzx r15d, al
movzx eax, r13b
mov ecx, 0xb
sub cl, r12b
add cl, cl
imul byte [rsp + 0x68]
sub cl, al
movzx eax, dl
add r15b, cl
imul r8b
add r15b, al
add r15b, byte [rsp + 0xe0]
add r15b, byte [rsp + 0x60]
add r15b, dil
mov rdi, r14
inc rdi
cmp byte [rbx + rdi], 0
jne 0x1400b2e32
movzx ecx, byte [rsp + 0x108]
movzx eax, r12b
add dl, 0x20
sub cl, byte [rsp + 0x90]
imul cl
sub al, bpl
add dil, al
add dil, r8b
add dil, dl
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
lea r8d, [rcx + 0x12]
mov edx, 0x308
mov qword [rsp + 0xc0], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x336
movzx r12d, al
lea r8d, [rcx + 0xc]
mov qword [rsp + 0x98], rax
add r12b, r12b
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0xc8], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0x88], rax
cmp r13b, 1
jae 0x1400b2f49
mov rdx, qword [rsp + 0xd0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
lea rcx, [rsp + 0x130]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
movsxd rdx, dword [rsp + 0x60]
mov r13d, dword [rsp + 0x70]
xor eax, eax
movsx ecx, r15b
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x74]
mov qword [rsp + 0x40], rdx
mov dword [rsp + 0x38], ecx
mov ecx, dword [rsp + 0x64]
mov dword [rsp + 0x30], eax
mov r9d, edx
lea r8, str.c4a3
mov rdx, rsi
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 1
call qword [sym.imp.USER32.dll_CreateWindowExA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
jmp 0x1400b2f4e
mov r13d, dword [rsp + 0x70]
mov r9d, dword [rsp + 0x64]
mov r10, qword [rsp + 0xe8]
mov r11, qword [rsp + 0xd0]
mov eax, r13d
mov r13, qword [rsp + 0x80]
lea edx, [r10*4]
imul eax, dword [rsp + 0x90]
add eax, eax
movsx ecx, r12b
mov dword [rsp + 0xb0], eax
mov eax, r9d
movzx edi, dil
imul ecx, dword [rsp + 0x98]
movsx r8, r15b
imul eax, r13d
mov dword [rsp + 0x64], eax
mov eax, edx
imul eax, dword [rsp + 0x60]
add ecx, eax
mov eax, dword [rsp + 0xd8]
imul eax, r11d
add ecx, eax
mov eax, dword [rsp + 0x74]
imul eax, r13d
add ecx, eax
imul eax, dword [rsp + 0xb8], 7
sub ecx, eax
mov rax, qword [rsp + 0x88]
lea eax, [rcx + rax*4]
mov rcx, qword [rsp + 0x78]
sub eax, edi
sub eax, dword [rsp + 0x6c]
sub eax, r10d
mov r10, qword [rsp + 0xc8]
sub eax, dword [rsp + 0xc0]
sub eax, dword [rsp + 0xa8]
add eax, 5
add eax, r13d
add eax, r10d
add eax, dword [rsp + 0x64]
add eax, edx
add eax, dword [rsp + 0xb0]
add eax, r8d
mov dword [rcx], eax
lea eax, [r9*4]
movsx r9, r12b
mov dword [rsp + 0xc8], eax
mov rax, r14
mov qword [rsp + 0x80], r9
nop dword [rax + rax]
inc rax
cmp byte [rsi + rax], 0
jne 0x1400b3040
mov r12, qword [rsp + 0xe8]
mov ecx, r12d
sub ecx, eax
mov eax, dword [rsp + 0x6c]
add ecx, 6
imul eax, dword [rsp + 0xb8]
imul eax, r8d
imul ecx, r13d
mov r8, qword [rsp + 0xc0]
imul eax, eax, 7
add ecx, eax
mov eax, dword [rsp + 0x70]
imul eax, ebp
add ecx, eax
mov eax, dword [rsp + 0x60]
lea eax, [rcx + rax*4]
mov rcx, r14
sub eax, edi
sub eax, dword [rsp + 0xf8]
sub eax, r8d
sub eax, r11d
sub eax, dword [rsp + 0x90]
inc rcx
cmp byte [rbx + rcx], 0
jne 0x1400b30a3
mov rdx, qword [rsp + 0x100]
add eax, edx
add ecx, eax
mov rax, qword [rsp + 0x78]
add ecx, r9d
movsx r9d, r15b
lea r15d, [rdx + rdx]
add ecx, r10d
mov rdx, r14
add ecx, dword [rsp + 0x98]
add ecx, dword [rsp + 0xc8]
add ecx, dword [rsp + 0x88]
add ecx, dword [rsp + 0xa8]
mov dword [rax + 4], ecx
nop dword [rax]
inc rdx
cmp byte [rsi + rdx], 0
jne 0x1400b30f0
mov eax, edi
imul eax, r9d
imul eax, r8d
mov r8d, dword [rsp + 0xa0]
inc eax
imul r8d, dword [rsp + 0x60]
lea eax, [rax + rax*2]
add r8d, r8d
sub r8d, eax
mov eax, dword [rsp + 0x80]
add r8d, dword [rsp + 0x90]
add r8d, r8d
imul eax, r10d
imul ecx, eax, 0x1c
mov eax, dword [rsp + 0x6c]
add ecx, r15d
imul ecx, r13d
sub r8d, ecx
mov ecx, dword [rsp + 0x64]
imul eax, dword [rsp + 0xa8]
add r8d, eax
mov eax, dword [rsp + 0xe0]
imul eax, r11d
add r8d, eax
mov rax, r14
sub r8d, dword [rsp + 0xb8]
sub r8d, dword [rsp + 0x88]
sub r8d, ecx
add r8d, dword [rsp + 0x98]
sub r8d, edx
inc rax
cmp byte [rbx + rax], 0
jne 0x1400b3181
add r8d, eax
mov rax, qword [rsp + 0x78]
imul edi, r9d
mov dword [rax + 8], r8d
mov dword [rsp + 0x64], edi
mov r8, r14
mov qword [rax + 0x10], r12
lea edi, [r10*4]
nop dword [rax]
cmp byte [rbx + r8 + 1], 0
lea r8, [r8 + 1]
jne 0x1400b31b0
mov rax, r14
nop
cmp byte [rsi + rax + 1], 0
lea rax, [rax + 1]
jne 0x1400b31c0
lea edx, [rcx + rax]
mov rax, qword [rsp + 0xd8]
lea ecx, [rdi + 1]
imul eax, r15d
mov r15d, dword [rsp + 0x64]
imul eax, r11d
add ecx, eax
mov eax, dword [rsp + 0x80]
imul ecx, r13d
imul eax, dword [rsp + 0x98]
imul eax, dword [rsp + 0xc0]
lea eax, [rax + rax*2]
shl eax, 2
sub ecx, eax
mov eax, dword [rsp + 0x70]
imul eax, dword [rsp + 0x90]
sub ecx, eax
mov eax, r15d
imul eax, dword [rsp + 0xb8]
sub ecx, eax
mov eax, dword [rsp + 0x6c]
imul eax, dword [rsp + 0xa8]
shl eax, 5
add ecx, eax
mov eax, ebp
imul eax, dword [rsp + 0xf0]
add ecx, eax
lea eax, [rdx + r8]
mov edx, 0x5c71
sub ecx, r12d
mov r8d, 0x3000
sub ecx, r12d
sub ecx, dword [rsp + 0x88]
sub ecx, dword [rsp + 0x60]
add ecx, 0xfffffff4
add eax, ecx
mov rcx, qword [rsp + 0x78]
mov dword [rcx + 0x18], eax
xor ecx, ecx
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rcx, qword [rsp + 0x78]
xor edx, edx
mov qword [rcx + 0x20], rax
mov rcx, rax
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, r14
nop dword [rax]
inc rdx
cmp byte [rbx + rdx], 0
jne 0x1400b32a0
nop dword [rax]
cmp byte [rsi + r14 + 1], 0
lea r14, [r14 + 1]
jne 0x1400b32b0
mov r8d, dword [rsp + 0x74]
mov eax, r12d
add r12d, 0xfffffffa
lea ecx, [r14 + rbp]
imul eax, dword [rsp + 0xa0]
add edx, ecx
mov rcx, qword [rsp + 0x78]
imul eax, dword [rsp + 0x60]
imul r8d, dword [rsp + 0xe0]
lea eax, [rax*4 + 1]
imul eax, r13d
add eax, r8d
sub eax, dword [rsp + 0x80]
sub eax, dword [rsp + 0x98]
sub eax, dword [rsp + 0xc8]
sub eax, dword [rsp + 0x88]
sub eax, dword [rsp + 0xa8]
sub eax, dword [rsp + 0xd0]
sub eax, dword [rsp + 0xb0]
add eax, r15d
add eax, dword [rsp + 0x6c]
add eax, edi
add eax, dword [rsp + 0xb8]
add eax, r12d
add eax, dword [rsp + 0xc0]
add eax, edx
mov dword [rcx + 0x28], eax
mov rax, rcx
mov rcx, qword [rsp + 0x350]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x3a0]
add rsp, 0x360
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret