Function at 0x14009e270
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1a0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x190], rax
movzx r12d, byte [rsp + 0x200]
mov rdi, r9
mov rsi, r8
mov r14, rdx
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rcx
test r12b, r12b
jle 0x14009e2e0
mov rcx, r8
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, r14
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov edx, 0x83
xor ecx, ecx
lea r8d, [rdx - 0x71]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
movzx r15d, r12b
mov ecx, r15d
mov dword [rsp + 0x24], r15d
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
or rbx, 0xffffffffffffffff
mov r13, rax
mov qword [rsp + 0x30], rax
mov rbp, rbx
inc rbp
cmp byte [rdi + rbp], 0
jne 0x14009e301
add bpl, bpl
mov rax, rbx
add bpl, r14b
inc rax
cmp byte [rsi + rax], 0
jne 0x14009e313
sub bpl, al
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
lea r8d, [rcx + 3]
mov edx, 0xde
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, rbx
mov r9, rax
mov qword [rsp + 0x68], rax
movsx rax, bpl
mov qword [rsp + 0x50], rax
nop
inc rcx
cmp byte [rsi + rcx], 0
jne 0x14009e350
mov r8, qword [rsp + 0x40]
mov r11, qword [rsp + 0x28]
lea eax, [rax + rax*2]
imul ecx, r8d
add eax, eax
mov r14, rbx
sub ecx, eax
sub ecx, r11d
inc r14
cmp byte [rdi + r14], 0
jne 0x14009e374
lea eax, [r15 + rcx]
mov rcx, rbx
add r14d, eax
nop dword [rax + rax]
inc rcx
cmp byte [rdi + rcx], 0
jne 0x14009e390
mov rax, rbx
nop dword [rax]
inc rax
cmp byte [rsi + rax], 0
jne 0x14009e3a0
mov r15, qword [rsp + 0x208]
imul cl
shl r13b, 3
sub r13b, al
mov rax, rbx
sub r13b, r12b
inc rax
cmp byte [r15 + rax], 0
jne 0x14009e3c0
add r13b, al
mov rcx, rbx
add r13b, r8b
inc rcx
cmp byte [rdi + rcx], 0
jne 0x14009e3d3
mov rax, rbx
nop
inc rax
cmp byte [rsi + rax], 0
jne 0x14009e3e0
imul cl
movzx ecx, al
movzx eax, r12b
imul cl
movzx ecx, r11b
add cl, cl
lea edx, [rcx + r11]
mov rcx, rbx
add dl, bpl
add dl, dl
sub al, dl
sub al, 6
add al, r8b
mov byte [rsp + 0x21], al
inc rcx
cmp byte [rdi + rcx], 0
jne 0x14009e411
movzx eax, r8b
imul cl
lea ecx, [r9 + r9*2]
sub al, r13b
lea edx, [rcx + rcx]
add al, 2
mov rcx, rbx
mov dword [rsp + 0x38], edx
mov byte [rsp + 0x20], al
inc rcx
cmp byte [rdi + rcx], 0
jne 0x14009e437
mov eax, dword [rsp + 0x30]
mov r12d, 2
imul eax, r11d
sub r12d, eax
imul eax, r14d, 0xb
shl r12d, 2
sub r12d, eax
sub r12d, edx
sub r12d, dword [rsp + 0x24]
add r12d, r8d
sub r12d, ecx
js 0x14009e4c3
xor ecx, ecx
mov edx, 0x199
lea r8d, [rcx + 0x17]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rdx, [0x1400ed3f4]
movsxd r9, r12d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
lea rcx, [0x1400ed3f4]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, qword [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r8, qword [rsp + 0x40]
mov r11, qword [rsp + 0x28]
movsx r9, byte [rsp + 0x20]
movzx r10d, byte [rsp + 0x21]
mov rcx, rbx
inc rcx
cmp byte [rdi + rcx], 0
jne 0x14009e4d2
mov eax, dword [rsp + 0x50]
mov rdx, qword [rsp + 0x30]
imul eax, dword [rsp + 0x68]
lea eax, [rax + rax*8]
lea edx, [rdx + rax*2]
lea eax, [r12 + r12*4]
add edx, edx
sub edx, eax
sub edx, r11d
sub edx, r14d
add edx, r10d
add edx, r9d
add edx, r8d
sub edx, ecx
xor ecx, ecx
sub edx, 0xb
lea r8d, [rcx + 0x10]
mov dword [rsp + 0x3c], edx
mov edx, 0x224
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x80]
mov edx, 0x104
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov rdx, rbx
mov qword [rsp + 0x58], rax
inc rdx
cmp byte [rsi + rdx], 0
jne 0x14009e540
mov ecx, dword [rsp + 0x60]
mov eax, dword [rsp + 0x30]
imul edx, dword [rsp + 0x40]
imul eax, dword [rsp + 0x28]
imul ecx, dword [rsp + 0x3c]
imul ecx, r12d
add ecx, eax
lea eax, [rcx + rcx*2]
movsx rcx, r13b
add eax, eax
sub edx, eax
mov eax, dword [rsp + 0x38]
add eax, edx
add ecx, eax
movsx rax, byte [rsp + 0x20]
add ecx, dword [rsp + 0x24]
add ecx, eax
mov rax, rbx
nop dword [rax + rax]
inc rax
cmp byte [r15 + rax], 0
jne 0x14009e590
sub ecx, eax
mov rax, qword [rsp + 0x48]
mov edx, 0x163
add ecx, 9
mov qword [rsp + 0x70], rcx
lea rcx, str.c2ret
mov qword [rax], rcx
xor ecx, ecx
lea r8d, [rcx + 0x1b]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, qword [rsp + 0x48]
movsx r10d, r13b
imul r10d, r14d
mov qword [rcx + 8], rax
mov rdx, rbx
nop dword [rax + rax]
inc rdx
cmp byte [rdi + rdx], 0
jne 0x14009e5e0
imul edx, dword [rsp + 0x24]
mov rax, rbx
inc rax
cmp byte [rsi + rax], 0
jne 0x14009e5f1
mov r8, qword [rsp + 0x40]
mov r9d, dword [rsp + 0x3c]
movsx r11, byte [rsp + 0x20]
imul eax, r8d
mov r14, qword [rsp + 0x60]
movzx r13d, byte [rsp + 0x21]
add edx, eax
mov eax, r9d
imul eax, r12d
imul ecx, eax, 0x19
mov rax, qword [rsp + 0x50]
imul eax, dword [rsp + 0x30]
imul eax, eax, 0xfffffff4
sub eax, ecx
add edx, eax
mov rax, qword [rsp + 0x28]
lea eax, [rax + rax*8]
add edx, eax
mov rax, rbx
sub edx, r11d
sub edx, r14d
sub edx, dword [rsp + 0x68]
add edx, r10d
add edx, r13d
add edx, dword [rsp + 0x58]
nop word [rax + rax]
inc rax
cmp byte [r15 + rax], 0
jne 0x14009e660
sub edx, eax
mov rax, qword [rsp + 0x48]
mov rcx, rbx
add edx, 0x11
mov dword [rax + 0x10], edx
mov rdx, qword [rsp + 0x30]
mov qword [rax + 0x18], rdx
inc rcx
cmp byte [r15 + rcx], 0
jne 0x14009e683
imul ecx, dword [rsp + 0x24]
movsx eax, bpl
imul eax, edx
sub eax, 0xc
lea edx, [rax + rax*2]
mov rax, qword [rsp + 0x58]
add eax, eax
sub edx, eax
add edx, dword [rsp + 0x28]
add edx, edx
sub edx, ecx
imul eax, r13d, 0xb
add edx, eax
mov rax, rbx
sub edx, r10d
sub edx, r14d
sub edx, dword [rsp + 0x70]
inc rax
cmp byte [rdi + rax], 0
jne 0x14009e6c3
add edx, dword [rsp + 0x38]
inc rbx
cmp byte [rsi + rbx], 0
jne 0x14009e6d0
add edx, eax
mov rax, qword [rsp + 0x48]
add ebx, edx
add ebx, r11d
add ebx, r8d
add ebx, r9d
add ebx, r12d
mov dword [rax + 0x20], ebx
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x1e0]
add rsp, 0x1a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret