Function at 0x140085250
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x78
movsxd rdi, r8d
mov r14, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
mov edx, 0x2cb
mov ebx, eax
lea r8d, [rcx + 0xe]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rdx, str.gazebo
mov r8, rdi
mov r9, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
mov rbp, qword [rsp + 0xe0]
mov edx, 0x6d
lea ecx, [rbp*2]
mov esi, r14d
lea r8d, [rdx - 0x55]
add ecx, ebp
mov dword [rsp + 0x20], eax
add ecx, ecx
sub esi, ecx
mov rcx, qword [rsp + 0xe8]
sub esi, dword [rcx + 8]
xor ecx, ecx
sub esi, 4
mov dword [rsp + 0xd8], esi
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
mov dword [rsp + 0xc8], eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
mov edx, 0x20e
mov qword [rsp + 0x58], rax
lea r8d, [rcx + 0xd]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r12, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov ecx, esi
mov rdi, rax
imul ecx, ebx
add ecx, eax
add ecx, r14d
lea r13d, [rcx*4 + 0x18]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rdx, r14
xor ecx, ecx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor ecx, ecx
lea r8d, [rcx + 0x11]
mov edx, 0x3c4
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x365
lea r8d, [rcx + 0xc]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov edx, dword [rsp + 0xd0]
lea edx, [rdx*4]
mov ecx, r12d
mov r15, rax
imul ecx, edi
sub edx, ecx
add edx, dword [rsp + 0x58]
add edx, r13d
add edx, ebp
mov rbp, qword [rsp + 0xc0]
add ebp, 0xfffffffc
add ebp, edx
xor ecx, ecx
mov edx, 0x2d7
lea r8d, [rcx + 0x14]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x173
lea r8d, [rcx + 0x1d]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x16b
lea r8d, [rcx + 2]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea edx, [rsi + rsi*2]
mov rsi, qword [rsp + 0xe0]
imul r12d, dword [rsp + 0xd8]
add r12d, edx
mov ecx, 0xffff
sub r12d, r15d
sub r12d, ebx
sub r12d, esi
add r12d, r14d
mov r14, qword [rsp + 0xc0]
lea ebx, [r14 - 0x73]
add ebx, r12d
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
xor ecx, ecx
lea r8d, [rcx + 0x12]
mov edx, 0x399
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, dword [rsp + 0xc8]
imul r13d, esi
lea eax, [rcx + rcx]
mov ecx, dword [rsp + 0x20]
sub ecx, eax
lea eax, [rcx*2]
add eax, r13d
sub eax, edi
sub eax, r15d
sub eax, ebx
sub eax, ebp
add eax, 3
add eax, dword [rsp + 0xd8]
add eax, r14d
add eax, dword [rsp + 0xd0]
cmp dword [rsp + 0xd0], eax
jle case.default.0x1400854ba
xor ecx, ecx
mov edx, 0x38d
lea r8d, [rcx + 0x1b]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor r8d, r8d
mov edx, 0x1d3
xor ecx, ecx
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
jmp qword [sym.imp.KERNEL32.dll_FindResourceA]