Function at 0x140070750
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x240
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
mov r13, rdx
lea rcx, [rsp + 0xf0]
mov edx, 0x104
mov r12, r8
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov r15, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0xf0]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0xf0]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0xf0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
or rdi, 0xffffffffffffffff
mov qword [rsp + 0xc8], rax
mov r14, rdi
nop dword [rax]
inc r14
cmp byte [rbx + r14], 0
jne 0x1400707f0
mov rcx, qword [r13 + 0x10]
mov rax, rdi
inc rax
cmp byte [rcx + rax], 0
jne 0x140070801
imul r14d, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor ecx, ecx
lea r8d, [rcx + 0x1b]
mov edx, 0x179
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rbp, rdi
mov qword [rsp + 0xe8], rax
inc rbp
cmp byte [rbx + rbp], 0
jne 0x140070830
mov rcx, qword [r13 + 0x10]
mov rax, rdi
inc rax
cmp byte [rcx + rax], 0
jne 0x140070840
xor ecx, ecx
mov edx, 0x3ce
sub bpl, al
lea r8d, [rcx + 0x10]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
lea rcx, [rsp + 0xf0]
mov edx, 0x104
mov qword [rsp + 0x68], rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov rcx, rdi
inc rcx
cmp byte [rbx + rcx], 0
jne 0x140070886
imul esi, dword [rsp + 0xc8]
mov edx, 5
lea r8d, [rdx - 2]
sub r15d, esi
lea eax, [r15 + 2]
add eax, ecx
xor ecx, ecx
mov dword [rsp + 0x60], eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
lea r8d, [rcx + 0xf]
mov edx, 0x3cf
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [rsp + 0x78], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov r15, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
lea r8d, [rcx + 9]
mov edx, 0xd4
mov qword [rsp + 0x80], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0x88], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rcx, [rsp + 0xf0]
mov edx, 0x104
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor ecx, ecx
lea r8d, [rcx + 0xf]
mov edx, 0xfc
mov dword [rsp + 0x98], eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rsi, rdi
mov qword [rsp + 0xa8], rax
nop dword [rax + rax]
inc rsi
cmp byte [rbx + rsi], 0
jne 0x140070950
mov rcx, qword [r13 + 0x10]
mov rax, rdi
inc rax
cmp byte [rcx + rax], 0
jne 0x140070960
imul esi, eax
mov eax, dword [rsp + 0xe8]
lea eax, [rax*2 + 0xa]
sub esi, eax
mov rax, rdi
sub esi, dword [rsp + 0x70]
sub esi, dword [rsp + 0x80]
add esi, dword [rsp + 0x68]
nop
inc rax
cmp byte [r12 + rax], 0
jne 0x140070990
sub esi, eax
lea eax, [rsi + 2]
add al, al
add al, byte [rsp + 0x98]
cmp al, sil
ja 0x140070a8c
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
movsx r10d, bpl
movsxd r8, esi
mov rcx, rdi
mov r9d, eax
nop word [rax + rax]
inc rcx
cmp byte [rbx + rcx], 0
jne 0x1400709d0
mov rdx, qword [r13 + 0x10]
mov rax, rdi
inc rax
cmp byte [rdx + rax], 0
jne 0x1400709e0
imul r15d, dword [rsp + 0x78]
mov r11, qword [rsp + 0x68]
imul ecx, eax
mov eax, r11d
imul eax, r11d
sub r15d, eax
mov rax, qword [rsp + 0x88]
add r15d, dword [rsp + 0x60]
add r15d, ecx
imul eax, dword [rsp + 0x70]
lea edx, [r15 + rax*8]
mov eax, r10d
imul eax, r14d
imul edx, r9d
sub edx, eax
inc rdi
cmp byte [rbx + rdi], 0
jne 0x140070a27
imul edi, dword [r13 + 8]
xor ecx, ecx
lea eax, [r11 + 0x13a]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], r8
mov dword [rsp + 0x38], r10d
sub edx, edi
sub edx, dword [rsp + 0xa8]
lea r8, str.mallet
mov r9d, r10d
add eax, edx
lea rdx, str.waitress
mov ecx, r10d
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea rax, str.c1a5
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x298]
add rsp, 0x240
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret