Function at 0x140090430
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xd0
or rbp, 0xffffffffffffffff
mov r14, r9
mov rsi, r8
mov r15, rdx
mov rbx, rcx
mov rax, rbp
nop word [rax + rax]
inc rax
cmp byte [r9 + rax], 0
jne 0x140090470
mov r13d, ecx
sub r13d, eax
mov rax, rbp
inc rax
cmp byte [rdx + rax], 0
jne 0x140090483
add r13d, eax
mov rax, rbp
inc rax
cmp byte [r8 + rax], 0
jne 0x140090492
add r13d, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rbp
mov qword [rsp + 0x68], rax
nop dword [rax]
inc rcx
cmp byte [r14 + rcx], 0
jne 0x1400904b0
imul ecx, eax
mov r12, rbp
imul ecx, r13d
inc r12
cmp byte [r15 + r12], 0
jne 0x1400904c4
imul r12d, ebx
mov rax, rbp
sub r12d, ecx
nop dword [rax + rax]
inc rax
cmp byte [rsi + rax], 0
jne 0x1400904e0
sub r12d, eax
lea rcx, str.lion
movsxd rbx, r13d
sub r12d, 4
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.lion
mov r9, rbx
mov r8d, r13d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
mov rax, rbp
nop dword [rax]
inc rax
cmp byte [r15 + rax], 0
jne 0x140090520
mov rcx, rbp
nop dword [rax]
inc rcx
cmp byte [rsi + rcx], 0
jne 0x140090530
mov rbx, qword [rsp + 0x68]
imul eax, ecx
mov rcx, rbp
mov edx, ebx
sub edx, eax
sub edx, r13d
nop dword [rax + rax]
inc rcx
cmp byte [r14 + rcx], 0
jne 0x140090550
mov rax, qword [rsp + 0x100]
add eax, edx
add ecx, eax
mov dword [rsp + 0x90], ecx
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
xor ecx, ecx
mov edx, 0x33e
lea r8d, [rcx + 0xd]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
cmp r12d, 0x40
jne 0x140090665
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea r8d, [r12 - 0x27]
mov edx, 0x2af
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea ecx, [r12 + 5]
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea edx, [r12 + 0x3a]
lea r8d, [r12 - 0x24]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor eax, eax
mov r9d, r13d
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], 0x40
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], 0x45
mov r8, r14
mov rdx, r14
mov ecx, r12d
mov dword [rsp + 0x28], 0x45
mov dword [rsp + 0x20], 0x45
call qword [sym.imp.USER32.dll_CreateWindowExA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea r8d, [r12 - 0x3e]
mov edx, 0x36d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, str.lion
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rbp
nop dword [rax + rax]
inc rcx
cmp byte [rsi + rcx], 0
jne 0x140090670
mov rdx, qword [rsp + 0x100]
mov eax, r13d
mov edi, edx
imul eax, r13d
sub edi, eax
mov rax, rbp
sub edi, ebx
sub edi, ecx
mov dword [rsp + 0x70], edi
nop word [rax + rax]
inc rax
cmp byte [r15 + rax], 0
jne 0x1400906a0
imul eax, r13d
dec eax
imul eax, edx
sub eax, ebx
mov rbx, rbp
sub eax, r12d
add eax, 0xffffffc0
add eax, r13d
mov dword [rsp + 0x60], eax
inc rbx
cmp byte [rsi + rbx], 0
jne 0x1400906c5
imul ebx, edx
sub ebx, 0x41
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rcx, rbp
mov r8, rax
inc rcx
cmp byte [r14 + rcx], 0
jne 0x1400906e0
mov r10, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x100]
movzx eax, r13b
imul cl
movzx ecx, al
movzx eax, r12b
imul cl
movzx ecx, al
movzx eax, r10b
imul cl
movzx ecx, al
mov rax, rbp
add cl, cl
add cl, dil
add cl, cl
sub cl, byte [rsp + 0x90]
sub cl, bl
sub cl, r8b
add cl, dl
nop word [rax + rax]
inc rax
cmp byte [rsi + rax], 0
jne 0x140090730
sub cl, al
sub cl, 2
mov byte [rsp + 0x100], cl
mov rcx, rbp
nop dword [rax + rax]
inc rcx
cmp byte [rsi + rcx], 0
jne 0x140090750
mov r9d, dword [rsp + 0x60]
inc ecx
imul ecx, r13d
imul eax, r9d, 0x1c
add eax, edi
lea edi, [rcx + rax*2]
mov rax, rbp
sub edi, r8d
add edi, edx
inc rax
cmp byte [r15 + rax], 0
jne 0x140090775
sub edi, eax
mov rax, rbp
inc edi
inc rax
cmp byte [r14 + rax], 0
jne 0x140090786
sub eax, r10d
xor ecx, ecx
imul eax, r13d
lea r13d, [rdx - 4]
mov edx, 0x3b1
sub eax, r9d
add eax, r8d
lea r8d, [rcx + 7]
add eax, ebx
add r13d, eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rbp
mov rdx, rax
nop dword [rax + rax]
inc rcx
cmp byte [rsi + rcx], 0
jne 0x1400907d0
imul edx, dword [rsp + 0x78]
imul ebx, dword [rsp + 0x60]
movsx rax, byte [rsp + 0x100]
add ebx, ebx
sub edx, ebx
imul r13d, edi
add edx, r13d
add edx, eax
mov rax, rbp
sub edx, dword [rsp + 0x70]
add edx, dword [rsp + 0x68]
add edx, r12d
sub edx, ecx
nop dword [rax]
inc rax
cmp byte [r15 + rax], 0
jne 0x140090810
add edx, 0x1133
inc rbp
cmp byte [r14 + rbp], 0
jne 0x140090820
lea r11, [rsp + 0xd0]
add eax, edx
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
add eax, ebp
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret