Function at 0x1400ba350
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2b8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov rsi, qword [rsp + 0x320]
mov r15, qword [rsp + 0x328]
mov rdi, rcx
xor ecx, ecx
mov rbp, r8
mov qword [rsp + 0xa0], r8
mov qword [rsp + 0x78], rdx
lea r8d, [rcx + 0xb]
mov edx, 0x1c2
mov r14, r9
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, rbp
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r12, rax
mov qword [rsp + 0x98], rax
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
movzx r13d, ax
mov ecx, 0xffff
mov dword [rsp + 0x60], r13d
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
mov dword [rsp + 0x64], eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
lea r8d, [rcx + 3]
mov edx, 0x16a
mov rbx, rax
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea ecx, [r13*2]
add ecx, r13d
mov qword [rsp + 0x88], rax
lea r13d, [rcx + rcx]
sub r13d, eax
sub r13d, ebx
sub r13d, dword [rsp + 0x64]
add r13d, r12d
cmp r12d, 0xfffffffa
jne 0x1400ba475
lea rcx, [rsp + 0x160]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x160]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, qword [rsp + 0x88]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov edx, 0x5f
xor ecx, ecx
lea r8d, [rdx - 0x47]
mov qword [rsp + 0x90], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x2e1
lea r8d, [rcx + 0x17]
mov qword [rsp + 0x128], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
or rbx, 0xffffffffffffffff
mov rcx, rbx
nop dword [rax]
inc rcx
cmp byte [rsi + rcx], 0
jne 0x1400ba4e0
mov eax, dword [rsp + 0x60]
shl ecx, 4
imul eax, r12d
add ecx, eax
mov rax, rbx
sub ecx, ebp
nop dword [rax + rax]
inc rax
cmp byte [r14 + rax], 0
jne 0x1400ba500
add ecx, dword [rsp + 0x88]
mov rbp, rbx
inc rbp
cmp byte [rdi + rbp], 0
jne 0x1400ba514
add ecx, eax
mov rax, qword [rsp + 0x78]
add ebp, ecx
add ebp, dword [rax + 0xc]
mov rax, qword [rsp + 0x90]
lea eax, [rax + rax*4]
sub eax, dword [rsp + 0x128]
sub eax, dword [rsp + 0x70]
add eax, 4
mov dword [rsp + 0x6c], eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [rsp + 0xa8], rax
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
mov r8, rbx
movzx eax, ax
mov dword [rsp + 0x68], eax
inc r8
cmp byte [rsi + r8], 0
jne 0x1400ba564
mov rcx, qword [rsp + 0x70]
movzx eax, cl
imul cl
movzx ecx, al
movzx eax, r13b
imul cl
movzx ecx, al
shl cl, 2
lea edx, [rcx + rax]
movzx eax, byte [rsp + 0x60]
mov rcx, rbx
imul r12b
movzx r12d, al
sub r12b, dl
sub r12b, r8b
nop
inc rcx
cmp byte [r15 + rcx], 0
jne 0x1400ba5a0
sub r12b, cl
mov rax, rbx
inc rax
cmp byte [rdi + rax], 0
jne 0x1400ba5b0
add r12b, al
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rcx, rbx
mov rdx, rax
mov qword [rsp + 0xb0], rax
inc rcx
cmp byte [r15 + rcx], 0
jne 0x1400ba5d0
mov rax, rbx
nop dword [rax]
inc rax
cmp byte [rsi + rax], 0
jne 0x1400ba5e0
imul ecx, eax
mov rax, rbx
nop
inc rax
cmp byte [r14 + rax], 0
jne 0x1400ba5f0
lea r13d, [r13 + r13*8]
imul ecx, eax
mov rax, qword [rsp + 0x78]
mov rax, qword [rax]
shl r13d, 2
sub r13d, dword [rsp + 0x6c]
imul r13d, dword [rsp + 0x70]
sub r13d, ecx
mov rcx, rbx
nop
inc rcx
cmp byte [rax + rcx], 0
jne 0x1400ba620
mov rax, rbx
nop dword [rax]
inc rax
cmp byte [rdi + rax], 0
jne 0x1400ba630
imul ecx, eax
add r13d, ecx
sub r13d, edx
sub r13d, dword [rsp + 0x90]
sub r13d, dword [rsp + 0x68]
sub r13d, 6
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, dword [rsp + 0x6c]
xor edx, edx
mov qword [rsp + 0x100], rax
mov eax, dword [rsp + 0x60]
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x30], 0xfffffffa
mov dword [rsp + 0x28], ecx
lea rdx, str.agenda
mov r9d, 0xfffffffa
mov r8, rsi
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov ecx, dword [rsp + 0x64]
mov qword [rsp + 0xb8], rax
xor eax, eax
mov r9d, ecx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x60]
mov qword [rsp + 0x40], 0xfffffffffffffffa
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x6c]
lea r8, str.agenda
mov rdx, r14
mov ecx, 0xfffffffa
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [rsp + 0xd0], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rdx, rbx
mov qword [rsp + 0xd8], rax
inc rdx
cmp byte [rdi + rdx], 0
jne 0x1400ba722
mov rax, qword [rsp + 0xa0]
mov ecx, dword [rsp + 0x70]
lea eax, [rax*8]
sub ecx, eax
mov rax, qword [rsp + 0x78]
sub ecx, dword [rax + 8]
mov eax, dword [rsp + 0x60]
add eax, ecx
mov rcx, rdi
add edx, eax
mov rax, qword [rsp + 0x98]
add eax, 0x11
add eax, edx
mov dword [rsp + 0x80], eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r11, qword [rsp + 0x98]
mov qword [rsp + 0xc0], rax
cmp dword [rsp + 0x80], r11d
jae 0x1400ba7cf
xor ecx, ecx
mov edx, 0xed
lea r8d, [rcx + 0xd]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x160]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
mov r11, qword [rsp + 0x98]
movsx r8, r12b
mov rax, rbx
mov qword [rsp + 0xc8], r8
nop
inc rax
cmp byte [r15 + rax], 0
jne 0x1400ba7e0
mov r10, qword [rsp + 0xa0]
mov r12d, r8d
sub r12d, r10d
sub r12d, dword [rsp + 0x90]
sub r12d, dword [rsp + 0x88]
sub r12d, eax
mov rax, rbx
nop
inc rax
cmp byte [rdi + rax], 0
jne 0x1400ba810
add r12d, eax
mov rax, qword [rsp + 0x78]
mov rdx, rbx
mov rax, qword [rax]
inc rdx
cmp byte [rax + rdx], 0
jne 0x1400ba827
mov rax, rbx
inc rax
cmp byte [rsi + rax], 0
jne 0x1400ba833
imul edx, eax
mov rax, rbx
inc rax
cmp byte [r14 + rax], 0
jne 0x1400ba842
imul edx, eax
mov rax, rbx
inc rax
cmp byte [rdi + rax], 0
jne 0x1400ba852
imul ecx, dword [rsp + 0x70], 0xffffffe3
mov r9, qword [rsp + 0xa8]
imul edx, eax
mov eax, r9d
imul eax, dword [rsp + 0x68]
imul eax, ebp
sub ecx, eax
lea eax, [r11 + r11*2]
add eax, eax
sub ecx, eax
mov rax, qword [rsp + 0xb8]
add edx, ecx
add eax, 0xa2
sub edx, r13d
sub edx, r8d
add eax, edx
mov dword [rsp + 0x68], eax
mov rax, rbx
nop
inc rax
cmp byte [r14 + rax], 0
jne 0x1400ba8a0
mov rcx, rbx
nop dword [rax]
inc rcx
cmp byte [rdi + rcx], 0
jne 0x1400ba8b0
imul r9d, dword [rsp + 0x6c]
imul eax, ecx
mov rcx, qword [rsp + 0x78]
imul eax, r10d
imul eax, dword [rcx + 8]
mov rcx, qword [rsp + 0xb0]
add eax, ecx
add r9d, eax
mov rax, rbx
add r9d, dword [rsp + 0x88]
inc rax
cmp byte [rsi + rax], 0
jne 0x1400ba8e7
sub r9d, eax
mov rax, rbx
inc rax
cmp byte [r15 + rax], 0
jne 0x1400ba8f6
sub r9d, eax
mov ecx, 0xffff
add r9d, 0x12
mov qword [rsp + 0xa8], r9
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
xor ecx, ecx
lea r8d, [rcx + 6]
mov edx, 0xfd
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, r12d
mov r13, rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rbx
mov rdx, rax
nop word [rax + rax]
inc rcx
cmp byte [r14 + rcx], 0
jne 0x1400ba950
mov rax, qword [rsp + 0xa0]
imul ecx, eax
mov rax, rbx
nop dword [rax + rax]
inc rax
cmp byte [rdi + rax], 0
jne 0x1400ba970
mov r8, qword [rsp + 0x78]
mov r9, qword [rsp + 0x70]
mov r10, qword [rsp + 0x90]
imul eax, dword [r8 + 0xc]
mov r8, qword [rsp + 0xd8]
add ecx, eax
mov eax, r9d
imul r8d, dword [rsp + 0xc0]
imul eax, dword [rsp + 0x64]
imul r8d, dword [rsp + 0x80]
sub r8d, eax
mov eax, dword [rsp + 0x68]
imul eax, r12d
sub r8d, eax
mov rax, qword [rsp + 0xb0]
imul eax, r10d
add eax, eax
sub r8d, eax
mov rax, qword [rsp + 0xb8]
add ecx, r8d
lea eax, [rax + rax*4]
add ecx, eax
movzx eax, r13b
sub ecx, dword [rsp + 0x128]
add ecx, eax
mov rax, rbx
sub ecx, ebp
sub ecx, dword [rsp + 0x100]
sub ecx, dword [rsp + 0xd0]
sub ecx, r9d
inc rax
cmp byte [r15 + rax], 0
jne 0x1400baa06
add ecx, edx
inc rbx
cmp byte [rsi + rbx], 0
jne 0x1400baa12
add ecx, eax
mov rax, qword [rsp + 0xa8]
add ebx, ecx
add ebx, eax
mov rax, qword [rsp + 0x98]
add ebx, r10d
add eax, 0x17
add ebx, dword [rsp + 0x88]
add ebx, dword [rsp + 0xc8]
add ebx, dword [rsp + 0x60]
add eax, ebx
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x2b8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret