Function at 0x1400c5520
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x310
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x300], rax
or rbp, 0xffffffffffffffff
mov rdi, rcx
mov r15, rbp
nop dword [rax + rax]
inc r15
cmp byte [rcx + r15], 0
jne 0x1400c5560
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r14, rbp
mov rbx, rax
inc r14
cmp byte [rdi + r14], 0
jne 0x1400c5576
mov r12, rbp
inc r12
cmp byte [rdi + r12], 0
jne 0x1400c5583
lea rcx, [rsp + 0xb0]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0xb0]
lea rcx, [0x1400ee168]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rcx, rbp
mov qword [rsp + 0x68], rax
nop
cmp byte [rdi + rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x1400c55c0
lea r13d, [rcx + rcx*2]
mov rsi, rbp
sub r13d, eax
sub r13d, r12d
mov dword [rsp + 0x60], r13d
nop dword [rax]
inc rsi
cmp byte [rdi + rsi], 0
jne 0x1400c55e0
mov eax, ebx
mov ecx, r15d
imul eax, r14d
sub esi, eax
sub esi, r12d
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x80], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
lea r8d, [rcx + 8]
mov edx, 0xe6
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor r9d, r9d
lea r10, str.c1a2
mov ecx, eax
mov r8, rax
mov qword [rsp + 0x70], rax
imul ecx, esi
lea ecx, [rcx + rcx*2]
lea r13d, [r13 + rcx*4]
add r13d, 0xfffffffb
cmp r12d, r14d
jle 0x1400c578c
mov rcx, rbp
nop dword [rax + rax]
inc rcx
cmp byte [rdi + rcx], r9b
jne 0x1400c5650
mov qword [rsp + 0x58], r9
mov qword [rsp + 0x50], r9
mov qword [rsp + 0x48], r9
movzx eax, r15b
mov r9d, r15d
imul cl
movzx ecx, al
movzx eax, r12b
imul cl
movzx edx, al
movzx eax, r8b
mov r8, r10
imul byte [rsp + 0x80]
movzx ecx, al
movzx eax, r13b
imul cl
sub dl, al
movzx ecx, dl
add cl, cl
add cl, 4
add dl, cl
add dl, byte [rsp + 0x68]
movsx ecx, dl
movsxd rdx, dword [rsp + 0x60]
mov qword [rsp + 0x40], rdx
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], edx
lea rdx, str.brian
call qword [sym.imp.USER32.dll_CreateWindowExA]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
xor eax, eax
movsxd rsi, r13d
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x60]
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x38], r13d
mov dword [rsp + 0x30], eax
lea r8, [0x1400edd8c]
lea rdx, str.brian
mov r9d, r15d
mov ecx, r13d
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExA]
xor ecx, ecx
lea r8d, [rcx + 0x14]
mov edx, 0x306
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 3
xor ecx, ecx
lea r8d, [rdx + 0x12]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rdx, str.brian
movsxd r9, r14d
mov r8, rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
lea rcx, [rsp + 0x1f0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor r9d, r9d
lea r10, str.c1a2
movsxd rcx, dword [rsp + 0x60]
mov qword [rsp + 0x58], r9
mov qword [rsp + 0x50], r9
mov qword [rsp + 0x48], r9
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x38], r14d
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], ecx
lea rdx, str.brian
mov ecx, r14d
mov r9d, r12d
mov r8, r10
mov dword [rsp + 0x20], r15d
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov rsi, rbp
mov rcx, rax
inc rsi
cmp byte [rdi + rsi], 0
jne 0x1400c57d4
lea eax, [r14 + r14*2]
sub eax, ebx
sub eax, dword [rsp + 0x68]
add eax, 0xfffffffc
add eax, dword [rsp + 0x70]
add eax, dword [rsp + 0x80]
add eax, r15d
add esi, eax
nop word [rax + rax]
inc rbp
cmp byte [rdi + rbp], 0
jne 0x1400c5800
imul r13d, dword [rsp + 0x60]
lea rax, str.c1a2
xor edi, edi
lea rdx, [0x1400ed4d4]
mov r8d, esi
mov qword [rsp + 0x28], rdi
inc r13d
mov qword [rsp + 0x20], rax
imul r13d, ecx
sub r13d, r15d
lea rcx, [rsp + 0x78]
add ebp, r13d
mov r9d, ebp
call fcn.1400db100
cmp dword [rsp + 0x60], esi
jg 0x1400c589e
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
movsxd rax, r14d
lea r8, [0x1400edd8c]
lea rdx, [0x1400ed4d4]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], ebp
mov dword [rsp + 0x30], ebp
mov r9d, ebp
mov ecx, esi
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], r15d
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea rcx, [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rax, str.c10a3
mov rcx, qword [rsp + 0x300]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x310]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret