Function at 0x1401cd050
Capabilities:
Extract resource via kernel32 functions
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x4f8
mov qword [rsp + 0x488], 0xfffffffffffffffe
mov dword [rsp + 0x480], 0
mov rdx, qword [rsp + 0x520]
lea rcx, [rsp + 0x3e0]
call fcn.14000f540
mov qword [rsp + 0x490], rax
mov rax, qword [rsp + 0x490]
mov qword [rsp + 0x498], rax
mov rcx, qword [rsp + 0x498]
call fcn.14000f5d0
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.140002050
nop
lea rcx, [rsp + 0x3e0]
call fcn.140002dd0
lea rcx, [rsp + 0x70]
call fcn.140006ea0
movzx eax, al
test eax, eax
je 0x1401cd106
mov dword [rsp + 0x3e8], 0
lea rcx, [rsp + 0x70]
call fcn.140007060
mov eax, dword [rsp + 0x3e8]
jmp 0x1401cd88f
mov r8d, 1
lea rdx, [rsp + 0x3f0]
lea rcx, [rsp + 0x70]
call fcn.140006ba0
mov qword [rsp + 0x4a0], rax
mov rax, qword [rsp + 0x4a0]
mov qword [rsp + 0x4a8], rax
mov eax, dword [rsp + 0x480]
or eax, 1
mov dword [rsp + 0x480], eax
lea rdx, [0x14022feac]
mov rcx, qword [rsp + 0x4a8]
call fcn.140006dd0
movzx eax, al
test eax, eax
jne 0x1401cd1bb
mov r8d, 1
lea rdx, [rsp + 0x3f8]
lea rcx, [rsp + 0x70]
call fcn.140006ba0
mov qword [rsp + 0x4b0], rax
mov eax, dword [rsp + 0x480]
or eax, 2
mov dword [rsp + 0x480], eax
lea rdx, [0x14022ff1c]
mov rcx, qword [rsp + 0x4b0]
call fcn.140006dd0
movzx eax, al
test eax, eax
jne 0x1401cd1bb
mov dword [rsp + 0x4b8], 0
jmp 0x1401cd1c6
mov dword [rsp + 0x4b8], 1
movzx eax, byte [rsp + 0x4b8]
mov byte [rsp + 0x3ec], al
mov eax, dword [rsp + 0x480]
and eax, 2
test eax, eax
je 0x1401cd1f9
and dword [rsp + 0x480], 0xfffffffd
lea rcx, [rsp + 0x3f8]
call fcn.140007060
nop
mov eax, dword [rsp + 0x480]
and eax, 1
test eax, eax
je 0x1401cd21c
and dword [rsp + 0x480], 0xfffffffe
lea rcx, [rsp + 0x3f0]
call fcn.140007060
movzx eax, byte [rsp + 0x3ec]
test eax, eax
je 0x1401cd278
mov r8d, 1
lea rdx, [rsp + 0x400]
lea rcx, [rsp + 0x70]
call fcn.140006a80
mov qword [rsp + 0x4c0], rax
mov rax, qword [rsp + 0x4c0]
mov qword [rsp + 0x4c8], rax
mov rdx, qword [rsp + 0x4c8]
lea rcx, [rsp + 0x70]
call fcn.140002ce0
nop
lea rcx, [rsp + 0x400]
call fcn.140007060
lea rcx, [rsp + 0x70]
call fcn.140050200
lea r8, [rsp + 0x58]
mov rdx, rax
lea rcx, [0x1403c7e08]
call fcn.140025860
test eax, eax
je 0x1401cd2d9
mov rcx, qword [rsp + 0x510]
mov rax, qword [rsp + 0x60]
mov qword [rcx], rax
mov rcx, qword [rsp + 0x518]
mov eax, dword [rsp + 0x58]
mov dword [rcx], eax
mov dword [rsp + 0x408], 1
lea rcx, [rsp + 0x70]
call fcn.140007060
mov eax, dword [rsp + 0x408]
jmp 0x1401cd88f
xor r8d, r8d
lea rdx, [0x14023055c]
lea rcx, [rsp + 0x70]
call fcn.140006800
test eax, eax
jl 0x1401cd312
mov dword [rsp + 0x40c], 0
lea rcx, [rsp + 0x70]
call fcn.140007060
mov eax, dword [rsp + 0x40c]
jmp 0x1401cd88f
lea rcx, [rsp + 0x20]
call fcn.1400777f0
nop
lea rdx, [0x1403c7ba0]
add rdx, 0x228
lea r8, str._tftp_
lea rcx, [rsp + 0x410]
call fcn.1400010b0
mov qword [rsp + 0x4d0], rax
mov rax, qword [rsp + 0x4d0]
mov qword [rsp + 0x4d8], rax
lea r8, [rsp + 0x70]
mov rdx, qword [rsp + 0x4d8]
lea rcx, [rsp + 0x50]
call fcn.140006c50
nop
lea rcx, [rsp + 0x410]
call fcn.140007060
lea rcx, [rsp + 0x50]
call fcn.140050200
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.1400778f4
test eax, eax
je 0x1401cd4e8
lea rcx, [rsp + 0x20]
call fcn.1400774fc
lea rcx, [rsp + 0x20]
call fcn.140077548
mov dword [rsp + 0x58], eax
lea rcx, [rsp + 0x20]
call fcn.140077428
lea rcx, [rsp + 0x50]
call fcn.140050200
lea rdx, [0x140230578]
mov rcx, rax
call fcn.1400ab5cc
mov qword [rsp + 0x78], rax
cmp qword [rsp + 0x78], 0
jne 0x1401cd41d
mov dword [rsp + 0x418], 0
lea rcx, [rsp + 0x50]
call fcn.140007060
nop
lea rcx, [rsp + 0x20]
call fcn.14007784c
nop
lea rcx, [rsp + 0x70]
call fcn.140007060
mov eax, dword [rsp + 0x418]
jmp 0x1401cd88f
mov ecx, dword [rsp + 0x58]
call fcn.140073290
mov qword [rsp + 0x420], rax
mov rax, qword [rsp + 0x420]
mov qword [rsp + 0x60], rax
mov edx, dword [rsp + 0x58]
mov r9, qword [rsp + 0x78]
mov r8d, 1
mov rcx, qword [rsp + 0x60]
call fcn.1400ae1e4
mov rcx, qword [rsp + 0x78]
call fcn.1400ab86c
mov rdx, qword [rsp + 0x510]
mov rax, qword [rsp + 0x60]
mov qword [rdx], rax
mov rcx, qword [rsp + 0x518]
mov eax, dword [rsp + 0x58]
mov dword [rcx], eax
lea rdi, [rsp + 0x460]
lea rsi, [rsp + 0x58]
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x70]
call fcn.140050200
lea r8, [rsp + 0x460]
mov rdx, rax
lea rcx, [0x1403c7e08]
call fcn.1400258e0
mov dword [rsp + 0x428], 1
lea rcx, [rsp + 0x50]
call fcn.140007060
nop
lea rcx, [rsp + 0x20]
call fcn.14007784c
nop
lea rcx, [rsp + 0x70]
call fcn.140007060
mov eax, dword [rsp + 0x428]
jmp 0x1401cd88f
lea rcx, [rsp + 0x20]
call fcn.140077428
lea rcx, [rsp + 0x70]
call fcn.140050200
mov rdi, rax
call fcn.14000dda0
lea r8, [0x140230580]
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rsp + 0x68], rax
lea rdx, [0x140230598]
lea rcx, [rsp + 0x430]
call fcn.1400f05c0
mov qword [rsp + 0x4e0], rax
lea rdx, [0x140230588]
mov rcx, qword [rsp + 0x4e0]
call fcn.140006e10
mov byte [rsp + 0x42c], al
lea rcx, [rsp + 0x430]
call fcn.140007060
movzx edx, byte [rsp + 0x42c]
test edx, edx
je 0x1401cd612
lea rdx, [0x1402305a8]
lea rcx, [rsp + 0x70]
call fcn.140006130
test eax, eax
jne 0x1401cd5a6
call fcn.14000dda0
lea r8, [0x1402305c0]
lea rdx, str.oem_gpxe.pxe
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rsp + 0x68], rax
lea rdx, [0x1402305e8]
lea rcx, [rsp + 0x70]
call fcn.140006130
test eax, eax
jne 0x1401cd5dc
call fcn.14000dda0
lea r8, [0x140230600]
lea rdx, str.oem_gpxex.pxe
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rsp + 0x68], rax
lea rdx, [0x140230628]
lea rcx, [rsp + 0x70]
call fcn.140006130
test eax, eax
jne 0x1401cd612
call fcn.14000dda0
lea r8, [0x140230640]
lea rdx, [0x140230648]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rsp + 0x68], rax
cmp qword [rsp + 0x68], 0
je 0x1401cd718
call fcn.14000dda0
mov rdx, qword [rsp + 0x68]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x58], eax
call fcn.14000dda0
mov rdx, qword [rsp + 0x68]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x80], rax
mov ecx, dword [rsp + 0x58]
call fcn.140073290
mov qword [rsp + 0x438], rax
mov rax, qword [rsp + 0x438]
mov qword [rsp + 0x60], rax
mov r8d, dword [rsp + 0x58]
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
call fcn.1400aa500
mov rdx, qword [rsp + 0x510]
mov rax, qword [rsp + 0x60]
mov qword [rdx], rax
mov rcx, qword [rsp + 0x518]
mov eax, dword [rsp + 0x58]
mov dword [rcx], eax
lea rdi, [rsp + 0x470]
lea rsi, [rsp + 0x58]
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x70]
call fcn.140050200
lea r8, [rsp + 0x470]
mov rdx, rax
lea rcx, [0x1403c7e08]
call fcn.1400258e0
mov dword [rsp + 0x440], 1
lea rcx, [rsp + 0x50]
call fcn.140007060
nop
lea rcx, [rsp + 0x20]
call fcn.14007784c
nop
lea rcx, [rsp + 0x70]
call fcn.140007060
mov eax, dword [rsp + 0x440]
jmp 0x1401cd88f
lea rcx, [0x14022ff5c]
call fcn.1400aa950
mov rdi, rax
lea rcx, [rsp + 0x70]
call fcn.140050200
mov r8, rdi
lea rdx, [0x140230668]
mov rcx, rax
call fcn.1400aab6c
test eax, eax
jne 0x1401cd856
lea rcx, [rsp + 0x90]
call fcn.1401e0790
nop
lea rax, [rsp + 0x448]
mov qword [rsp + 0x450], rax
mov r8d, 3
mov rdx, qword [rsp + 0x450]
lea rcx, [rsp + 0x70]
call fcn.140006a80
mov qword [rsp + 0x4e8], rax
mov rdx, qword [rsp + 0x4e8]
lea rcx, [rsp + 0x90]
call fcn.1401e6500
mov dword [rsp + 0x3d4], 0
mov dword [rsp + 0x3d0], 0
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x90]
call fcn.1401e5200
nop
cmp dword [rsp + 0x3d4], 0xffffffff
je 0x1401cd83b
lea r9, [rsp + 0x3d4]
lea r8, [0x14023000c]
lea rdx, [rsp + 0x3d8]
lea rcx, [rsp + 0x88]
call fcn.140006620
lea rcx, [rsp + 0x3d8]
call fcn.140006ea0
movzx eax, al
test eax, eax
je 0x1401cd81b
lea rcx, [rsp + 0x3d8]
call fcn.140007060
jmp 0x1401cd83b
mov eax, dword [rsp + 0x3d0]
add eax, 1
mov dword [rsp + 0x3d0], eax
lea rcx, [rsp + 0x3d8]
call fcn.140007060
jmp 0x1401cd7ca
lea rcx, [rsp + 0x88]
call fcn.140007060
nop
lea rcx, [rsp + 0x90]
call fcn.140005e30
mov dword [rsp + 0x458], 0
lea rcx, [rsp + 0x50]
call fcn.140007060
nop
lea rcx, [rsp + 0x20]
call fcn.14007784c
nop
lea rcx, [rsp + 0x70]
call fcn.140007060
mov eax, dword [rsp + 0x458]
jmp 0x1401cd88f
add rsp, 0x4f8
pop rdi
pop rsi
ret