Function at 0x1800976d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r15
lea rbp, [rsp - 0x6d0]
sub rsp, 0x7d0
mov rax, qword [0x180146748]
xor rax, rsp
mov qword [rbp + 0x6b0], rax
mov rsi, rdx
mov qword [rsp + 0x28], rcx
mov r15, rcx
xor edx, edx
lea rcx, [rsp + 0x70]
mov r8d, 0x11c
call fcn.1800bbd80
xor edx, edx
mov dword [rsp + 0x70], 0x11c
mov r8d, 0x11c
mov rcx, rsi
call fcn.1800bbd80
mov rcx, rsi
mov dword [rsi], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.RtlGetVersion
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180097764
lea rcx, [rsp + 0x70]
call rax
mov eax, dword [rsi + 4]
lea ecx, [rax + rax*4]
mov eax, dword [rsi + 8]
lea edi, [rax + rcx*2]
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x20], edi
lea ecx, [rax + rax*4]
mov eax, dword [rsp + 0x78]
lea r8d, [rax + rcx*2]
cmp r8d, edi
jle 0x18009780c
mov rcx, rsi
lea rdx, [rsp + 0x70]
mov eax, 2
nop dword [rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
lea rdx, [rdx + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rdx - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rdx - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rdx - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rdx - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rdx - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rdx - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rax, 1
jne 0x1800977a0
mov rax, qword [rdx + 0x10]
movups xmm0, xmmword [rdx]
mov dword [rsp + 0x20], r8d
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rax
mov eax, dword [rdx + 0x18]
mov dword [rcx + 0x18], eax
xor edx, edx
mov qword [rsp + 0x7c0], r14
mov r8d, 0x410
lea rcx, [rbp + 0x2a0]
call fcn.1800bbd80
xor edx, edx
lea rcx, [rbp + 0x90]
mov r8d, 0x208
call fcn.1800bbd80
mov edx, 0x104
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
dec eax
xor ebx, ebx
cmp eax, 0x102
ja 0x1800979b9
lea r8, str.System32_ntoskrnl.exe
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x2a0]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
xor edx, edx
lea r8d, [rbx + 2]
lea rcx, [rbp + 0x2a0]
mov edi, ebx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov r14, rax
test rax, rax
je 0x18009793a
lea edx, [rbx + 1]
mov rcx, rax
lea r8d, [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r15, rax
test rax, rax
je 0x18009792c
mov rdx, rax
mov qword [rsp + 0x7c8], r13
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, r15
mov rcx, r14
mov r13d, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r15, rax
test rax, rax
je 0x180097924
mov rcx, rax
mov qword [rsp + 0x810], r12
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r12, rax
test rax, rax
je 0x180097913
mov ecx, r13d
call fcn.1800c55b8
mov rdi, rax
test rax, rax
je 0x180097913
mov r8d, r13d
mov rdx, r12
mov rcx, rax
call fcn.1800bb910
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov r12, qword [rsp + 0x810]
mov r13, qword [rsp + 0x7c8]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov r15, qword [rsp + 0x28]
mov r14d, ebx
test rdi, rdi
je 0x1800979b9
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rbx
lea r8, [rsp + 0x28]
mov dword [rsp + 0x30], ebx
lea rdx, [0x18010d4a0]
mov rcx, rdi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x18009797c
mov rax, qword [rsp + 0x28]
mov r14d, 1
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x48], xmm1
mov rcx, rdi
call fcn.1800bea88
test r14d, r14d
je 0x1800979b9
mov edx, dword [rsp + 0x48]
movzx r8d, word [rsp + 0x48]
shr edx, 0x10
lea eax, [rdx + rdx*4]
lea ecx, [r8 + rax*2]
cmp dword [rsp + 0x20], ecx
jge 0x1800979b9
mov eax, dword [rsp + 0x4c]
mov ebx, 1
shr eax, 0x10
mov dword [rsi + 0xc], eax
mov dword [rsi + 4], edx
mov dword [rsi + 8], r8d
mov dword [r15 + 8], ebx
mov eax, 1
mov r14, qword [rsp + 0x7c0]
mov rcx, qword [rbp + 0x6b0]
xor rcx, rsp
call fcn.18008c720
add rsp, 0x7d0
pop r15
pop rdi
pop rsi
pop rbx
pop rbp
ret