Function at 0x18004b030
Capabilities:
Extract resource via kernel32 functions
Read file via mapping

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
xor edi, edi
mov ebx, edi
mov r14d, edi
mov qword [rsp + 0xb8], rdi
mov r13, 0xffffffffffffffff
mov qword [rsp + 0x48], r13
mov r12d, edi
mov qword [rsp + 0x50], rdi
mov r15d, edi
mov qword [rsp + 0x58], rdi
test rdx, rdx
je 0x18004b07b
mov dword [rdx], edi
mov rsi, qword [sym.imp.KERNEL32.dll_CreateFileW]
lea rax, [0x180033800]
test r8d, r8d
cmovne rsi, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x180033580]
cmovne rax, rcx
mov qword [rsp + 0x60], rax
test rsi, rsi
je 0x18004b2b5
test rax, rax
je 0x18004b2b5
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov dword [rsp + 0xc0], eax
mov rcx, qword [rsp + 0xb0]
cmp dword [rsp + 0xc8], ebx
jne 0x18004b174
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
call rsi
mov r13, rax
mov qword [rsp + 0x48], rax
call fcn.180024710
neg eax
sbb r8d, r8d
and r8d, 0x18000000
cmp r13, 0xffffffffffffffff
je 0x18004b18b
or r8d, 0x1000002
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor edx, edx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov r12, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x18004b18b
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r15, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x18004b18b
jmp 0x18004b180
xor edx, edx
lea r8d, [rdx + 2]
call qword [0x1800d4958]
mov qword [rsp + 0xb8], rax
mov r14, rax
mov ecx, dword [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
test r14, r14
je 0x18004b262
mov esi, edi
mov dword [rsp + 0x44], edi
mov edx, 1
lea r8d, [rdx + 0xf]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
je 0x18004b21d
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x40], eax
test eax, eax
je 0x18004b21d
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x18004b21d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
je 0x18004b21d
movzx ebx, word [rax]
cmp ebx, dword [rsp + 0x40]
ja 0x18004b214
mov dword [rsp + 0x40], ebx
add ebx, 3
and ebx, 0xfffffffc
mov dword [rsp + 0x40], ebx
cmp dword [rax + 0x28], 0xfeef04bd
je 0x18004b223
mov esi, 0xd
mov dword [rsp + 0x44], esi
mov ebx, edi
mov dword [rsp + 0x40], ebx
jmp 0x18004b24d
cmp dword [rsp + 0xc8], 0
je 0x18004b267
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x18004b267
mov esi, 0xd
test r15, r15
je 0x18004b275
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test r12, r12
je 0x18004b283
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp r13, 0xffffffffffffffff
je 0x18004b290
mov rcx, r13
call qword [rsp + 0x60]
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
je 0x18004b2a3
lea edi, [rbx*2 + 4]
mov eax, edi
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
xor eax, eax
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret