Function at 0x1400032ec
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4a0
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x18], 0xfffffffffffffffe
mov qword [rbp + 0x4a0], rbx
mov rax, qword [0x1400971b0]
xor rax, rbp
mov qword [rbp + 0x450], rax
mov qword [rbp], r9
mov r13, r8
mov r12, rdx
xor edi, edi
mov ebx, edi
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x30], rcx
mov qword [rbp + 0x28], rdi
xor edx, edx
mov r8d, 0x408
lea rcx, [rbp + 0x40]
call fcn.14004cad0
mov qword [rbp + 0x40], rdi
test r12, r12
je 0x1400035b6
or rax, 0xffffffffffffffff
inc rax
cmp word [r12 + rax*2], di
jne 0x140003360
inc eax
cdqe
lea r15, [rax + rax]
mov eax, 0x80000000
add rax, r15
mov ecx, 0xffffffff
cmp rax, rcx
ja 0x14000342a
movsxd rsi, r15d
cmp r15d, 0x400
jg 0x1400033c6
mov rcx, rsi
call fcn.1400023f4
test al, al
je 0x1400033c6
lea rax, [rsi + 0xf]
cmp rax, rsi
ja 0x1400033b3
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.14004b4b0
sub rsp, rax
lea r14, [rsp + 0x40]
jmp 0x1400033f2
mov rax, rsi
not rax
cmp rax, 0x10
jb 0x14000360a
lea rcx, [rsi + 0x10]
call fcn.140055afc
test rax, rax
je 0x14000342a
mov qword [rax], rdi
mov rbx, rax
mov qword [rbp + 0x20], rax
lea r14, [rax + 0x10]
test r14, r14
je 0x14000342a
mov byte [r14], dil
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r14
or r9d, 0xffffffff
mov r8, r12
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
neg eax
sbb rsi, rsi
and rsi, r14
jmp 0x14000342d
mov rsi, rdi
test rsi, rsi
je 0x1400035b6
xor edx, edx
lea r8d, [rdx + 0x60]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov r14, rax
mov qword [rbp + 8], rax
test rax, rax
jne 0x140003478
xor edx, edx
lea r8d, [rax + 2]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov r14, rax
mov qword [rbp + 8], rax
test rax, rax
jne 0x140003478
call fcn.140002624
mov esi, eax
jmp 0x14000358c
mov r8, qword [rbp]
mov rdx, r13
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rsi, rax
test rax, rax
jne 0x14000349a
call fcn.140002624
jmp 0x14000357b
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r15, rax
mov qword [rbp + 0x10], rax
test rax, rax
je 0x140003490
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [rbp], esi
lea eax, [rsi + 1]
cmp eax, esi
jae 0x1400034d4
mov esi, 0x8007000e
jmp 0x14000357d
mov ecx, eax
test eax, eax
je 0x140003504
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 1
jb 0x140003615
cmp rcx, 0x400
jbe 0x140003504
mov rdx, rcx
lea rcx, [rbp + 0x40]
call fcn.140018b00
jmp 0x14000350c
lea rax, [rbp + 0x48]
mov qword [rbp + 0x40], rax
jmp 0x14000351f
cmp qword [rbp + 0x40], rdi
je 0x1400034ca
mov r9, rsi
mov r8, r15
mov rdx, rsi
mov rcx, qword [rbp + 0x40]
call fcn.140001600
test eax, eax
je 0x14000355f
cmp eax, 0xc
je 0x140003636
cmp eax, 0x16
je 0x14000362b
cmp eax, 0x22
je 0x14000362b
cmp eax, 0x50
jne 0x140003620
mov rax, qword [rbp + 0x40]
mov byte [rsi + rax], dil
mov r8d, dword [rbp + 0x4c0]
mov rdx, qword [rbp + 0x40]
lea rcx, [rbp + 0x28]
call fcn.140004944
mov esi, eax
test r14, r14
je 0x14000358c
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rbp + 0x48]
cmp qword [rbp + 0x40], rax
je 0x1400035a0
lea rcx, [rbp + 0x40]
call fcn.140017980
nop
jmp 0x1400035ad
mov rcx, rbx
mov rbx, qword [rbx]
call fcn.1400558e4
test rbx, rbx
jne 0x1400035a2
mov eax, esi
jmp 0x1400035e1
lea rax, [rbp + 0x48]
cmp qword [rbp + 0x40], rax
je 0x1400035ca
lea rcx, [rbp + 0x40]
call fcn.140017980
nop
jmp 0x1400035d7
mov rcx, rbx
mov rbx, qword [rbx]
call fcn.1400558e4
test rbx, rbx
jne 0x1400035cc
mov eax, 0x8007000e
mov rcx, qword [rbp + 0x450]
xor rcx, rbp
call fcn.14004a750
mov rbx, qword [rbp + 0x4a0]
lea rsp, [rbp + 0x460]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80070216
call fcn.140002490
nop
mov ecx, 0x80070216
call fcn.140002490
nop
mov ecx, 0x80004005
call fcn.140002490
int3
mov ecx, 0x80070057
call fcn.140002490
int3
mov ecx, 0x8007000e
call fcn.140002490
int3