Function at 0x1800077f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbp
push rdi
push r12
push r14
push r15
sub rsp, 0x490
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x480], rbx
mov qword [rbp + 0x490], rsi
mov rax, qword [0x180240300]
xor rax, rbp
mov qword [rbp + 0x440], rax
mov r12, r9
mov r14, rdx
xor esi, esi
mov ebx, esi
mov qword [rbp + 0x18], rbx
mov qword [rbp + 0x28], rcx
mov qword [rbp + 0x20], rsi
xor edx, edx
mov r8d, 0x408
lea rcx, [rbp + 0x30]
call fcn.1801d8ef0
mov qword [rbp + 0x30], rsi
test r14, r14
je 0x180007ab8
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [r14 + rax*2], 0
jne 0x180007860
inc eax
cdqe
lea r15, [rax + rax]
mov eax, 0x80000000
add rax, r15
mov ecx, 0xffffffff
cmp rax, rcx
ja 0x180007ab8
movsxd rdi, r15d
cmp r15d, 0x400
jg 0x1800078c7
mov rcx, rdi
call fcn.180006b90
test al, al
je 0x1800078c7
lea rax, [rdi + 0xf]
cmp rax, rdi
ja 0x1800078b4
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.18017c370
sub rsp, rax
lea rdi, [rsp + 0x40]
jmp 0x1800078f8
mov rax, rdi
not rax
cmp rax, 0x10
jb 0x180007b12
lea rcx, [rdi + 0x10]
call fcn.1801be08c
test rax, rax
jne 0x1800078ea
mov rdi, rsi
jmp 0x1800078f8
mov qword [rax], rsi
mov rbx, rax
mov qword [rbp + 0x18], rax
lea rdi, [rax + 0x10]
test rdi, rdi
je 0x180007ab4
mov byte [rdi], 0
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rdi
mov r9d, 0xffffffff
mov r8, r14
xor edx, edx
mov ecx, 3
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x180007ab4
xor edx, edx
mov r8d, 0x60
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
mov qword [rbp + 8], rax
test rax, rax
jne 0x18000797c
xor edx, edx
mov r8d, 2
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
mov qword [rbp + 8], rax
test rax, rax
jne 0x18000797c
call fcn.180006c80
mov edi, eax
jmp 0x180007a7e
mov r8, r12
mov edx, 0x65
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdi, rax
test rax, rax
jne 0x18000799f
call fcn.180006c80
jmp 0x180007a6d
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r14, rax
mov qword [rbp + 0x10], rax
test rax, rax
jne 0x1800079c1
call fcn.180006c80
jmp 0x180007a6d
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [rbp], edi
lea eax, [rdi + 1]
cmp eax, edi
jae 0x1800079e3
mov edi, 0x8007000e
jmp 0x180007a6f
mov ecx, eax
test eax, eax
je 0x180007a16
xor edx, edx
mov rax, 0xffffffffffffffff
div rcx
cmp rax, 1
jb 0x180007b1d
cmp rcx, 0x400
jbe 0x180007a16
mov rdx, rcx
lea rcx, [rbp + 0x30]
call fcn.180036f70
jmp 0x180007a1e
lea rax, [rbp + 0x38]
mov qword [rbp + 0x30], rax
jmp 0x180007a2f
cmp qword [rbp + 0x30], 0
jne 0x180007a3d
mov edi, 0x8007000e
jmp 0x180007a6f
test rdi, rdi
je 0x180007a51
mov r8, rdi
mov rdx, r14
mov rcx, qword [rbp + 0x30]
call fcn.1801d8850
mov rax, qword [rbp + 0x30]
mov byte [rdi + rax], 0
mov r8d, dword [rbp + 0x4a0]
mov rdx, qword [rbp + 0x30]
lea rcx, [rbp + 0x20]
call fcn.1800088e0
mov edi, eax
test rsi, rsi
je 0x180007a7e
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rbp + 0x38]
cmp qword [rbp + 0x30], rax
je 0x180007a92
lea rcx, [rbp + 0x30]
call fcn.1800349c0
nop
test rbx, rbx
je 0x180007ab0
nop word [rax + rax]
mov rcx, rbx
mov rbx, qword [rbx]
call fcn.1801b20d8
test rbx, rbx
jne 0x180007aa0
mov eax, edi
jmp 0x180007ae5
mov rsi, qword [rbp + 0x30]
lea rax, [rbp + 0x38]
cmp rsi, rax
je 0x180007acb
lea rcx, [rbp + 0x30]
call fcn.1800349c0
nop
test rbx, rbx
je 0x180007ae0
mov rcx, rbx
mov rbx, qword [rbx]
call fcn.1801b20d8
test rbx, rbx
jne 0x180007ad0
mov eax, 0x8007000e
mov rcx, qword [rbp + 0x440]
xor rcx, rbp
call fcn.18017b580
mov rbx, qword [rbp + 0x480]
mov rsi, qword [rbp + 0x490]
lea rsp, [rbp + 0x450]
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov ecx, 0x80070216
call fcn.180001a70
nop
mov ecx, 0x80070216
call fcn.180001a70
int3