Function at 0x411c1740
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x14a0
call fcn.41295c90
sub rsp, rax
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rsp + 0x14d8], rbx
mov qword [rsp + 0x14e0], rbp
mov qword [rsp + 0x14e8], rsi
mov rax, qword [0x41359af8]
xor rax, rsp
mov qword [rsp + 0x1490], rax
mov r14, rcx
mov dword [rcx], 1
mov word [rsp + 0x100], 0
xor edx, edx
mov r8d, 0x3e6
lea rcx, [rsp + 0x102]
call fcn.412121c0
lea rcx, [rsp + 0x70]
call fcn.4120a860
nop
lea r8, str.DICT
lea rdx, str.ZFHDATA
mov rcx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
jne 0x411c1813
lea rax, [0x412a4888]
mov qword [rsp + 0x70], rax
lea rax, [0x41361370]
mov rcx, qword [rsp + 0xc8]
cmp rcx, rax
je 0x411c1802
call fcn.41212980
lea rcx, [rsp + 0x70]
call fcn.4120a4b0
xor eax, eax
jmp 0x411c1cf8
mov rdx, rax
mov rcx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rsi, rax
mov rdx, rdi
mov rcx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
lea eax, [rbx + 1]
mov edi, eax
mov ecx, eax
call fcn.4120fd60
mov r15, rax
mov qword [rsp + 0x20], rax
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.412121c0
mov r8, rbx
mov rdx, rsi
mov rcx, r15
call fcn.4121e450
xor r9d, r9d
xor r8d, r8d
mov rdx, r15
lea rcx, [rsp + 0x70]
call fcn.4120e060
lea rdx, str.Symbol
lea rcx, [rsp + 0x70]
call fcn.41209d70
test rax, rax
jne 0x411c18c9
lea rax, [0x412a4888]
mov qword [rsp + 0x70], rax
lea rax, [0x41361370]
mov rcx, qword [rsp + 0xc8]
cmp rcx, rax
je 0x411c18b8
call fcn.41212980
lea rcx, [rsp + 0x70]
call fcn.4120a4b0
xor eax, eax
jmp 0x411c1cf8
lea rdx, str.SymbolList
mov rcx, rax
call fcn.41209e00
mov rcx, rax
call fcn.41209dc0
mov r13, rax
mov word [rsp + 0x4f0], 0
xor edx, edx
mov r8d, 0xf9e
lea rcx, [rsp + 0x4f2]
call fcn.412121c0
test r13, r13
je 0x411c1cb6
xor r12d, r12d
movabs r15, 0x7ffffffffffffffe
nop
nop
mov ecx, 0x50
call fcn.41211580
mov rbx, rax
test rax, rax
je 0x411c1958
mov qword [rax + 0x20], 7
mov qword [rax + 0x18], r12
mov word [rax + 8], 0
mov qword [rax + 0x48], 7
mov qword [rax + 0x40], r12
mov word [rax + 0x30], 0
jmp 0x411c195b
mov rbx, r12
lea rdx, [0x412bab78]
mov rcx, r13
call fcn.4120b8a0
test rax, rax
je 0x411c1a8b
lea rdx, [rsp + 0x100]
mov rcx, rax
call fcn.41035a10
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x100]
repne scasw ax, word [rdi]
not rcx
lea rsi, [rcx - 1]
mov rdx, qword [rbx + 0x20]
cmp rdx, 8
jb 0x411c19ae
lea rdi, [rbx + 8]
mov rax, qword [rdi]
jmp 0x411c19b5
lea rdi, [rbx + 8]
mov rax, rdi
lea rcx, [rsp + 0x100]
cmp rcx, rax
jb 0x411c1a0c
cmp rdx, 8
jb 0x411c19cd
mov rcx, qword [rdi]
jmp 0x411c19d0
mov rcx, rdi
mov rax, qword [rbx + 0x18]
lea rcx, [rcx + rax*2]
lea rax, [rsp + 0x100]
cmp rcx, rax
jbe 0x411c1a0c
cmp rdx, 8
jb 0x411c19ee
mov rdi, qword [rdi]
lea r8, [rsp + 0x100]
sub r8, rdi
sar r8, 1
mov r9, rsi
mov rdx, rbx
mov rcx, rbx
call fcn.41022de0
jmp 0x411c1a8b
cmp rsi, r15
jbe 0x411c1a16
call fcn.4120fbc0
mov rax, qword [rbx + 0x20]
cmp rax, rsi
jae 0x411c1a30
mov r8, qword [rbx + 0x18]
mov rdx, rsi
mov rcx, rbx
call fcn.41022ab0
jmp 0x411c1a49
test rsi, rsi
jne 0x411c1a49
mov qword [rbx + 0x18], r12
cmp rax, 8
jb 0x411c1a42
mov rdi, qword [rdi]
mov word [rdi], 0
jmp 0x411c1a8b
test rsi, rsi
je 0x411c1a8b
mov rdx, qword [rbx + 0x20]
cmp rdx, 8
jb 0x411c1a5d
mov rcx, qword [rdi]
jmp 0x411c1a60
mov rcx, rdi
lea rbp, [rsi + rsi]
add rdx, rdx
mov r9, rbp
lea r8, [rsp + 0x100]
call fcn.412118b0
mov qword [rbx + 0x18], rsi
cmp qword [rbx + 0x20], 8
jb 0x411c1a85
mov rdi, qword [rdi]
mov word [rdi + rbp], 0
mov rcx, r13
call fcn.41209f60
test rax, rax
je 0x411c1bbf
lea rdx, [rsp + 0x4f0]
mov rcx, rax
call fcn.41035a10
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x4f0]
repne scasw ax, word [rdi]
not rcx
lea rbp, [rcx - 1]
mov rdx, qword [rbx + 0x48]
cmp rdx, 8
jb 0x411c1ad7
lea rdi, [rbx + 0x30]
mov rax, qword [rdi]
jmp 0x411c1ade
lea rdi, [rbx + 0x30]
mov rax, rdi
lea rcx, [rsp + 0x4f0]
cmp rcx, rax
jb 0x411c1b3a
cmp rdx, 8
jb 0x411c1af6
mov rcx, qword [rdi]
jmp 0x411c1af9
mov rcx, rdi
mov rax, qword [rbx + 0x40]
lea rcx, [rcx + rax*2]
lea rax, [rsp + 0x4f0]
cmp rcx, rax
jbe 0x411c1b3a
cmp rdx, 8
jb 0x411c1b17
mov rdi, qword [rdi]
lea r8, [rsp + 0x4f0]
sub r8, rdi
sar r8, 1
mov r9, rbp
lea rdx, [rbx + 0x28]
lea rcx, [rbx + 0x28]
call fcn.41022de0
jmp 0x411c1bbf
cmp rbp, r15
jbe 0x411c1b44
call fcn.4120fbc0
mov rax, qword [rbx + 0x48]
cmp rax, rbp
jae 0x411c1b5f
mov r8, qword [rbx + 0x40]
mov rdx, rbp
lea rcx, [rbx + 0x28]
call fcn.41022ab0
jmp 0x411c1b78
test rbp, rbp
jne 0x411c1b78
mov qword [rbx + 0x40], r12
cmp rax, 8
jb 0x411c1b71
mov rdi, qword [rdi]
mov word [rdi], 0
jmp 0x411c1bbf
test rbp, rbp
je 0x411c1bbf
mov rdx, qword [rbx + 0x48]
cmp rdx, 8
jb 0x411c1b8c
mov rcx, qword [rdi]
jmp 0x411c1b8f
mov rcx, rdi
lea r12, [rbp + rbp]
add rdx, rdx
mov r9, r12
lea r8, [rsp + 0x4f0]
call fcn.412118b0
mov qword [rbx + 0x40], rbp
cmp qword [rbx + 0x48], 8
jb 0x411c1bb5
mov rdi, qword [rdi]
mov word [rdi + r12], 0
xor r12d, r12d
mov rcx, r13
call fcn.41209ee0
mov r13, rax
mov r8, rbx
lea rdx, [rsp + 0x28]
mov rcx, qword [r14 + 0x10]
call fcn.4117a2e0
mov rdx, qword [r14 + 0x10]
mov rdi, qword [rdx + 8]
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x411c1bf2
cmp rax, rdx
je 0x411c1bf7
call fcn.41211d60
cmp qword [rsp + 0x30], rdi
jne 0x411c1c57
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], r12
mov word [rsp + 0x40], 0
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.41022de0
mov qword [rsp + 0x60], rbx
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0xe0]
mov rcx, qword [r14 + 0x10]
call fcn.410ed280
nop
cmp qword [rsp + 0x58], 8
jb 0x411c1ca8
mov rcx, qword [rsp + 0x40]
call fcn.41210d60
jmp 0x411c1ca8
test rbx, rbx
je 0x411c1ca8
cmp qword [rbx + 0x48], 8
jb 0x411c1c6c
mov rcx, qword [rbx + 0x30]
call fcn.41210d60
mov qword [rbx + 0x48], 7
mov qword [rbx + 0x40], r12
mov word [rbx + 0x30], 0
cmp qword [rbx + 0x20], 8
jb 0x411c1c8e
mov rcx, qword [rbx + 8]
call fcn.41210d60
mov qword [rbx + 0x20], 7
mov qword [rbx + 0x18], r12
mov word [rbx + 8], 0
mov rcx, rbx
call fcn.41210d60
test r13, r13
jne 0x411c1920
mov r15, qword [rsp + 0x20]
test r15, r15
je 0x411c1cc4
mov rcx, r15
call fcn.41212980
nop
lea rax, [0x412a4888]
mov qword [rsp + 0x70], rax
lea rax, [0x41361370]
mov rcx, qword [rsp + 0xc8]
cmp rcx, rax
je 0x411c1ce9
call fcn.41212980
lea rcx, [rsp + 0x70]
call fcn.4120a4b0
mov eax, 1
mov rcx, qword [rsp + 0x1490]
xor rcx, rsp
call fcn.41211b80
lea r11, [rsp + 0x14a0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret