Function at 0x140029fc0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x260
mov rax, qword [0x1400962f8]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdi, qword [0x140099618]
mov ebp, ecx
mov r14d, 0x409
test rdi, rdi
jne 0x14002a173
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002a0c5
mov ebx, 0x104
lea rdx, [rsp + 0x40]
mov r8d, ebx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x14002a032
mov rax, rdi
jmp 0x14002a0da
mov edx, 0x5c
lea rcx, [rsp + 0x40]
call fcn.140049608
test rax, rax
je 0x14002a04c
add rax, 2
jmp 0x14002a051
lea rax, [rsp + 0x40]
mov word [rax], di
mov rcx, 0xffffffffffffffff
lea rax, [rsp + 0x40]
inc rcx
cmp word [rax + rcx*2], di
jne 0x14002a060
lea rax, [rcx + 1]
cmp rax, rbx
jae 0x14002a0be
lea rax, [rcx + 0xd]
lea r8, str.eclsLang.dll
cmp rax, rbx
ja 0x14002a096
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.14005ec5c
lea rcx, [rsp + 0x40]
jmp 0x14002a0cc
lfence
sub rbx, rcx
lea rax, [rsp + 0x40]
mov r9d, 0x103
mov rdx, rbx
sub r9, rcx
lea rcx, [rax + rcx*2]
call fcn.1400580e8
mov word [rsp + 0x246], di
lea rcx, [rsp + 0x40]
jmp 0x14002a0cc
lea rcx, str.eclsLang.dll
mov r8d, 2
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [0x140099618], rax
test rax, rax
jne 0x14002a0fa
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
mov qword [0x140099618], rax
jmp 0x14002a173
mov ebx, r14d
mov qword [rsp + 0x38], rdi
mov r9d, 0x20019
mov dword [rsp + 0x30], ebx
lea r8, [rsp + 0x38]
mov byte [rsp + 0x20], 1
lea rdx, str.SoftwareESETESET_SecurityCurrentVersionInfo
mov rcx, 0xffffffff80000002
call fcn.140042e50
test al, al
je 0x14002a166
mov rdi, qword [rsp + 0x38]
test rdi, rdi
je 0x14002a166
lea r8, [rsp + 0x30]
mov rcx, rdi
lea rdx, str.LanguageId
call fcn.140042fe0
mov ebx, dword [rsp + 0x30]
test al, al
mov rcx, rdi
cmove ebx, r14d
call qword [0x1400961f8]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rdi, qword [0x140099618]
mov dword [0x140096f20], ebx
movzx r9d, word [0x140096f20]
movzx eax, bp
shr ax, 4
mov edx, 6
inc ax
mov rcx, rdi
movzx esi, ax
movzx ebx, bp
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
je 0x14002a1e4
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
je 0x14002a1e4
movzx ecx, word [rax]
lea rax, [rax + 2]
and ebx, 0xf
je 0x14002a1e0
nop word [rax + rax]
lea rax, [rax + rcx*2]
movzx ecx, word [rax]
add rax, 2
sub ebx, 1
jne 0x14002a1d0
test ecx, ecx
jne 0x14002a24b
mov r9d, r14d
mov r8, rsi
mov edx, 6
mov rcx, rdi
movzx ebx, bp
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
je 0x14002a244
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
je 0x14002a244
movzx ecx, word [rax]
lea rax, [rax + 2]
and ebx, 0xf
je 0x14002a240
nop word [rax + rax]
lea rax, [rax + rcx*2]
movzx ecx, word [rax]
add rax, 2
sub ebx, 1
jne 0x14002a230
test ecx, ecx
jne 0x14002a24b
lea rax, [0x140087970]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140047b10
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret