Function at 0x1000254d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 8], ecx
mov rax, rsp
sub rsp, 0xb8
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax - 8], rbx
mov qword [rax - 0x10], rbp
mov qword [rax - 0x18], rsi
mov qword [rax - 0x20], rdi
mov qword [rax - 0x28], r12
mov qword [rax - 0x30], r13
mov qword [rax - 0x38], r14
mov qword [rax - 0x40], r15
mov r15, r8
mov ebx, edx
mov r12d, ecx
lea rcx, [0x1000a9318]
mov rax, qword [0x1000a9318]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x48], rax
lea rcx, [0x1000a9318]
mov rax, qword [0x1000a9318]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x30], rax
xor edx, edx
mov r13d, edx
mov r14d, edx
mov esi, 1
mov dword [rsp + 0x20], esi
mov dword [rsp + 0x40], esi
mov rdi, qword [rsp + 0xe8]
mov dword [rdi], edx
mov rcx, qword [rsp + 0xf0]
mov dword [rcx], edx
mov eax, 0xf
cmp dword [0x1000a8a50], edx
cmovne eax, edx
mov rdx, qword [rsp + 0xf8]
mov dword [rdx], eax
mov eax, dword [0x1000a8998]
test eax, eax
jne 0x1000257e3
xor r12d, r12d
mov rbx, r12
xor edx, edx
lea rcx, [0x1000a92a0]
call fcn.100047064
mov rdi, rax
mov ebp, esi
test rax, rax
je 0x100025692
test rbx, rbx
jne 0x100025692
xor r9d, r9d
lea edx, [rbx + 6]
mov r8d, 0x13d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
mov rsi, rax
test rax, rax
jne 0x1000255ee
mov rbx, r12
jmp 0x100025659
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x100025604
mov rbx, r12
jmp 0x100025654
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
jne 0x10002561a
mov rbx, r12
jmp 0x100025654
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, eax
add rdx, rbx
mov ecx, 5
cmp rbx, rdx
jae 0x100025647
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
add ecx, 0xffffffff
jne 0x100025630
cmp rbx, rdx
jb 0x10002564c
mov rbx, r12
jmp 0x100025654
cmp word [rbx], r12w
cmove rbx, r12
test rbx, rbx
jne 0x100025677
mov edx, ebp
lea rcx, [0x1000a92a0]
call fcn.100047064
mov rdi, rax
inc ebp
test rax, rax
jne 0x1000255c3
jmp 0x100025692
test rdi, rdi
je 0x100025692
mov r8d, 0x13c5
mov rdx, rdi
mov rcx, qword [rsp + 0xd8]
call fcn.1000149f0
mov rbx, r12
xor edx, edx
lea rcx, [0x1000a92a0]
call fcn.100047064
mov rdi, rax
test rax, rax
je 0x10002578b
nop
test rbx, rbx
jne 0x10002578b
xor r9d, r9d
lea edx, [rbx + 6]
mov r8d, 0x13a
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
mov rsi, rax
test rax, rax
jne 0x1000256db
mov rbx, r12
jmp 0x100025749
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x1000256f1
mov rbx, r12
jmp 0x100025744
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
jne 0x100025707
mov rbx, r12
jmp 0x100025744
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, eax
add rdx, rbx
mov ecx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
nop
cmp rbx, rdx
jae 0x100025737
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
add ecx, 0xffffffff
jne 0x100025720
cmp rbx, rdx
jb 0x10002573c
mov rbx, r12
jmp 0x100025744
cmp word [rbx], r12w
cmove rbx, r12
test rbx, rbx
jne 0x10002576f
mov esi, dword [rsp + 0x20]
mov edx, esi
lea rcx, [0x1000a92a0]
call fcn.100047064
mov rdi, rax
inc esi
mov dword [rsp + 0x20], esi
test rax, rax
jne 0x1000256b0
jmp 0x10002578b
test rdi, rdi
je 0x10002578b
mov r8d, 0x139c
mov rdx, rdi
mov rcx, qword [rsp + 0xe0]
call fcn.1000149f0
nop
lea rax, [rsp + 0x30]
mov qword [rsp + 0xe8], rax
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov esi, 0xffffffff
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1000257bd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x28]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x1000265c3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x1000265c3
cmp eax, esi
jne 0x100025a33
xor r12d, r12d
mov rbx, r12
xor edx, edx
lea rcx, [0x1000a92a0]
call fcn.100047064
mov rdi, rax
mov ebp, esi
test rax, rax
je 0x1000258e2
nop
test rbx, rbx
jne 0x1000258e2
xor r9d, r9d
lea edx, [rbx + 6]
mov r8d, 0x13d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
mov rsi, rax
test rax, rax
jne 0x10002583b
mov rbx, r12
jmp 0x1000258a9
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x100025851
mov rbx, r12
jmp 0x1000258a4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
jne 0x100025867
mov rbx, r12
jmp 0x1000258a4
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, eax
add rdx, rbx
mov ecx, 5
nop
cmp rbx, rdx
jae 0x100025897
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
add ecx, 0xffffffff
jne 0x100025880
cmp rbx, rdx
jb 0x10002589c
mov rbx, r12
jmp 0x1000258a4
cmp word [rbx], r12w
cmove rbx, r12
test rbx, rbx
jne 0x1000258c7
mov edx, ebp
lea rcx, [0x1000a92a0]
call fcn.100047064
mov rdi, rax
inc ebp
test rax, rax
jne 0x100025810
jmp 0x1000258e2
test rdi, rdi
je 0x1000258e2
mov r8d, 0x13c5
mov rdx, rdi
mov rcx, qword [rsp + 0xd8]
call fcn.1000149f0
mov rbx, r12
xor edx, edx
lea rcx, [0x1000a92a0]
call fcn.100047064
mov rdi, rax
test rax, rax
je 0x1000259db
nop
test rbx, rbx
jne 0x1000259db
xor r9d, r9d
lea edx, [rbx + 6]
mov r8d, 0x13b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
mov rsi, rax
test rax, rax
jne 0x10002592b
mov rbx, r12
jmp 0x100025999
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x100025941
mov rbx, r12
jmp 0x100025994
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
jne 0x100025957
mov rbx, r12
jmp 0x100025994
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, eax
add rdx, rbx
mov ecx, 0xe
nop
cmp rbx, rdx
jae 0x100025987
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
add ecx, 0xffffffff
jne 0x100025970
cmp rbx, rdx
jb 0x10002598c
mov rbx, r12
jmp 0x100025994
cmp word [rbx], r12w
cmove rbx, r12
test rbx, rbx
jne 0x1000259bf
mov esi, dword [rsp + 0x20]
mov edx, esi
lea rcx, [0x1000a92a0]
call fcn.100047064
mov rdi, rax
inc esi
mov dword [rsp + 0x20], esi
test rax, rax
jne 0x100025900
jmp 0x1000259db
test rdi, rdi
je 0x1000259db
mov r8d, 0x13ae
mov rdx, rdi
mov rcx, qword [rsp + 0xe0]
call fcn.1000149f0
nop
lea rax, [rsp + 0x30]
mov qword [rsp + 0xe8], rax
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov esi, 0xffffffff
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x100025a0d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x28]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x1000265c3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x1000265c3
test ebx, ebx
je 0x100025ead
mov rbx, r13
xor edx, edx
lea rcx, [0x1000a92a0]
call fcn.100047064
mov rdi, rax
mov ebp, esi
test rax, rax
je 0x100025b48
nop
nop
test rbx, rbx
jne 0x100025b3c
xor r9d, r9d
lea edx, [rbx + 6]
mov r8d, 0x13d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
mov rsi, rax
test rax, rax
jne 0x100025a8b
mov rbx, r13
jmp 0x100025af9
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x100025aa1
mov rbx, r13
jmp 0x100025af4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
jne 0x100025ab7
mov rbx, r13
jmp 0x100025af4
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, eax
add rdx, rbx
mov ecx, 5
nop
cmp rbx, rdx
jae 0x100025ae7
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
add ecx, 0xffffffff
jne 0x100025ad0
cmp rbx, rdx
jb 0x100025aec
mov rbx, r13
jmp 0x100025af4
cmp word [rbx], r13w
cmove rbx, r13
test rbx, rbx
jne 0x100025b1a
mov edx, ebp
lea rcx, [0x1000a92a0]
call fcn.100047064
mov rdi, rax
inc ebp
test rax, rax
jne 0x100025a60
lea esi, [rax + 1]
jmp 0x100025b48
test rdi, rdi
je 0x100025b43
mov r8d, 0x13c5
mov rdx, rdi
mov rcx, qword [rsp + 0xd8]
call fcn.1000149f0
mov esi, 1
jmp 0x100025b48
mov esi, 1
jmp 0x100025b48
mov esi, 1
mov rbx, r13
xor edx, edx
lea rcx, [0x1000a92a0]
call fcn.100047064
mov rdi, rax
mov ebp, esi
mov r15, qword [rsp + 0xe0]
test rax, rax
je 0x100025c3d
nop
test rbx, rbx
jne 0x100025c3d
xor r9d, r9d
lea edx, [rbx + 6]
mov r8d, 0x13e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
mov rsi, rax
test rax, rax
jne 0x100025b9b
mov rbx, r13
jmp 0x100025c09
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x100025bb1
mov rbx, r13
jmp 0x100025c04
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
jne 0x100025bc7
mov rbx, r13
jmp 0x100025c04
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, eax
add rdx, rbx
mov ecx, 6
nop
cmp rbx, rdx
jae 0x100025bf7
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
add ecx, 0xffffffff
jne 0x100025be0
cmp rbx, rdx
jb 0x100025bfc
mov rbx, r13
jmp 0x100025c04
cmp word [rbx], r13w
cmove rbx, r13
test rbx, rbx
jne 0x100025c27
mov edx, ebp
lea rcx, [0x1000a92a0]
call fcn.100047064
mov rdi, rax
inc ebp
test rax, rax
jne 0x100025b70
jmp 0x100025c3d
test rdi, rdi
je 0x100025c3d
mov r8d, 0x13d6
mov rdx, rdi
mov rcx, r15
call fcn.1000149f0
mov esi, 0xffffffff
test r12d, r12d
je 0x100025e5a
lea rcx, [0x1000a9318]
mov rax, qword [0x1000a9318]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0xf0], rbx
mov rdi, r13
xor edx, edx
lea rcx, [0x1000a92a0]
call fcn.100047064
mov rbp, rax
lea r14d, [rsi + 2]
test rax, rax
je 0x100025e22
lea r13d, [rsi + 4]
nop
test rdi, rdi
jne 0x100025e22
xor r9d, r9d
lea edx, [rdi + 6]
mov r8d, 0x13b
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
mov r12, rax
test rax, rax
jne 0x100025cbb
mov rdi, rax
jmp 0x100025d26
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x100025cd1
mov rdi, rax
jmp 0x100025d21
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
je 0x100025d21
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, eax
add rdx, rdi
mov ecx, r13d
cmp rdi, rdx
jae 0x100025d0d
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
add ecx, 0xffffffff
jne 0x100025cf6
cmp rdi, rdx
jb 0x100025d14
xor eax, eax
mov rdi, rax
jmp 0x100025d21
cmp word [rdi], 0
mov eax, 0
cmove rdi, rax
test rdi, rdi
jne 0x100025d49
mov edx, r14d
lea rcx, [0x1000a92a0]
call fcn.100047064
mov rbp, rax
inc r14d
test rax, rax
jne 0x100025c90
jmp 0x100025e22
test rbp, rbp
je 0x100025e22
mov edx, 0x13b
mov r8d, 6
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r12, rax
test rax, rax
je 0x100025e22
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x100025e22
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
je 0x100025e22
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rdi
nop
cmp rdi, rcx
jae 0x100025e22
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
add r13d, 0xffffffff
jne 0x100025db0
cmp rdi, rcx
jae 0x100025e22
movzx eax, word [rdi]
test ax, ax
je 0x100025e22
movzx ebp, ax
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, ebp
or eax, ecx
jge 0x100025dfb
mov edx, ebp
lea rcx, [rsp + 0xf0]
call fcn.1000140c0
mov rbx, qword [rsp + 0xf0]
lea r12, [rbp + rbp]
lea rdx, [rdi + 2]
mov r8, r12
mov rcx, rbx
call sub.msvcrt.dll_memcpy
test ebp, ebp
js 0x100025e4f
cmp ebp, dword [rbx - 0xc]
jg 0x100025e4f
mov dword [rbx - 0x10], ebp
mov word [r12 + rbx], 0
lea rdx, [rsp + 0xf0]
mov rcx, r15
call fcn.100016c30
nop
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x100025e5a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x100025e5a
mov ecx, 0x80070057
call fcn.100013860
nop
lea rax, [rsp + 0x30]
mov qword [rsp + 0xe8], rax
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x100025e87
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x28]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x1000265c3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x1000265c3
cmp qword [r15 + 0x10], r13
jne 0x100026103
xor r12d, r12d
mov rbx, r12
xor edx, edx
lea rcx, [0x1000a92a0]
call fcn.100047064
mov rdi, rax
mov ebp, esi
test rax, rax
je 0x100025fb2
nop
nop
test rbx, rbx
jne 0x100025fb2
xor r9d, r9d
lea edx, [rbx + 6]
mov r8d, 0x13d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
mov rsi, rax
test rax, rax
jne 0x100025f0b
mov rbx, r12
jmp 0x100025f79
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x100025f21
mov rbx, r12
jmp 0x100025f74
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
jne 0x100025f37
mov rbx, r12
jmp 0x100025f74
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, eax
add rdx, rbx
mov ecx, 5
nop
cmp rbx, rdx
jae 0x100025f67
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
add ecx, 0xffffffff
jne 0x100025f50
cmp rbx, rdx
jb 0x100025f6c
mov rbx, r12
jmp 0x100025f74
cmp word [rbx], r12w
cmove rbx, r12
test rbx, rbx
jne 0x100025f97
mov edx, ebp
lea rcx, [0x1000a92a0]
call fcn.100047064
mov rdi, rax
inc ebp
test rax, rax
jne 0x100025ee0
jmp 0x100025fb2
test rdi, rdi
je 0x100025fb2
mov r8d, 0x13c5
mov rdx, rdi
mov rcx, qword [rsp + 0xd8]
call fcn.1000149f0
mov rbx, r12
xor edx, edx
lea rcx, [0x1000a92a0]
call fcn.100047064
mov rdi, rax
test rax, rax
je 0x1000260ab
nop
test rbx, rbx
jne 0x1000260ab
xor r9d, r9d
lea edx, [rbx + 6]
mov r8d, 0x13a
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
mov rsi, rax
test rax, rax
jne 0x100025ffb
mov rbx, r12
jmp 0x100026069
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x100026011
mov rbx, r12
jmp 0x100026064
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
jne 0x100026027
mov rbx, r12
jmp 0x100026064
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, eax
add rdx, rbx
mov ecx, 0xd
nop
cmp rbx, rdx
jae 0x100026057
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
add ecx, 0xffffffff
jne 0x100026040
cmp rbx, rdx
jb 0x10002605c
mov rbx, r12
jmp 0x100026064
cmp word [rbx], r12w
cmove rbx, r12
test rbx, rbx
jne 0x10002608f
mov esi, dword [rsp + 0x20]
mov edx, esi
lea rcx, [0x1000a92a0]
call fcn.100047064
mov rdi, rax
inc esi
mov dword [rsp + 0x20], esi
test rax, rax
jne 0x100025fd0
jmp 0x1000260ab
test rdi, rdi
je 0x1000260ab
mov r8d, 0x139d
mov rdx, rdi
mov rcx, qword [rsp + 0xe0]
call fcn.1000149f0
nop
lea rax, [rsp + 0x30]
mov qword [rsp + 0xe8], rax
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov esi, 0xffffffff
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1000260dd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x28]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x1000265c3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x1000265c3
mov dword [rcx], esi
mov rbp, qword [r15]
mov esi, 0xffffffff
test rbp, rbp
je 0x100026277
nop
nop
nop
mov rdi, rbp
mov rbp, qword [rbp]
mov rdx, qword [rdi + 0x10]
lea rcx, [rdx - 0x18]
mov rbx, qword [rsp + 0x28]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x100026187
cmp dword [rbx + 0x10], 0
jl 0x100026179
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x100026179
call fcn.100014130
mov r12, rax
mov ecx, esi
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x10002616d
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [r12 + 0x18]
mov qword [rsp + 0x28], rax
jmp 0x100026187
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x28]
call fcn.100014b20
mov rdx, qword [rdi + 0x18]
lea rcx, [rdx - 0x18]
mov rbx, qword [rsp + 0x30]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x1000261e7
cmp dword [rbx + 0x10], 0
jl 0x1000261d9
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x1000261d9
call fcn.100014130
mov r12, rax
mov ecx, esi
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x1000261cd
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [r12 + 0x18]
mov qword [rsp + 0x30], rax
jmp 0x1000261e7
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x30]
call fcn.100014b20
mov eax, dword [rdi + 0x20]
mov dword [rsp + 0x38], eax
test eax, eax
jle 0x100026203
cmp eax, 3
jle 0x1000261fe
cmp eax, 4
jne 0x100026203
jmp 0x100026206
inc r14d
jmp 0x100026206
inc r13d
test rbp, rbp
jne 0x100026120
test r13d, r13d
je 0x100026267
test r14d, r14d
jne 0x100026255
mov edx, 0x13c5
mov rcx, qword [rsp + 0xd8]
call fcn.100015e20
mov edx, 0x13a1
mov r15, qword [rsp + 0xe0]
mov rcx, r15
call fcn.100015e20
mov rax, qword [rsp + 0xf8]
mov dword [rax], 4
xor edi, edi
jmp 0x100026326
mov rdi, qword [rsp + 0xe8]
mov r12d, dword [rsp + 0xc0]
jmp 0x100026277
mov rdi, qword [rsp + 0xe8]
mov r12d, dword [rsp + 0xc0]
lea rcx, [rsp + 0x58]
call fcn.100020060
nop
mov rdx, rax
mov rcx, qword [rsp + 0xd8]
call fcn.100015fc0
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1000262b2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test r13d, r13d
je 0x1000262dd
mov edx, 0x13ba
mov r15, qword [rsp + 0xe0]
mov rcx, r15
call fcn.100015e20
test r12d, r12d
je 0x100026538
xor edi, edi
mov dword [rsp + 0x40], edi
jmp 0x100026326
mov rdx, r15
lea rcx, [rsp + 0x50]
call fcn.1000249a0
nop
mov rdx, rax
mov r15, qword [rsp + 0xe0]
mov rcx, r15
call fcn.100015fc0
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x10002631e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov dword [rdi], 1
xor edi, edi
cmp dword [rsp + 0xc0], 0
je 0x100026531
lea rcx, [0x1000a9318]
mov rax, qword [0x1000a9318]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x20], rbx
xor edx, edx
lea rcx, [0x1000a92a0]
call fcn.100047064
mov rbp, rax
mov r14d, 1
test rax, rax
je 0x1000264fc
lea r13d, [r14 + 2]
test rdi, rdi
jne 0x1000264fc
xor r9d, r9d
lea edx, [rdi + 6]
mov r8d, 0x13b
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
mov r12, rax
test rax, rax
jne 0x10002639d
mov rdi, rax
jmp 0x100026408
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x1000263b3
mov rdi, rax
jmp 0x100026403
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
je 0x100026403
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, eax
add rdx, rdi
mov ecx, r13d
cmp rdi, rdx
jae 0x1000263ef
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
add ecx, 0xffffffff
jne 0x1000263d8
cmp rdi, rdx
jb 0x1000263f6
xor eax, eax
mov rdi, rax
jmp 0x100026403
cmp word [rdi], 0
mov eax, 0
cmove rdi, rax
test rdi, rdi
jne 0x10002642b
mov edx, r14d
lea rcx, [0x1000a92a0]
call fcn.100047064
mov rbp, rax
inc r14d
test rax, rax
jne 0x100026372
jmp 0x1000264fc
test rbp, rbp
je 0x1000264fc
mov edx, 0x13b
mov r8d, 6
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r12, rax
test rax, rax
je 0x1000264fc
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1000264fc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
je 0x1000264fc
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rdi
nop
cmp rdi, rcx
jae 0x1000264fc
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
add r13d, 0xffffffff
jne 0x100026490
cmp rdi, rcx
jae 0x1000264fc
movzx eax, word [rdi]
test ax, ax
je 0x1000264fc
movzx ebp, ax
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, ebp
or eax, ecx
jge 0x1000264d5
mov edx, ebp
lea rcx, [rsp + 0x20]
call fcn.1000140c0
mov rbx, qword [rsp + 0x20]
lea r12, [rbp + rbp]
lea rdx, [rdi + 2]
mov r8, r12
mov rcx, rbx
call sub.msvcrt.dll_memcpy
test ebp, ebp
js 0x100026526
cmp ebp, dword [rbx - 0xc]
jg 0x100026526
mov dword [rbx - 0x10], ebp
mov word [r12 + rbx], 0
lea rdx, [rsp + 0x20]
mov rcx, r15
call fcn.100016c30
nop
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x100026531
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x100026531
mov ecx, 0x80070057
call fcn.100013860
nop
cmp dword [rsp + 0x40], 0
je 0x100026579
mov r8, r15
lea rdx, [0x100003260]
lea rcx, [rsp + 0x48]
call fcn.100022910
nop
mov rdx, rax
mov rcx, r15
call fcn.100015fc0
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x100026579
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rax, [rsp + 0x30]
mov qword [rsp + 0xe8], rax
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1000265a6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x28]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x1000265c3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0xb0]
mov rbp, qword [rsp + 0xa8]
mov rsi, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0x98]
mov r12, qword [rsp + 0x90]
mov r13, qword [rsp + 0x88]
mov r14, qword [rsp + 0x80]
mov r15, qword [rsp + 0x78]
add rsp, 0xb8
ret