Function at 0x1800147d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1ad8]
mov eax, 0x1bd8
call fcn.180277d90
sub rsp, rax
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov rax, qword [0x1803c56a8]
xor rax, rsp
mov qword [rbp + 0x1ac0], rax
mov byte [rsp + 0x40], r9b
mov byte [rsp + 0x41], r8b
movzx r13d, dl
mov r15, rcx
mov r14, qword [rbp + 0x1b40]
mov rsi, qword [rbp + 0x1b48]
xor eax, eax
mov dword [rsp + 0x44], eax
call fcn.1800fd458
mov rdx, rax
lea rcx, [rsp + 0x42]
call fcn.180038170
nop
cmp byte [0x1803cfad0], 0
jne 0x180014857
mov ebx, 1
jmp 0x180014b99
test r15, r15
jne 0x180014865
lea ebx, [r15 + 3]
jmp 0x180014b99
mov rdi, 0xffffffffffffffff
test rsi, rsi
je 0x1800148a7
mov rax, rdi
inc rax
cmp word [rsi + rax*2], 0
jne 0x180014874
test rax, rax
je 0x1800148a7
mov rdx, rsi
lea rcx, [rbp - 0x70]
call fcn.18001c5f0
xor edx, edx
mov rcx, rax
call fcn.1800385a0
test al, al
jne 0x1800148a7
mov ebx, 7
jmp 0x180014b99
call fcn.1800ed608
cmp qword [rax + 0x18], 0
je 0x1800148be
call fcn.1800ed608
mov rbx, qword [rax + 0x18]
jmp 0x1800148ce
mov rbx, qword [0x1803cfb68]
call fcn.1800ed608
mov qword [rax + 0x18], rbx
mov edx, 0x65
lea r8d, [rdx - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r12, rax
test r14, r14
je 0x18001490f
mov rdx, r14
lea rcx, [rsp + 0x68]
call fcn.18000d360
nop
mov ebx, 1
xor r14d, r14d
jmp 0x1800149c6
mov rcx, r15
call fcn.18002a920
lea rcx, [rax + 0x28]
mov r8d, 0x2db
lea rdx, [rsp + 0x78]
call fcn.18001fa20
nop
lea rcx, [rsp + 0x78]
call fcn.18001cd10
mov rbx, rax
call fcn.1800ed100
mov rcx, rax
test rax, rax
je 0x180014bd3
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.18000e8d0
test al, al
jne 0x1800149af
test rbx, rbx
jne 0x180014987
xor r14d, r14d
mov eax, r14d
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.180012730
jmp 0x1800149b2
mov rax, rdi
nop word [rax + rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x180014990
xor r14d, r14d
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.180012730
jmp 0x1800149b2
xor r14d, r14d
lea rcx, [rsp + 0x78]
call fcn.18001c780
lea rax, [rsp + 0x50]
mov ebx, 6
mov dword [rsp + 0x44], ebx
mov rcx, qword [rax]
sub rcx, 0x18
call fcn.18000e9d0
add rax, 0x18
mov qword [rsp + 0x58], rax
test bl, 2
je 0x180014a0d
and ebx, 0xfffffffd
mov dword [rsp + 0x44], ebx
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x180014a09
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov ebx, dword [rsp + 0x44]
test bl, 1
je 0x180014a30
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x180014a30
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call fcn.1800ed100
mov rcx, rax
test rax, rax
je 0x180014bde
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
test rsi, rsi
je 0x180014aab
mov rcx, rdi
nop dword [rax + rax]
inc rcx
cmp word [rsi + rcx*2], 0
jne 0x180014a60
test rcx, rcx
je 0x180014aab
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.18000d360
nop
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.18000db10
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x180014afe
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x180014afe
lea rdx, [rax - 0x18]
mov rbx, qword [rdx]
cmp dword [rdx + 8], 0
je 0x180014afe
cmp dword [rdx + 0x10], 0
jge 0x180014ad7
cmp dword [rax - 0xc], 0
jl 0x180014bc8
mov dword [rax - 0x10], r14d
mov rax, qword [rsp + 0x48]
mov word [rax], r14w
jmp 0x180014afe
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x180014aec
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
movsx eax, byte [rsp + 0x40]
movsx r9d, byte [rsp + 0x41]
movsx r8d, r13b
mov qword [rsp + 0x38], r14
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], eax
mov rdx, r15
lea rcx, [rbp - 0x50]
call fcn.18000d4a0
nop
xor r8d, r8d
mov rdx, r12
lea rcx, [rbp - 0x50]
call fcn.1800f9204
lea rcx, [rbp - 0x50]
call fcn.1800f8e38
mov ebx, r14d
lea rcx, [rbp - 0x50]
call fcn.18000d890
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x180014b7b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x180014b99
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
nop
lea rcx, [rsp + 0x42]
call fcn.18000eb90
mov eax, ebx
mov rcx, qword [rbp + 0x1ac0]
xor rcx, rsp
call fcn.180277e00
add rsp, 0x1bd8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80070057
call fcn.18000def0
nop
mov ecx, 0x80004005
call fcn.18000def0
nop
mov ecx, 0x80004005
call fcn.18000def0
int3