Function at 0x1000fd9b8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
xor r14d, r14d
mov r15, r9
mov rsi, r8
mov rdi, rcx
mov ebx, 0x80070057
test rdx, rdx
jne 0x1000fda24
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000fde25
test byte [rcx + 0x1c], 1
je 0x1000fde25
mov rcx, qword [rcx + 0x10]
lea edx, [r14 + 0x3f]
lea r8, [0x10001dbd8]
call fcn.100034784
jmp 0x1000fde25
call fcn.1000feba8
mov ebx, eax
test eax, eax
jns 0x1000fda6d
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000fde25
test byte [rcx + 0x1c], 1
je 0x1000fde25
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dbd8]
mov edx, 0x40
mov r9d, ebx
call fcn.100036510
jmp 0x1000fde25
xor edx, edx
mov rcx, rsi
lea r8d, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov r12, rax
test rax, rax
jne 0x1000fdad5
call sub.KERNEL32.dll_GetLastError
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000fde18
test byte [rcx + 0x1c], 1
je 0x1000fde18
lea edx, [r12 + 0x41]
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dbd8]
mov r9d, ebx
call fcn.100036510
jmp 0x1000fde18
lea r8, [0x100027500]
lea rdx, [0x100027528]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x1000fdb2f
call sub.KERNEL32.dll_GetLastError
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000fde18
test byte [rcx + 0x1c], 1
je 0x1000fde18
mov edx, 0x42
jmp 0x1000fdabd
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r13d, eax
lea ecx, [rax - 0x98]
cmp ecx, 0x7ff68
ja 0x1000fddd7
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r14, rax
test rax, rax
jne 0x1000fdba1
call sub.KERNEL32.dll_GetLastError
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000fde0a
test byte [rcx + 0x1c], 1
je 0x1000fde0a
lea edx, [r14 + 0x44]
jmp 0x1000fddac
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rsi, rax
test rax, rax
jne 0x1000fdbee
call sub.KERNEL32.dll_GetLastError
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000fde0a
test byte [rcx + 0x1c], 1
je 0x1000fde0a
lea edx, [rsi + 0x45]
jmp 0x1000fddac
cmp dword [rax], 0x414d5153
je 0x1000fdc26
mov ebx, 0x90070a0b
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000fde0a
test byte [rcx + 0x1c], 1
je 0x1000fde0a
mov edx, 0x46
jmp 0x1000fddfa
lea rdx, [rdi + 0xc]
lea rcx, [rax + 0x18]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x1000fdc6c
mov ebx, 0x90070a0b
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000fde0a
test byte [rcx + 0x1c], 1
je 0x1000fde0a
mov edx, 0x47
lea r9, [rsi + 0x18]
jmp 0x1000fdd65
mov eax, dword [rdi + 8]
cmp dword [rsi + 4], eax
je 0x1000fdca4
mov ebx, 0x90070a0b
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000fde0a
test byte [rcx + 0x1c], 1
je 0x1000fde0a
mov edx, 0x48
jmp 0x1000fddfa
lea rbx, [rsi + 0x10]
test rbx, rbx
je 0x1000fdcda
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntdll.dll_NtQuerySystemTime]
test eax, eax
js 0x1000fdcda
mov eax, dword [rbx]
xor ecx, ecx
mov dword [rsp + 0x68], eax
mov eax, dword [rbx + 4]
mov dword [rsp + 0x6c], eax
mov rax, qword [rsp + 0x20]
cmp qword [rsp + 0x68], rax
setle cl
jmp 0x1000fdcdf
mov ecx, 1
test ecx, ecx
je 0x1000fdd13
mov ebx, 0x90070a0a
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000fde0a
test byte [rcx + 0x1c], 1
je 0x1000fde0a
mov edx, 0x49
jmp 0x1000fddfa
lea r8, [0x100027110]
mov r9d, 1
mov rdx, r15
mov rcx, rdi
call fcn.1000fd36c
mov ebx, eax
test eax, eax
jns 0x1000fdd7a
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000fde0a
test byte [rcx + 0x1c], 1
je 0x1000fde0a
lea r9, [0x100002f60]
test r15, r15
mov edx, 0x4a
cmovne r9, r15
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dbd8]
call fcn.1000347a8
jmp 0x1000fde0a
mov r8d, r13d
mov rdx, rsi
mov rcx, rdi
call fcn.1000fe308
mov ebx, eax
test eax, eax
jns 0x1000fddc1
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000fde0a
test byte [rcx + 0x1c], 1
je 0x1000fde0a
mov edx, 0x4b
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dbd8]
mov r9d, ebx
call fcn.100036510
jmp 0x1000fde0a
mov eax, dword [rdi + 0xa0]
sub eax, dword [rdi + 0x90]
xor ebx, ebx
mov dword [rdi + 0x98], eax
jmp 0x1000fde0a
mov ebx, 0x90070a0b
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000fde18
test byte [rcx + 0x1c], 1
je 0x1000fde18
mov edx, 0x43
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dbd8]
call fcn.100034784
test r14, r14
je 0x1000fde18
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeResource]
test r12, r12
je 0x1000fde25
mov rcx, r12
call sub.KERNEL32.dll_FreeLibrary
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret