Function at 0x18000cb80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x490
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x490], rbx
mov rax, qword [0x1800bd6d8]
xor rax, rbp
mov qword [rbp + 0x440], rax
mov r12, r9
mov r15, r8
mov rsi, rdx
xor r13d, r13d
mov ebx, r13d
mov qword [rbp + 8], rbx
mov qword [rbp + 0x28], rcx
mov qword [rbp + 0x20], r13
mov qword [rbp + 0x30], r13
test rdx, rdx
je 0x18000ce25
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rdx + rax*2], 0
jne 0x18000cbe0
inc eax
cdqe
lea r14, [rax + rax]
mov eax, 0x80000000
add rax, r14
mov ecx, 0xffffffff
cmp rax, rcx
ja 0x18000ccaa
movsxd rdi, r14d
cmp r14d, 0x400
jg 0x18000cc46
mov rcx, rdi
call fcn.180010c30
test al, al
je 0x18000cc46
lea rax, [rdi + 0xf]
cmp rax, rdi
ja 0x18000cc33
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.180013d40
sub rsp, rax
lea rdi, [rsp + 0x40]
jmp 0x18000cc72
mov rax, rdi
not rax
cmp rax, 0x10
jb 0x18000ce7e
lea rcx, [rdi + 0x10]
call fcn.1800242f8
test rax, rax
je 0x18000ccaa
mov qword [rax], r13
mov rbx, rax
mov qword [rbp + 8], rax
lea rdi, [rax + 0x10]
test rdi, rdi
je 0x18000ccaa
mov byte [rdi], 0
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rdi
mov r9d, 0xffffffff
mov r8, rsi
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
cmove rdi, r13
jmp 0x18000ccad
mov rdi, r13
test rdi, rdi
je 0x18000ce25
xor edx, edx
lea r8d, [rdx + 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
mov qword [rbp + 0x10], rax
test rax, rax
jne 0x18000ccf8
xor edx, edx
lea r8d, [rax + 2]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
mov qword [rbp + 0x10], rax
test rax, rax
jne 0x18000ccf8
call fcn.1800037a0
mov edi, eax
jmp 0x18000cdf8
mov r8, r12
mov rdx, r15
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdi, rax
test rax, rax
jne 0x18000cd19
call fcn.1800037a0
jmp 0x18000cde7
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r14, rax
mov qword [rbp + 0x18], rax
test rax, rax
jne 0x18000cd3b
call fcn.1800037a0
jmp 0x18000cde7
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [rbp], edi
lea eax, [rdi + 1]
cmp eax, edi
jae 0x18000cd5d
mov edi, 0x8007000e
jmp 0x18000cde9
mov ecx, eax
test eax, eax
je 0x18000cd90
xor edx, edx
mov rax, 0xffffffffffffffff
div rcx
cmp rax, 1
jb 0x18000ce89
cmp rcx, 0x400
jbe 0x18000cd90
mov rdx, rcx
lea rcx, [rbp + 0x30]
call fcn.1800035b0
jmp 0x18000cd98
lea rax, [rbp + 0x38]
mov qword [rbp + 0x30], rax
jmp 0x18000cda9
cmp qword [rbp + 0x30], 0
jne 0x18000cdb7
mov edi, 0x8007000e
jmp 0x18000cde9
test rdi, rdi
je 0x18000cdcb
mov r8, rdi
mov rdx, r14
mov rcx, qword [rbp + 0x30]
call fcn.180015fa0
mov rax, qword [rbp + 0x30]
mov byte [rdi + rax], 0
mov r8d, dword [rbp + 0x4b0]
mov rdx, qword [rbp + 0x30]
lea rcx, [rbp + 0x20]
call fcn.18000c720
mov edi, eax
test rsi, rsi
je 0x18000cdf8
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rbp + 0x38]
cmp qword [rbp + 0x30], rax
je 0x18000ce0c
lea rcx, [rbp + 0x30]
call fcn.180006d10
nop
test rbx, rbx
je 0x18000ce21
mov rcx, rbx
mov rbx, qword [rbx]
call fcn.1800242e4
test rbx, rbx
jne 0x18000ce11
mov eax, edi
jmp 0x18000ce55
lea rax, [rbp + 0x38]
cmp qword [rbp + 0x30], rax
je 0x18000ce39
lea rcx, [rbp + 0x30]
call fcn.180006d10
nop
test rbx, rbx
je 0x18000ce50
nop
mov rcx, rbx
mov rbx, qword [rbx]
call fcn.1800242e4
test rbx, rbx
jne 0x18000ce40
mov eax, 0x8007000e
mov rcx, qword [rbp + 0x440]
xor rcx, rbp
call fcn.180013da0
mov rbx, qword [rbp + 0x490]
lea rsp, [rbp + 0x450]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80070216
call fcn.180003880
nop
mov ecx, 0x80070216
call fcn.180003880
int3