Function at 0x1401b8b80
Capabilities:
Extract resource via kernel32 functions
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x4f8
mov qword [rsp + 0x488], 0xfffffffffffffffe
mov dword [rsp + 0x480], 0
mov rdx, qword [rsp + 0x520]
lea rcx, [rsp + 0x3e0]
call fcn.140010530
mov qword [rsp + 0x490], rax
mov rax, qword [rsp + 0x490]
mov qword [rsp + 0x498], rax
mov rcx, qword [rsp + 0x498]
call fcn.1400105c0
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.1400020d0
nop
lea rcx, [rsp + 0x3e0]
call fcn.140002e70
lea rcx, [rsp + 0x70]
call fcn.140006e20
movzx eax, al
test eax, eax
je 0x1401b8c36
mov dword [rsp + 0x3e8], 0
lea rcx, [rsp + 0x70]
call fcn.140001490
mov eax, dword [rsp + 0x3e8]
jmp 0x1401b93bf
mov r8d, 1
lea rdx, [rsp + 0x3f0]
lea rcx, [rsp + 0x70]
call fcn.140006b20
mov qword [rsp + 0x4a0], rax
mov rax, qword [rsp + 0x4a0]
mov qword [rsp + 0x4a8], rax
mov eax, dword [rsp + 0x480]
or eax, 1
mov dword [rsp + 0x480], eax
lea rdx, [0x140218d8c]
mov rcx, qword [rsp + 0x4a8]
call fcn.140006d50
movzx eax, al
test eax, eax
jne 0x1401b8ceb
mov r8d, 1
lea rdx, [rsp + 0x3f8]
lea rcx, [rsp + 0x70]
call fcn.140006b20
mov qword [rsp + 0x4b0], rax
mov eax, dword [rsp + 0x480]
or eax, 2
mov dword [rsp + 0x480], eax
lea rdx, [0x140218ddc]
mov rcx, qword [rsp + 0x4b0]
call fcn.140006d50
movzx eax, al
test eax, eax
jne 0x1401b8ceb
mov dword [rsp + 0x4b8], 0
jmp 0x1401b8cf6
mov dword [rsp + 0x4b8], 1
movzx eax, byte [rsp + 0x4b8]
mov byte [rsp + 0x3ec], al
mov eax, dword [rsp + 0x480]
and eax, 2
test eax, eax
je 0x1401b8d29
and dword [rsp + 0x480], 0xfffffffd
lea rcx, [rsp + 0x3f8]
call fcn.140001490
nop
mov eax, dword [rsp + 0x480]
and eax, 1
test eax, eax
je 0x1401b8d4c
and dword [rsp + 0x480], 0xfffffffe
lea rcx, [rsp + 0x3f0]
call fcn.140001490
movzx eax, byte [rsp + 0x3ec]
test eax, eax
je 0x1401b8da8
mov r8d, 1
lea rdx, [rsp + 0x400]
lea rcx, [rsp + 0x70]
call fcn.140006a00
mov qword [rsp + 0x4c0], rax
mov rax, qword [rsp + 0x4c0]
mov qword [rsp + 0x4c8], rax
mov rdx, qword [rsp + 0x4c8]
lea rcx, [rsp + 0x70]
call fcn.140002d80
nop
lea rcx, [rsp + 0x400]
call fcn.140001490
lea rcx, [rsp + 0x70]
call fcn.140023510
lea r8, [rsp + 0x58]
mov rdx, rax
lea rcx, [0x1403abd98]
call fcn.140026590
test eax, eax
je 0x1401b8e09
mov rcx, qword [rsp + 0x510]
mov rax, qword [rsp + 0x60]
mov qword [rcx], rax
mov rcx, qword [rsp + 0x518]
mov eax, dword [rsp + 0x58]
mov dword [rcx], eax
mov dword [rsp + 0x408], 1
lea rcx, [rsp + 0x70]
call fcn.140001490
mov eax, dword [rsp + 0x408]
jmp 0x1401b93bf
xor r8d, r8d
lea rdx, [0x14021936c]
lea rcx, [rsp + 0x70]
call fcn.140006780
test eax, eax
jl 0x1401b8e42
mov dword [rsp + 0x40c], 0
lea rcx, [rsp + 0x70]
call fcn.140001490
mov eax, dword [rsp + 0x40c]
jmp 0x1401b93bf
lea rcx, [rsp + 0x20]
call fcn.140076008
nop
lea rdx, [0x1403abb30]
add rdx, 0x228
lea r8, str._tftp_
lea rcx, [rsp + 0x410]
call fcn.1400010b0
mov qword [rsp + 0x4d0], rax
mov rax, qword [rsp + 0x4d0]
mov qword [rsp + 0x4d8], rax
lea r8, [rsp + 0x70]
mov rdx, qword [rsp + 0x4d8]
lea rcx, [rsp + 0x50]
call fcn.140006bd0
nop
lea rcx, [rsp + 0x410]
call fcn.140001490
lea rcx, [rsp + 0x50]
call fcn.140023510
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.14007610c
test eax, eax
je 0x1401b9018
lea rcx, [rsp + 0x20]
call fcn.140075d14
lea rcx, [rsp + 0x20]
call fcn.140075d60
mov dword [rsp + 0x58], eax
lea rcx, [rsp + 0x20]
call fcn.140075c40
lea rcx, [rsp + 0x50]
call fcn.140023510
lea rdx, [0x140219388]
mov rcx, rax
call fcn.1400a9d60
mov qword [rsp + 0x78], rax
cmp qword [rsp + 0x78], 0
jne 0x1401b8f4d
mov dword [rsp + 0x418], 0
lea rcx, [rsp + 0x50]
call fcn.140001490
nop
lea rcx, [rsp + 0x20]
call fcn.140076064
nop
lea rcx, [rsp + 0x70]
call fcn.140001490
mov eax, dword [rsp + 0x418]
jmp 0x1401b93bf
mov ecx, dword [rsp + 0x58]
call fcn.140071ab0
mov qword [rsp + 0x420], rax
mov rax, qword [rsp + 0x420]
mov qword [rsp + 0x60], rax
mov edx, dword [rsp + 0x58]
mov r9, qword [rsp + 0x78]
mov r8d, 1
mov rcx, qword [rsp + 0x60]
call fcn.1400ac814
mov rcx, qword [rsp + 0x78]
call fcn.1400aa000
mov rdx, qword [rsp + 0x510]
mov rax, qword [rsp + 0x60]
mov qword [rdx], rax
mov rcx, qword [rsp + 0x518]
mov eax, dword [rsp + 0x58]
mov dword [rcx], eax
lea rdi, [rsp + 0x460]
lea rsi, [rsp + 0x58]
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x70]
call fcn.140023510
lea r8, [rsp + 0x460]
mov rdx, rax
lea rcx, [0x1403abd98]
call fcn.140026610
mov dword [rsp + 0x428], 1
lea rcx, [rsp + 0x50]
call fcn.140001490
nop
lea rcx, [rsp + 0x20]
call fcn.140076064
nop
lea rcx, [rsp + 0x70]
call fcn.140001490
mov eax, dword [rsp + 0x428]
jmp 0x1401b93bf
lea rcx, [rsp + 0x20]
call fcn.140075c40
lea rcx, [rsp + 0x70]
call fcn.140023510
mov rdi, rax
call fcn.14000edf0
lea r8, [0x140219390]
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rsp + 0x68], rax
lea rdx, [0x1402193a8]
lea rcx, [rsp + 0x430]
call fcn.1400eeb90
mov qword [rsp + 0x4e0], rax
lea rdx, [0x140219398]
mov rcx, qword [rsp + 0x4e0]
call fcn.140006d90
mov byte [rsp + 0x42c], al
lea rcx, [rsp + 0x430]
call fcn.140001490
movzx edx, byte [rsp + 0x42c]
test edx, edx
je 0x1401b9142
lea rdx, [0x1402193b8]
lea rcx, [rsp + 0x70]
call fcn.1400060b0
test eax, eax
jne 0x1401b90d6
call fcn.14000edf0
lea r8, [0x1402193d0]
lea rdx, str.oem_gpxe.pxe
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rsp + 0x68], rax
lea rdx, [0x1402193f8]
lea rcx, [rsp + 0x70]
call fcn.1400060b0
test eax, eax
jne 0x1401b910c
call fcn.14000edf0
lea r8, [0x140219410]
lea rdx, str.oem_gpxex.pxe
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rsp + 0x68], rax
lea rdx, [0x140219438]
lea rcx, [rsp + 0x70]
call fcn.1400060b0
test eax, eax
jne 0x1401b9142
call fcn.14000edf0
lea r8, [0x140219450]
lea rdx, [0x140219458]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rsp + 0x68], rax
cmp qword [rsp + 0x68], 0
je 0x1401b9248
call fcn.14000edf0
mov rdx, qword [rsp + 0x68]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x58], eax
call fcn.14000edf0
mov rdx, qword [rsp + 0x68]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x80], rax
mov ecx, dword [rsp + 0x58]
call fcn.140071ab0
mov qword [rsp + 0x438], rax
mov rax, qword [rsp + 0x438]
mov qword [rsp + 0x60], rax
mov r8d, dword [rsp + 0x58]
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
call fcn.1400a8d30
mov rdx, qword [rsp + 0x510]
mov rax, qword [rsp + 0x60]
mov qword [rdx], rax
mov rcx, qword [rsp + 0x518]
mov eax, dword [rsp + 0x58]
mov dword [rcx], eax
lea rdi, [rsp + 0x470]
lea rsi, [rsp + 0x58]
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x70]
call fcn.140023510
lea r8, [rsp + 0x470]
mov rdx, rax
lea rcx, [0x1403abd98]
call fcn.140026610
mov dword [rsp + 0x440], 1
lea rcx, [rsp + 0x50]
call fcn.140001490
nop
lea rcx, [rsp + 0x20]
call fcn.140076064
nop
lea rcx, [rsp + 0x70]
call fcn.140001490
mov eax, dword [rsp + 0x440]
jmp 0x1401b93bf
lea rcx, [0x140218e5c]
call fcn.1400a9180
mov rdi, rax
lea rcx, [rsp + 0x70]
call fcn.140023510
mov r8, rdi
lea rdx, [0x140219478]
mov rcx, rax
call fcn.1400a939c
test eax, eax
jne 0x1401b9386
lea rcx, [rsp + 0x90]
call fcn.1401cc380
nop
lea rax, [rsp + 0x448]
mov qword [rsp + 0x450], rax
mov r8d, 3
mov rdx, qword [rsp + 0x450]
lea rcx, [rsp + 0x70]
call fcn.140006a00
mov qword [rsp + 0x4e8], rax
mov rdx, qword [rsp + 0x4e8]
lea rcx, [rsp + 0x90]
call fcn.1401d1c90
mov dword [rsp + 0x3d4], 0
mov dword [rsp + 0x3d0], 0
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x90]
call fcn.1401d09a0
nop
cmp dword [rsp + 0x3d4], 0xffffffff
je 0x1401b936b
lea r9, [rsp + 0x3d4]
lea r8, [0x140218eac]
lea rdx, [rsp + 0x3d8]
lea rcx, [rsp + 0x88]
call fcn.1400065a0
lea rcx, [rsp + 0x3d8]
call fcn.140006e20
movzx eax, al
test eax, eax
je 0x1401b934b
lea rcx, [rsp + 0x3d8]
call fcn.140001490
jmp 0x1401b936b
mov eax, dword [rsp + 0x3d0]
add eax, 1
mov dword [rsp + 0x3d0], eax
lea rcx, [rsp + 0x3d8]
call fcn.140001490
jmp 0x1401b92fa
lea rcx, [rsp + 0x88]
call fcn.140001490
nop
lea rcx, [rsp + 0x90]
call fcn.140005db0
mov dword [rsp + 0x458], 0
lea rcx, [rsp + 0x50]
call fcn.140001490
nop
lea rcx, [rsp + 0x20]
call fcn.140076064
nop
lea rcx, [rsp + 0x70]
call fcn.140001490
mov eax, dword [rsp + 0x458]
jmp 0x1401b93bf
add rsp, 0x4f8
pop rdi
pop rsi
ret