Function at 0x1400f92c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword ss:[rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x140237008]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor r12d, r12d
mov qword [rsp + 0x20], rcx
cmp word [rcx], 0x40
mov rbx, rcx
jne 0x1400f972a
call sym.ProcessHacker.exe_PhCountStringZ
movzx r13d, byte [0x140244611]
add rbx, 2
mov rbp, rax
mov rdi, rbx
add rbp, rbp
sub rbp, 2
mov r14, rbp
shr r14, 1
mov rsi, r14
cmp r13b, 1
jb 0x1400f938f
mov rcx, rbp
and esi, 7
shr rcx, 4
test rcx, rcx
je 0x1400f93ad
movdqa xmm2, xmmword [0x140211b10]
nop dword [rax]
movdqu xmm0, xmmword [rdi]
movdqa xmm1, xmm2
pcmpeqw xmm1, xmm0
pmovmskb eax, xmm1
bsf r8d, eax
mov dword [rsp + 0x28], r8d
jne 0x1400f9377
add rdi, 0x10
sub rcx, 1
jne 0x1400f9350
jmp 0x1400f93ad
shl rcx, 4
mov rdx, rbp
sub rdx, rcx
mov eax, r8d
shr rdx, 1
shr rax, 1
add rdx, rax
jmp 0x1400f93d0
test rbx, rbx
je 0x1400f93ad
mov edx, 0x2c
mov rcx, rbx
call fcn.1401861f4
movzx r13d, byte [0x140244611]
test rsi, rsi
je 0x1400f93c6
cmp word [rdi], 0x2c
je 0x1400f93cd
add rdi, 2
sub rsi, 1
jne 0x1400f93b2
xor eax, eax
jmp 0x1400f972d
mov rdx, r14
sub rdx, rsi
cmp rdx, 0xffffffffffffffff
je 0x1400f93c6
mov r10, qword [rsp + 0x20]
lea r15, [rdx + rdx]
add r10, 4
mov r8, rbp
add r10, r15
sub r8, r15
movzx edi, r12b
sub r8, 2
je 0x1400f9419
movzx eax, word ds:[r10]
cmp ax, 0x2d
je 0x1400f940e
cmp ax, 0x2b
jne 0x1400f9419
jmp 0x1400f9411
mov dil, 1
add r10, 2
add r8, 0xfffffffffffffffe
shr r8, 1
mov r11b, 1
mov rcx, r12
mov rdx, r12
je 0x1400f9454
lea rsi, [0x1401f2c20]
nop
movzx eax, byte [r10 + rdx*2]
mov r9d, dword [rsi + rax*4]
cmp r9d, 0xa
jae 0x1400f9449
lea rcx, [rcx + rcx*4]
lea rcx, [r9 + rcx*2]
jmp 0x1400f944c
xor r11b, r11b
inc rdx
cmp rdx, r8
jb 0x1400f9430
mov rsi, rcx
neg rsi
test dil, dil
cmove rsi, rcx
test r11b, r11b
jne 0x1400f958d
mov rdi, r14
cmp r13b, 1
jb 0x1400f9505
mov rcx, rbp
and edi, 7
shr rcx, 4
test rcx, rcx
je 0x1400f9517
movdqa xmm1, xmmword [0x140211b40]
nop dword [rax]
nop word [rax + rax]
movdqu xmm0, xmmword [rbx]
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
bsf edx, eax
jne 0x1400f94bd
add rbx, 0x10
sub rcx, 1
jne 0x1400f94a0
jmp 0x1400f9517
shl rcx, 4
mov r14, rbp
sub r14, rcx
mov eax, edx
shr r14, 1
shr rax, 1
add r14, rax
sub r14, rdi
cmp r14, 0xffffffffffffffff
je 0x1400f93c6
mov rdi, qword [rsp + 0x20]
lea rax, [r14 + r14]
add rdi, 4
sub rbp, rax
add rdi, rax
sub rbp, 2
jne 0x1400f954d
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov rbx, rax
jmp 0x1400f972d
test rbx, rbx
je 0x1400f9517
mov edx, 0x3b
mov rcx, rbx
call fcn.1401861f4
nop word [rax + rax]
test rdi, rdi
je 0x1400f93c6
nop dword [rax]
cmp word [rbx], 0x3b
je 0x1400f94d2
add rbx, 2
sub rdi, 1
jne 0x1400f9530
xor eax, eax
jmp 0x1400f972d
mov rdx, qword [0x1402418e8]
lea rcx, [rbp + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov rbx, rax
mov qword [rax], rbp
add rax, 0x10
mov qword [rbx + 8], rax
mov word [rax + rbp], r12w
test rdi, rdi
je 0x1400f9585
mov rcx, qword ds:[rbx + 8]
mov r8, rbp
mov rdx, rdi
call fcn.140188690
mov rax, rbx
jmp 0x1400f972d
test r15, r15
jne 0x1400f959c
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov rdi, rax
jmp 0x1400f95d4
mov rdx, qword [0x1402418e8]
lea rcx, [r15 + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov rdi, rax
mov qword [rax], r15
add rax, 0x10
mov qword [rdi + 8], rax
mov word [rax + r15], r12w
test rbx, rbx
je 0x1400f95d4
mov rcx, qword [rdi + 8]
mov r8, r15
mov rdx, rbx
call fcn.140188690
mov rax, qword [rdi + 8]
mov r14, rdi
mov ebx, 0xffffffff
cmp word [rax], 0x25
jne 0x1400f960b
mov rcx, rdi
call sym.ProcessHacker.exe_PhExpandEnvironmentStrings
test rax, rax
je 0x1400f960b
mov r14, rax
lea rcx, [rdi - 0x10]
mov eax, ebx
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400f960b
call fcn.1400fbcc0
mov rcx, qword [r14 + 8]
xor edx, edx
lea r8d, [rdx + 0x22]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbp, rax
test rax, rax
je 0x1400f9712
neg esi
mov qword [rsp + 0x40], 6
movzx ecx, si
mov qword [rsp + 0x50], r12
shr cx, 4
lea r9, [rsp + 0x30]
inc cx
lea rdx, [rsp + 0x40]
movzx ecx, cx
mov r8d, 3
mov qword [rsp + 0x48], rcx
mov rcx, rax
call qword [sym.imp.ntdll.dll_LdrFindResource_U]
test eax, eax
js 0x1400f9709
lfence
mov rdx, qword [rsp + 0x30]
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x38]
mov rcx, rbp
call qword [sym.imp.ntdll.dll_LdrAccessResource]
test eax, eax
js 0x1400f9709
mov rcx, qword [rsp + 0x38]
and esi, 0xf
jbe 0x1400f96b1
mov edx, esi
nop dword [rax]
movzx eax, word [rcx]
lea rcx, [rcx + rax*2]
add rcx, 2
sub rdx, 1
jne 0x1400f96a0
movzx edx, word ds:[rcx]
mov r8d, 0xfffc
lea eax, [rdx - 1]
cmp ax, r8w
ja 0x1400f9709
mov esi, edx
lea r15, [rcx + 2]
mov rdx, qword [0x1402418e8]
add rsi, rsi
lea rcx, [rsi + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov rdi, rax
mov qword [rax], rsi
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rcx + rsi], r12w
test r15, r15
je 0x1400f9706
mov rcx, qword [rax + 8]
mov r8, rsi
mov rdx, r15
call fcn.140188690
mov r12, rdi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, ds:[r14 - 0x10]
lock xadd dword [rcx + 8], ebx
cmp ebx, 1
jne 0x1400f972a
call fcn.1400fbcc0
mov rax, r12
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1401848a0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret