Function at 0x14004d750
Capabilities:
Extract resource via kernel32 functions
Manipulate console buffer

Disassembly:
mov r11, rsp
push rbp
push r15
lea rbp, [r11 - 0x7f8]
sub rsp, 0x8e8
mov rax, qword [0x1400ad368]
xor rax, rsp
mov qword [rbp + 0x7c0], rax
cmp qword [rcx + 0x4060], 0
mov r15, rcx
je 0x14004df73
movsd xmm0, qword [0x14009f670]
mov eax, dword [0x14009f678]
mov qword [r11 + 0x10], rbx
mov rbx, qword [0x1400b0dd0]
mov qword [r11 + 0x18], rsi
mov rcx, rbx
mov qword [r11 + 0x20], rdi
mov qword [r11 - 0x18], r12
mov qword [r11 - 0x20], r13
mov qword [r11 - 0x28], r14
movsd qword [rbp + 0x710], xmm0
mov dword [rbp + 0x718], eax
call fcn.140038fa0
mov rdi, qword [rbx + 0x2718]
test rdi, rdi
jne 0x14004d7dc
mov rdi, qword [rbx + 0x2710]
xor r12d, r12d
movzx r9d, ax
mov rcx, rdi
mov ebx, r12d
lea edx, [r12 + 6]
lea r8d, [r12 + 0x7e]
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
lea r14d, [r12 + 0x4a]
test rax, rax
je 0x14004d859
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
je 0x14004d859
movzx ebx, word [rax]
lea rdx, [rax + 2]
mov ecx, 3
nop dword [rax]
lea rdx, [rdx + rbx*2]
movzx ebx, word [rdx]
add rdx, 2
sub ecx, 1
jne 0x14004d830
cmp ebx, r14d
lea rcx, [rbp + 0x720]
cmova ebx, r14d
mov r8d, ebx
add r8, r8
call fcn.140053490
mov eax, ebx
mov esi, 0x4b
mov word [rbp + rax*2 + 0x720], r12w
test ebx, ebx
jne 0x14004d90e
lea edx, [rsi - 0x45]
mov r9d, 0x409
lea r8d, [rsi + 0x33]
mov rcx, rdi
mov ebx, r12d
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
je 0x14004d8e9
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
je 0x14004d8e9
movzx ebx, word [rax]
lea rdx, [rax + 2]
mov ecx, 3
nop word [rax + rax]
lea rdx, [rdx + rbx*2]
movzx ebx, word [rdx]
add rdx, 2
sub ecx, 1
jne 0x14004d8c0
cmp ebx, r14d
lea rcx, [rbp + 0x720]
cmova ebx, r14d
mov r8d, ebx
add r8, r8
call fcn.140053490
mov eax, ebx
mov word [rbp + rax*2 + 0x720], r12w
test ebx, ebx
jne 0x14004d90e
lea r8, [0x14009f680]
mov rdx, rsi
lea rcx, [rbp + 0x720]
call fcn.140069780
lea rax, [rbp + 0x720]
mov rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp word [rax + rcx*2], r12w
jne 0x14004d920
lea rax, [rcx + 1]
cmp rax, rsi
jae 0x14004d97b
lea rax, [rcx + 2]
lea r8, [0x14008fbcc]
cmp rax, rsi
ja 0x14004d954
mov rdx, rsi
lea rcx, [rbp + 0x720]
call fcn.140069860
jmp 0x14004d97b
lfence
sub r14, rcx
lea rax, [rbp + 0x720]
sub rsi, rcx
mov r9, r14
lea rcx, [rax + rcx*2]
mov rdx, rsi
call fcn.14005a91c
mov word [rbp + 0x7b4], r12w
lea rax, [rbp + 0x720]
mov r13, 0xffffffffffffffff
nop dword [rax]
inc r13
cmp word [rax + r13*2], r12w
jne 0x14004d990
add r13w, 8
mov edi, 3
mov word [rsp + 0x30], r13w
mov rcx, r15
mov word [rsp + 0x32], di
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x34], eax
call fcn.14004e310
mov rcx, qword [r15 + 8]
lea rdx, [r15 + 0x402c]
mov ebx, dword [r15 + 0x4030]
mov dword [rsp + 0x30], r12d
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
mov eax, dword [r15 + 0x4030]
movzx r10d, word [r15 + 0x4036]
movzx ecx, word [r15 + 0x403a]
movzx r11d, word [r15 + 0x4038]
sub cx, r10w
movzx edx, word [r15 + 0x403c]
inc cx
sub dx, r11w
mov dword [r15 + 0x404c], eax
inc dx
mov dword [r15 + 0x4030], ebx
cmp dx, 2
jl 0x14004df43
cmp cx, 2
jl 0x14004df43
movzx eax, word [rsp + 0x36]
cmp di, dx
mov ebx, dword [rsp + 0x30]
movzx r9d, dx
cmovg ax, dx
cmovle r9w, di
movzx r8d, cx
mov word [rsp + 0x36], ax
movzx eax, word [rsp + 0x34]
cmp ax, cx
movsx edx, dx
movzx r12d, ax
movsx r14d, r9w
cmovle r8w, ax
mov word [rsp + 0x48], r9w
cmovg r12w, cx
movsx esi, r8w
movsx ecx, cx
lea eax, [r9 - 1]
sub ecx, esi
mov word [rsp + 0x34], r12w
mov edi, dword [rsp + 0x34]
sub edx, r14d
sar ecx, 1
dec r8w
add cx, r10w
sar edx, 1
add dx, r11w
mov word [rsp + 0x40], cx
add ax, dx
mov word [rsp + 0x42], dx
add cx, r8w
mov word [rsp + 0x46], ax
mov word [rsp + 0x44], cx
lea rax, [rsp + 0x40]
mov rcx, qword [r15 + 8]
lea rdx, [rbp + 0x330]
mov r9d, ebx
mov qword [rsp + 0x20], rax
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_ReadConsoleOutputW]
imul esi, r14d
movsxd r8, esi
shl r8, 2
test r8, r8
je 0x14004daff
lea rdx, [rbp + 0x330]
lea rcx, [rsp + 0x50]
call fcn.140053490
xor eax, eax
movzx r9d, ax
cmp word [rsp + 0x48], ax
jle 0x14004db5d
movzx r10d, word [rsp + 0x36]
xor ebx, ebx
movzx eax, bx
test r12w, r12w
jle 0x14004db4f
movsx r8d, r9w
movsx ecx, r12w
imul r8d, ecx
nop dword [rax]
movsx ecx, ax
inc ax
add ecx, r8d
movsxd rdx, ecx
movzx ecx, word [r15 + 0x4088]
mov word [rsp + rdx*4 + 0x52], cx
cmp ax, r12w
jl 0x14004db30
inc r9w
cmp r9w, r10w
jl 0x14004db14
mov ebx, dword [rsp + 0x30]
movsx r9d, word [rsp + 0x36]
mov eax, 0x250c
mov word [rsp + 0x50], ax
mov ecx, 0x2510
movsx rax, r12w
mov edx, 0x2514
movsx esi, r12w
mov r14d, 1
lea r11d, [r9 - 1]
mov r8d, r11d
mov word [rsp + rax*4 + 0x4c], cx
lea r10d, [rdx - 0x14]
imul r8d, esi
mov ecx, r9d
imul ecx, esi
movsxd rax, r8d
mov word [rsp + rax*4 + 0x50], dx
movsxd rax, ecx
mov ecx, 0x2518
mov word [rsp + rax*4 + 0x4c], cx
movzx ecx, r14w
cmp r12w, 2
jle 0x14004dbe4
lea edx, [rsi - 1]
nop dword [rax]
nop word [rax + rax]
movsx rax, cx
inc cx
mov word [rsp + rax*4 + 0x50], r10w
movsx eax, cx
cmp edx, eax
jg 0x14004dbd0
movzx edx, r14w
cmp r12w, 2
jle 0x14004dc1d
mov eax, r14d
lea r10d, [rsi - 1]
mov r14d, 0x2500
nop dword [rax]
add eax, r8d
inc dx
movsxd rcx, eax
movsx eax, dx
mov word [rsp + rcx*4 + 0x50], r14w
cmp r10d, eax
jg 0x14004dc00
mov r14d, 1
movzx ecx, r14w
mov r8d, 0x2502
cmp r9d, 2
jle 0x14004dc46
mov eax, r14d
imul eax, esi
inc cx
cdqe
mov word [rsp + rax*4 + 0x50], r8w
movsx eax, cx
cmp r11d, eax
jg 0x14004dc30
movzx edx, r14w
cmp r9d, 2
jle 0x14004dc79
mov eax, r14d
nop dword [rax]
nop word [rax + rax]
inc eax
inc dx
imul eax, esi
movsxd rcx, eax
movsx eax, dx
mov word [rsp + rcx*4 + 0x4c], r8w
cmp r11d, eax
jg 0x14004dc60
movzx r10d, r14w
cmp r9d, 2
jle 0x14004dcda
lea r9d, [rsi - 1]
mov r8d, r14d
nop word [rax + rax]
movzx edx, r14w
cmp r9d, 1
jle 0x14004dccd
mov eax, r14d
imul r8d, esi
mov r14d, 0x20
nop word [rax + rax]
add eax, r8d
inc dx
movsxd rcx, eax
movsx eax, dx
mov word [rsp + rcx*4 + 0x50], r14w
cmp r9d, eax
jg 0x14004dcb0
mov r14d, 1
inc r10w
movsx r8d, r10w
cmp r11d, r8d
jg 0x14004dc90
mov rcx, qword [r15 + 8]
lea rax, [rsp + 0x40]
mov r9d, ebx
mov qword [rsp + 0x20], rax
mov r8d, edi
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_WriteConsoleOutputW]
cmp r13w, r12w
jle 0x14004dd5d
lea rax, [rbp + 0x720]
mov rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x14004dd10
movsx eax, r13w
sub eax, esi
cmp eax, ecx
jge 0x14004dd4c
cdqe
sub rcx, rax
lea rcx, [rcx*2 - 2]
cmp rcx, 0x96
jae 0x14004df8d
xor r12d, r12d
mov word [rbp + rcx + 0x720], r12w
jmp 0x14004dd60
xor r12d, r12d
mov ecx, r12d
mov word [rbp + rcx + 0x720], r12w
jmp 0x14004dd60
xor r12d, r12d
movzx eax, word [rsp + 0x40]
mov r8, 0xffffffffffffffff
inc ax
mov word [rsp + 0x38], ax
movzx eax, word [rsp + 0x42]
inc ax
mov word [rsp + 0x3a], ax
lea rax, [rbp + 0x720]
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14004dd90
lea r9, [rsp + 0x38]
mov rcx, r15
lea rdx, [rbp + 0x720]
call fcn.14004e140
lea rcx, [rbp + 0x720]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14004ddc0
add word [rsp + 0x38], ax
mov edx, dword [rsp + 0x38]
mov rcx, qword [r15 + 8]
mov dword [rsp + 0x30], edx
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov r13d, 0x1b
movzx ebx, r12w
movzx esi, r12w
lea r14d, [r13 + 5]
cmp r13w, si
je 0x14004ded8
call fcn.140069274
movzx esi, ax
mov eax, esi
cmp esi, 8
je 0x14004de69
cmp eax, 0xd
je 0x14004deca
cmp eax, r13d
je 0x14004de62
lea rax, [rbp + 0x710]
mov rcx, 0xffffffffffffffff
nop dword [rax + rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x14004de30
movsx eax, bx
cmp ecx, eax
jle 0x14004deca
movzx ecx, si
call fcn.140065cd4
test eax, eax
je 0x14004deca
movsx rax, bx
inc bx
mov word [rbp + rax*2 + 0x710], si
jmp 0x14004de7e
mov ebx, 0xffffffff
jmp 0x14004deca
test bx, bx
je 0x14004de7e
dec bx
movsx rax, bx
mov word [rbp + rax*2 + 0x710], r14w
lea rax, [rbp + 0x710]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14004de90
lea r9, [rsp + 0x38]
mov rcx, r15
lea rdx, [rbp + 0x710]
call fcn.14004e140
mov rcx, qword [r15 + 8]
movzx eax, bx
add ax, word [rsp + 0x38]
mov word [rsp + 0x30], ax
mov edx, dword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov eax, 0xd
cmp ax, si
jne 0x14004ddf3
mov rcx, qword [r15 + 8]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x30], 0
lea rdx, [rbp + 0x330]
mov r9d, dword [rsp + 0x30]
mov r8d, edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteConsoleOutputW]
mov edx, dword [r15 + 0x404c]
mov rcx, qword [r15 + 8]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
cmp bx, 0xffff
jle 0x14004df43
mov ebx, dword [r15 + 0x4060]
lea rcx, [rbp + 0x710]
dec ebx
call fcn.140069e64
cmp ebx, eax
mov rcx, r15
cmovl eax, ebx
mov dword [r15 + 0x4078], eax
call fcn.14004e720
mov r13, qword [rsp + 0x8d8]
mov r12, qword [rsp + 0x8e0]
mov rdi, qword [rsp + 0x918]
mov rsi, qword [rsp + 0x910]
mov rbx, qword [rsp + 0x908]
mov r14, qword [rsp + 0x8d0]
mov rcx, qword [rbp + 0x7c0]
xor rcx, rsp
call fcn.140050ca0
add rsp, 0x8e8
pop r15
pop rbp
ret
call fcn.140051344
int3