Function at 0x14002c620
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x260
mov rax, qword [0x1400981e8]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdi, qword [0x14009b4e0]
mov ebp, ecx
mov r14d, 0x409
test rdi, rdi
jne 0x14002c7d3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002c725
mov ebx, 0x104
lea rdx, [rsp + 0x40]
mov r8d, ebx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x14002c692
mov rax, rdi
jmp 0x14002c73a
mov edx, 0x5c
lea rcx, [rsp + 0x40]
call fcn.14004b398
test rax, rax
je 0x14002c6ac
add rax, 2
jmp 0x14002c6b1
lea rax, [rsp + 0x40]
mov word [rax], di
mov rcx, 0xffffffffffffffff
lea rax, [rsp + 0x40]
inc rcx
cmp word [rax + rcx*2], di
jne 0x14002c6c0
lea rax, [rcx + 1]
cmp rax, rbx
jae 0x14002c71e
lea rax, [rcx + 0xd]
lea r8, str.eclsLang.dll
cmp rax, rbx
ja 0x14002c6f6
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.1400609ec
lea rcx, [rsp + 0x40]
jmp 0x14002c72c
lfence
sub rbx, rcx
lea rax, [rsp + 0x40]
mov r9d, 0x103
mov rdx, rbx
sub r9, rcx
lea rcx, [rax + rcx*2]
call fcn.140059e78
mov word [rsp + 0x246], di
lea rcx, [rsp + 0x40]
jmp 0x14002c72c
lea rcx, str.eclsLang.dll
mov r8d, 2
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [0x14009b4e0], rax
test rax, rax
jne 0x14002c75a
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
mov qword [0x14009b4e0], rax
jmp 0x14002c7d3
mov ebx, r14d
mov qword [rsp + 0x38], rdi
mov r9d, 0x20019
mov dword [rsp + 0x30], ebx
lea r8, [rsp + 0x38]
mov byte [rsp + 0x20], 1
lea rdx, str.SoftwareESETESET_SecurityCurrentVersionInfo
mov rcx, 0xffffffff80000002
call fcn.140045e40
test al, al
je 0x14002c7c6
mov rdi, qword [rsp + 0x38]
test rdi, rdi
je 0x14002c7c6
lea r8, [rsp + 0x30]
mov rcx, rdi
lea rdx, str.LanguageId
call fcn.140045fd0
mov ebx, dword [rsp + 0x30]
test al, al
mov rcx, rdi
cmove ebx, r14d
call qword [0x140098160]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rdi, qword [0x14009b4e0]
mov dword [0x140098de0], ebx
movzx r9d, word [0x140098de0]
movzx eax, bp
shr ax, 4
mov edx, 6
inc ax
mov rcx, rdi
movzx esi, ax
movzx ebx, bp
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
je 0x14002c844
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
je 0x14002c844
movzx ecx, word [rax]
lea rax, [rax + 2]
and ebx, 0xf
je 0x14002c840
nop word [rax + rax]
lea rax, [rax + rcx*2]
movzx ecx, word [rax]
add rax, 2
sub ebx, 1
jne 0x14002c830
test ecx, ecx
jne 0x14002c8ab
mov r9d, r14d
mov r8, rsi
mov edx, 6
mov rcx, rdi
movzx ebx, bp
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
je 0x14002c8a4
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
je 0x14002c8a4
movzx ecx, word [rax]
lea rax, [rax + 2]
and ebx, 0xf
je 0x14002c8a0
nop word [rax + rax]
lea rax, [rax + rcx*2]
movzx ecx, word [rax]
add rax, 2
sub ebx, 1
jne 0x14002c890
test ecx, ecx
jne 0x14002c8ab
lea rax, [0x140089298]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400498a0
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret