Function at 0x140013320
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xc0]
sub rsp, 0x1c0
mov rax, qword [0x140267660]
xor rax, rsp
mov qword [rbp + 0xb0], rax
mov qword [rsp + 0x58], rdx
mov r12d, ecx
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp - 0x60]
call fcn.14019d7b0
mov r8d, 0x104
lea rdx, [rbp - 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor r14d, r14d
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], r14b
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x1400133de
lea r8, [0x1402342f8]
lea rdx, [0x1402342f0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdi, rax
test rax, rax
jne 0x140013459
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, [0x140234300]
call fcn.140002550
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x140013426
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140013421
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140013a3a
call fcn.140016b60
mov eax, r14d
mov rcx, qword [rbp + 0xb0]
xor rcx, rsp
call fcn.140197d80
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400133d5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rsi, rax
test rax, rax
je 0x1400133d5
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
movsxd r8, eax
mov rdx, rsi
lea rcx, [rbp - 0x80]
call fcn.14000d040
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x1400134ff
lea r8, [0x1402342f8]
lea rdx, [0x14023430c]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdi, rax
test rax, rax
jne 0x140013565
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, [0x140234300]
call fcn.140002550
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x140013549
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140013544
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140013a34
call fcn.140016b60
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
jmp 0x1400133eb
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400134f6
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rsi, rax
test rax, rax
je 0x1400134f6
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
movsxd r8, eax
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.14000d040
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, str.O_3_n
call fcn.140002550
mov esi, 1
mov r13d, esi
lea r14, [rsi - 2]
mov rdi, qword [rsp + 0x58]
cmp r12d, esi
jle 0x140013668
lea rbx, [rdi + 8]
nop word [rax + rax]
mov rcx, qword [rbx]
mov rax, r14
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400135e6
cmp rax, 5
jne 0x140013617
add rcx, 2
lea rdx, [0x140234320]
call fcn.1401a5ba8
test eax, eax
jne 0x140013617
mov rax, qword [rbx]
cmp word [rax], 0x2f
je 0x14001394a
mov rcx, qword [rbx]
mov rax, r14
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140013620
cmp rax, 6
jne 0x140013658
add rcx, 4
lea rdx, [0x140234320]
call fcn.1401a5ba8
test eax, eax
jne 0x140013658
mov rax, qword [rbx]
cmp word [rax], 0x2d
jne 0x140013658
cmp word [rax + 2], 0x2d
je 0x14001394a
inc r13d
add rbx, 8
cmp r13d, r12d
jl 0x1400135e0
mov byte [rsp + 0x50], 0
mov r13d, r14d
cmp r12d, esi
jle 0x140013700
lea rbx, [rdi + 8]
mov r15d, esi
mov rcx, qword [rbx]
mov rax, r14
inc rax
cmp word [rcx + rax*2], 0
jne 0x140013686
cmp rax, 4
jne 0x1400136b3
add rcx, 2
lea rdx, [0x140234330]
call fcn.1401a5ba8
test eax, eax
jne 0x1400136b3
mov rax, qword [rbx]
cmp word [rax], 0x2f
je 0x14001370c
mov rcx, qword [rbx]
mov rax, r14
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400136c0
cmp rax, 5
jne 0x1400136f4
add rcx, 4
lea rdx, [0x140234330]
call fcn.1401a5ba8
test eax, eax
jne 0x1400136f4
mov rax, qword [rbx]
cmp word [rax], 0x2d
jne 0x1400136f4
cmp word [rax + 2], 0x2d
je 0x14001370c
inc r15d
add rbx, 8
cmp r15d, r12d
jl 0x140013680
mov r15d, r14d
cmp r12d, esi
jle 0x14001378f
lea rbx, [rdi + 8]
mov rcx, qword [rbx]
mov rax, r14
inc rax
cmp word [rcx + rax*2], 0
jne 0x140013716
cmp rax, 9
jne 0x140013743
add rcx, 2
lea rdx, str.indPages
call fcn.1401a5ba8
test eax, eax
jne 0x140013743
mov rax, qword [rbx]
cmp word [rax], 0x2f
je 0x14001379c
mov rcx, qword [rbx]
mov rax, r14
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140013750
cmp rax, 0xa
jne 0x140013784
add rcx, 4
lea rdx, str.indPages
call fcn.1401a5ba8
test eax, eax
jne 0x140013784
mov rax, qword [rbx]
cmp word [rax], 0x2d
jne 0x140013784
cmp word [rax + 2], 0x2d
je 0x14001379c
inc esi
add rbx, 8
cmp esi, r12d
jl 0x140013710
mov esi, r14d
cmp r12d, 1
jle 0x14001382f
lea rbx, [rdi + 8]
mov edi, 1
nop word [rax + rax]
mov rcx, qword [rbx]
mov rax, r14
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400137b6
cmp rax, 0x12
jne 0x1400137e3
add rcx, 2
lea rdx, str.PassAllocationPtr
call fcn.1401a5ba8
test eax, eax
jne 0x1400137e3
mov rax, qword [rbx]
cmp word [rax], 0x2f
je 0x140013832
mov rcx, qword [rbx]
mov rax, r14
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400137f0
cmp rax, 0x13
jne 0x140013824
add rcx, 4
lea rdx, str.PassAllocationPtr
call fcn.1401a5ba8
test eax, eax
jne 0x140013824
mov rax, qword [rbx]
cmp word [rax], 0x2d
jne 0x140013824
cmp word [rax + 2], 0x2d
je 0x140013832
inc edi
add rbx, 8
cmp edi, r12d
jl 0x1400137b0
mov edi, r14d
test edi, edi
setg bl
test r13d, r13d
jle 0x140013866
lea rdx, [0x140232378]
lea rcx, [0x140273a80]
call fcn.14000e490
mov rcx, rax
lea rdx, str.___Free_pool_memory_after_usage_enabled
call fcn.14000e7c0
mov rcx, rax
call fcn.14000ea50
test r15d, r15d
jle 0x140013895
lea rdx, [0x140232378]
lea rcx, [0x140273a80]
call fcn.14000e490
mov rcx, rax
lea rdx, str.___Mdl_memory_usage_enabled
call fcn.14000e7c0
mov rcx, rax
call fcn.14000ea50
test esi, esi
jle 0x1400138c3
lea rdx, [0x140232378]
lea rcx, [0x140273a80]
call fcn.14000e490
mov rcx, rax
lea rdx, str.___Allocate_Independent_Pages_mode_enabled
call fcn.14000e7c0
mov rcx, rax
call fcn.14000ea50
test edi, edi
jle 0x1400138f1
lea rdx, [0x140232378]
lea rcx, [0x140273a80]
call fcn.14000e490
mov rcx, rax
lea rdx, str.___Pass_Allocation_Ptr_as_first_param_enabled
call fcn.14000e7c0
mov rcx, rax
call fcn.14000ea50
call fcn.140005e40
mov qword [0x140274db8], rax
cmp rax, r14
je 0x14001350c
test r15d, r15d
jle 0x14001395e
test esi, esi
jle 0x140013957
lea rdx, [0x140232378]
lea rcx, [0x140273a80]
call fcn.14000e490
mov rcx, rax
lea rdx, str.____Too_many_allocation_modes
call fcn.14000e7c0
mov rcx, rax
call fcn.14000ea50
mov rcx, qword [0x140274db8]
call fcn.140006e60
jmp 0x14001350c
test r13d, r13d
setg byte [rsp + 0x50]
jmp 0x140013679
mov ecx, 1
jmp 0x14001396a
xor ecx, ecx
mov edx, 2
test esi, esi
cmovg ecx, edx
mov dword [rsp + 0x58], 0
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 0x10
cmovae rdx, qword [rbp - 0x80]
lea r8, [rsp + 0x58]
mov qword [rsp + 0x48], r8
mov byte [rsp + 0x38], bl
mov dword [rsp + 0x30], ecx
movzx ecx, byte [rsp + 0x50]
mov byte [rsp + 0x20], cl
mov rcx, rax
call fcn.140014380
mov rcx, qword [0x140274db8]
test rax, rax
jne 0x1400139b9
call fcn.140006e60
jmp 0x14001350c
call fcn.140006e60
test al, al
jne 0x1400139ec
lea rdx, [0x140232378]
lea rcx, [0x140273a80]
call fcn.14000e490
mov rcx, rax
lea rdx, str.____Warning_failed_to_fully_unload_vulnerable_driver
call fcn.14000e7c0
mov rcx, rax
call fcn.14000ea50
lea rdx, [0x140232378]
lea rcx, [0x140273a80]
call fcn.14000e490
mov rcx, rax
lea rdx, str.___success
call fcn.14000e7c0
mov rcx, rax
call fcn.14000ea50
lea rcx, str.success_n
call fcn.140002550
lea rcx, [rsp + 0x60]
call fcn.140012f10
xor r14d, r14d
jmp 0x14001350c
call fcn.1401a16fc
nop
call fcn.1401a16fc
int3