Function at 0x140030acc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
xor r13d, r13d
mov edi, r13d
mov rax, r8
cmp qword [r8 + 0x18], 8
jb 0x140030b0c
mov rax, qword [r8]
mov qword [r8 + 0x10], r13
mov word [rax], r13w
lea r8, [0x140045cf0]
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_1.dll_FindResourceW]
nop dword [rax + rax]
mov r15, rax
mov r12d, 0x80070000
test rax, rax
jne 0x140030b60
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx edi, ax
or edi, r12d
test eax, eax
cmovle edi, eax
mov r9d, edi
mov r8, rbp
lea rdx, str.ResourceUtil:_Error_when_attempting_to_load_XML_from_module._Resource_name:___s_._hr0x_08X
mov ecx, edi
call fcn.14000abd4
mov rdx, r15
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadResource]
nop dword [rax + rax]
mov r14, rax
test rax, rax
jne 0x140030ba5
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx edi, ax
or edi, r12d
test eax, eax
cmovle edi, eax
mov r9d, edi
mov r8, rbp
lea rdx, str.ResourceUtil:_Error_when_attempting_to_load_XML_from_module._Resource_name:___s_._hr0x_08X
mov ecx, edi
call fcn.14000abd4
mov rcx, r14
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LockResource]
nop dword [rax + rax]
mov r12, rax
test rax, rax
jne 0x140030bea
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov r9d, edi
mov r8, rbp
lea rdx, str.ResourceUtil:_Error_when_attempting_to_load_XML_from_module._Resource_name:___s_._hr0x_08X
mov ecx, edi
call fcn.14000abd4
mov rdx, r15
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_SizeofResource]
nop dword [rax + rax]
mov r13d, eax
xor ebx, ebx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
mov r9d, eax
mov r8, r12
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.api_ms_win_core_string_l1_1_0.dll_MultiByteToWideChar]
nop dword [rax + rax]
movsxd r15, eax
test eax, eax
jne 0x140030c58
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov r9d, edi
mov r8, rbp
lea rdx, str.ResourceUtil:_Error_when_attempting_to_load_XML_from_module._Resource_name:___s_._hr0x_08X
mov ecx, edi
call fcn.14000abd4
lea ebx, [r15 + 1]
movsxd rcx, ebx
mov eax, 2
mul rcx
mov rdx, 0xffffffffffffffff
cmovo rax, rdx
mov rcx, rax
call fcn.1400321f0
mov r14, rax
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, r13d
mov r8, r12
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.api_ms_win_core_string_l1_1_0.dll_MultiByteToWideChar]
nop dword [rax + rax]
xor ebx, ebx
test eax, eax
jne 0x140030cdb
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov r9d, edi
mov r8, rbp
lea rdx, str.ResourceUtil:_Error_when_attempting_to_load_XML_from_module._Resource_name:___s_._hr0x_08X
mov ecx, edi
call fcn.14000abd4
mov word [r14 + r15*2], bx
mov rdx, r14
mov rcx, rsi
call fcn.14000d008
nop
mov rcx, r14
call fcn.140031098
mov eax, edi
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret