Function at 0x140018778
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
movzx r9d, word [rcx + 0xc]
mov esi, r8d
xor r12d, r12d
shr r8d, 4
inc r8w
mov qword [rax + 8], r12
movzx ebp, r8w
mov r15, rdx
mov rbx, rcx
mov r8d, ebp
mov rcx, qword [rcx]
lea edx, [r12 + 6]
mov edi, r12d
mov r14d, r12d
and esi, 0xf
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
mov r13d, 0x80070000
test rax, rax
jne 0x140018827
mov rcx, qword [rbx]
lea edx, [rax + 6]
mov r9d, 0x409
mov r8d, ebp
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
jne 0x140018827
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, r13d
test eax, eax
cmovle ecx, eax
test ecx, ecx
jns 0x14001881d
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, r13d
test eax, eax
cmovle ebx, eax
jmp 0x1400188ba
mov ebx, 0x80004005
jmp 0x1400188ba
mov rcx, qword [rbx]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400187f2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x1400187f2
test esi, esi
je 0x140018860
mov ecx, esi
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
sub rcx, 1
jne 0x14001884f
movzx ebp, word [rbx]
mov rcx, 0xffffffffffffffff
inc rbp
mov eax, 2
mul rbp
lea rdx, [0x1400252b0]
cmovo rax, rcx
mov rcx, rax
call fcn.14001f930
mov rsi, rax
test rax, rax
je 0x1400189ab
movzx r9d, word [rbx]
lea r8, [rbx + 2]
mov rdx, rbp
mov rcx, rax
call fcn.140018d80
mov ebx, eax
test eax, eax
jns 0x1400188b7
mov rcx, rsi
call sub.msvcrt.dll_free
jmp 0x1400188ba
mov r14, rsi
test ebx, ebx
js 0x1400189ce
lea rax, [rsp + 0x98]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
lea rax, [rsp + 0x80]
mov dword [rsp + 0x28], r12d
mov rdx, r14
mov qword [rsp + 0x20], rax
mov ecx, 0x500
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
jne 0x14001892e
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, r13d
test eax, eax
cmovle ecx, eax
test ecx, ecx
jns 0x140018924
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, r13d
test eax, eax
cmovle ebx, eax
jmp 0x1400189ce
mov ebx, 0x80004005
jmp 0x1400189ce
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x140018971
mov edi, 0x2022
mov edx, edi
cmp word [rcx], r12w
je 0x140018952
add rcx, 2
sub rdx, 1
jne 0x140018942
mov rax, rdx
neg rax
sbb ebx, ebx
not ebx
and ebx, 0x80070057
test rdx, rdx
je 0x14001896c
sub rdi, rdx
jmp 0x140018976
mov rdi, r12
jmp 0x140018976
mov ebx, 0x80070057
test ebx, ebx
cmovs rdi, r12
js 0x1400189ce
mov rcx, 0xffffffffffffffff
inc rdi
mov eax, 2
mul rdi
lea rdx, [0x1400252b0]
cmovo rax, rcx
mov rcx, rax
call fcn.14001f930
mov qword [r15], rax
test rax, rax
jne 0x1400189b2
mov ebx, 0x8007000e
jmp 0x1400189ce
mov r9, qword [rsp + 0x80]
lea r8, [0x140026388]
mov rdx, rdi
mov rcx, rax
call fcn.140006328
mov ebx, eax
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x1400189e1
call qword [sym.imp.KERNEL32.dll_LocalFree]
test r14, r14
je 0x1400189ee
mov rcx, r14
call sub.msvcrt.dll_free
mov eax, ebx
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret