Function at 0x1800094a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x480
lea rbp, [rsp + 0x20]
mov qword [rbp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x18009b4d0]
xor rax, rbp
mov qword [rbp + 0x450], rax
mov r14, r9
mov r13, r8
mov r12, rdx
xor ebx, ebx
mov qword [rbp + 8], rbx
mov qword [rbp + 0x28], rcx
mov qword [rbp + 0x20], rbx
mov rax, rbx
mov qword [rbp + 0x40], rbx
test rdx, rdx
je 0x180009743
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
movsxd rdi, eax
add rdi, rdi
mov eax, 0x80000000
add rax, rdi
mov ecx, 0xffffffff
cmp rax, rcx
ja 0x18000973f
cmp edi, 0x400
jg 0x18000955b
movsxd rsi, edi
mov rcx, rsi
call fcn.180005cd0
test al, al
je 0x18000955b
lea rax, [rsi + 0xf]
cmp rax, rsi
ja 0x180009548
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.180041f20
sub rsp, rax
lea rcx, [rsp + 0x20]
jmp 0x180009590
movsxd rcx, edi
or rax, 0xffffffffffffffff
sub rax, rcx
cmp rax, 0x10
jb 0x180009734
add rcx, 0x10
call fcn.180022da8
test rax, rax
jne 0x180009582
mov rcx, rbx
jmp 0x180009590
mov qword [rax], rbx
mov rbx, rax
mov qword [rbp + 8], rax
lea rcx, [rax + 0x10]
mov r9d, 3
mov r8d, edi
mov rdx, r12
call fcn.180004940
test rax, rax
je 0x18000973f
xor edx, edx
lea r8d, [rdx + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
mov qword [rbp + 0x18], rax
test rax, rax
jne 0x1800095d1
call fcn.180004b30
mov edi, eax
jmp 0x180009704
mov r8, r14
mov rdx, r13
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdi, rax
test rax, rax
jne 0x1800095f4
call fcn.180004b30
mov edi, eax
jmp 0x1800096fa
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r12, rax
mov qword [rbp + 0x10], rax
test rax, rax
jne 0x180009618
call fcn.180004b30
mov edi, eax
jmp 0x1800096fa
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [rbp], edi
lea eax, [rdi + 1]
cmp eax, edi
jae 0x18000966a
lea rax, [rbp + 0x48]
cmp qword [rbp + 0x40], rax
je 0x180009644
lea rcx, [rbp + 0x40]
call fcn.180005b20
nop
test rbx, rbx
je 0x180009660
nop dword [rax]
mov rcx, rbx
mov rbx, qword [rbx]
call fcn.18002220c
test rbx, rbx
jne 0x180009650
mov eax, 0x8007000e
jmp 0x180009775
mov ecx, eax
test eax, eax
je 0x1800096a4
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 1
jae 0x180009689
mov ecx, 0x80070057
call fcn.180003100
cmp rcx, 0x400
jbe 0x1800096a4
mov rdx, rcx
lea rcx, [rbp + 0x40]
call fcn.180005b60
mov rcx, qword [rbp + 0x40]
jmp 0x1800096ac
lea rcx, [rbp + 0x48]
mov qword [rbp + 0x40], rcx
jmp 0x1800096c1
test rcx, rcx
jne 0x1800096cd
mov edi, 0x8007000e
jmp 0x1800096fa
mov r9, rdi
mov r8, r12
mov rdx, rdi
call fcn.180004a10
mov r11, qword [rbp + 0x40]
mov byte [rdi + r11], 0
mov r8d, dword [rbp + 0x4c0]
mov rdx, qword [rbp + 0x40]
lea rcx, [rbp + 0x20]
call fcn.1800090a0
mov edi, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rbp + 0x48]
cmp qword [rbp + 0x40], rax
je 0x180009718
lea rcx, [rbp + 0x40]
call fcn.180005b20
nop
test rbx, rbx
je 0x180009730
nop dword [rax]
mov rcx, rbx
mov rbx, qword [rbx]
call fcn.18002220c
test rbx, rbx
jne 0x180009720
mov eax, edi
jmp 0x180009775
mov ecx, 0x80070057
call fcn.180003100
int3
mov rax, qword [rbp + 0x40]
lea rcx, [rbp + 0x48]
cmp rax, rcx
je 0x180009756
lea rcx, [rbp + 0x40]
call fcn.180005b20
nop
test rbx, rbx
je 0x180009770
nop dword [rax + rax]
mov rcx, rbx
mov rbx, qword [rbx]
call fcn.18002220c
test rbx, rbx
jne 0x180009760
mov eax, 0x8007000e
mov rcx, qword [rbp + 0x450]
xor rcx, rbp
call fcn.180022070
lea rsp, [rbp + 0x460]
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret