Function at 0x1400079d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbp
push rdi
push r12
push r14
push r15
sub rsp, 0x460
lea rbp, [rsp + 0x20]
mov qword [rbp + 0x20], 0xfffffffffffffffe
mov qword [rbp + 0x480], rbx
mov qword [rbp + 0x488], rsi
mov r15, r9
mov r12, r8
mov rsi, rdx
xor ebx, ebx
mov qword [rbp + 0x478], rbx
mov qword [rbp + 0x18], rcx
mov qword [rbp + 0x10], rbx
mov qword [rbp + 0x30], rbx
test rdx, rdx
je 0x140007c7c
or rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], 0
jne 0x140007a26
inc eax
cdqe
lea r14, [rax + rax]
mov eax, 0x80000000
add rax, r14
mov ecx, 0xffffffff
cmp rax, rcx
ja 0x140007c7c
movsxd rdi, r14d
cmp r14d, 0x400
jg 0x140007a8c
mov rcx, rdi
call fcn.14000b030
test al, al
je 0x140007a8c
lea rax, [rdi + 0xf]
cmp rax, rdi
ja 0x140007a79
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.1400112c0
sub rsp, rax
lea rcx, [rsp + 0x20]
jmp 0x140007adf
mov rax, rdi
not rax
cmp rax, 0x10
jb 0x140007a9e
add rdi, 0x10
jmp 0x140007aa5
mov rdi, qword [rbp + 0x470]
cmp rax, 0x10
sbb ecx, ecx
and ecx, 0x80070216
cmp rax, 0x10
jb 0x140007cdb
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
test rax, rax
jne 0x140007ace
mov rcx, rbx
jmp 0x140007adf
mov qword [rax], rbx
mov rbx, rax
mov qword [rbp + 0x478], rax
lea rcx, [rax + 0x10]
mov r9d, 3
mov r8d, r14d
mov rdx, rsi
call fcn.140005390
mov rdi, rax
test rax, rax
je 0x140007c7c
xor edx, edx
lea r8d, [rdx + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
mov qword [rbp], rax
test rax, rax
jne 0x140007b3e
xor edx, edx
lea r8d, [rax + 2]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
mov qword [rbp], rax
test rax, rax
jne 0x140007b3e
call fcn.1400044f0
mov edi, eax
jmp 0x140007c41
mov r8, r15
mov rdx, r12
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdi, rax
test rax, rax
jne 0x140007b5f
call fcn.1400044f0
jmp 0x140007c30
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r14, rax
mov qword [rbp + 8], rax
test rax, rax
jne 0x140007b81
call fcn.1400044f0
jmp 0x140007c30
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [rbp + 0x470], edi
lea eax, [rdi + 1]
cmp eax, edi
jae 0x140007ba6
mov edi, 0x8007000e
jmp 0x140007c32
mov r8d, eax
test eax, eax
je 0x140007bd7
xor edx, edx
or rax, 0xffffffffffffffff
div r8
cmp rax, 1
jb 0x140007ce1
cmp r8, 0x400
jbe 0x140007bd7
mov edx, r8d
lea rcx, [rbp + 0x30]
call fcn.140004390
jmp 0x140007bdf
lea rax, [rbp + 0x38]
mov qword [rbp + 0x30], rax
jmp 0x140007bf6
mov rcx, qword [rbp + 0x30]
test rcx, rcx
jne 0x140007c06
mov edi, 0x8007000e
jmp 0x140007c32
mov r9, rdi
mov r8, r14
mov rdx, rdi
call fcn.14000b830
mov rax, qword [rbp + 0x30]
mov byte [rdi + rax], 0
mov r8d, dword [rbp + 0x490]
mov rdx, qword [rbp + 0x30]
lea rcx, [rbp + 0x10]
call fcn.140007580
mov edi, eax
test rsi, rsi
je 0x140007c41
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rbp + 0x38]
cmp qword [rbp + 0x30], rax
je 0x140007c55
lea rcx, [rbp + 0x30]
call fcn.140006100
nop
test rbx, rbx
je 0x140007c78
nop word [rax + rax]
mov rcx, rbx
mov rbx, qword [rbx]
mov qword [rbp + 0x478], rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test rbx, rbx
jne 0x140007c60
mov eax, edi
jmp 0x140007cbd
lea rax, [rbp + 0x38]
cmp qword [rbp + 0x30], rax
je 0x140007c90
lea rcx, [rbp + 0x30]
call fcn.140006100
nop
test rbx, rbx
je 0x140007cb8
nop word [rax + rax]
mov rcx, rbx
mov rbx, qword [rbx]
mov qword [rbp + 0x478], rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test rbx, rbx
jne 0x140007ca0
mov eax, 0x8007000e
mov rbx, qword [rbp + 0x480]
mov rsi, qword [rbp + 0x488]
lea rsp, [rbp + 0x440]
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.140005280
nop
mov ecx, 0x80070216
call fcn.140005280
int3