Function at 0x10000b340
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x48
xor r13d, r13d
mov rbp, rcx
cmp qword [rcx + 0x588], r13
jne 0x10000b36a
mov eax, 0x80004003
jmp 0x10000badc
cmp qword [rcx + 0x568], r13
je 0x10000b360
cmp qword [rcx + 0x540], r13
je 0x10000b360
mov rcx, qword [0x100015570]
lea r8, [0x100003810]
mov edx, 0xd2
call qword [sym.imp.KERNEL32.dll_FindResourceW]
cmp rax, r13
je 0x10000b360
mov rcx, qword [0x100015570]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
cmp rax, r13
je 0x10000b360
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
cmp rax, r13
je 0x10000b360
lea rcx, [rsp + 0x90]
mov qword [rsp + 0x90], r13
call sub.WMVCore.DLL_WMCreateProfileManager
mov r12d, 0x42
lea rcx, [rbp + 8]
cmp eax, r13d
mov ebx, eax
mov word [rbp + 0x16], r12w
jge 0x10000b416
mov dword [rcx + 8], r13d
mov word [rcx + 0x10], r13w
mov dword [rcx + 0x20], eax
call fcn.1000083b0
mov rcx, qword [rsp + 0x90]
cmp rcx, r13
je 0x10000b40f
mov rax, qword [rcx]
call qword [rax + 0x10]
mov eax, ebx
jmp 0x10000badc
mov dword [rbp + 0x10], r13d
mov word [rbp + 0x18], r13w
mov dword [rbp + 0x28], r13d
call fcn.1000083b0
mov ebx, 6
mov word [rbp + 0x16], r12w
mov word [rbp + 0x18], bx
lea rcx, [rbp + 8]
cmp qword [rsp + 0x90], r13
jne 0x10000b470
mov dword [rbp + 0x10], r13d
mov dword [rbp + 0x28], 0x80004003
call fcn.1000083b0
mov rcx, qword [rsp + 0x90]
cmp rcx, r13
je 0x10000b360
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x10000b360
mov r15d, 1
mov dword [rbp + 0x28], r13d
mov dword [rbp + 0x10], r15d
call fcn.1000083b0
mov rcx, qword [rsp + 0x90]
mov qword [rsp + 0xa0], r13
mov rax, qword [rcx]
lea r8, [rsp + 0xa0]
mov rdx, rdi
call qword [rax + 0x28]
lea r12d, [r15 + 0x42]
lea rcx, [rbp + 8]
cmp eax, r13d
mov word [rbp + 0x16], r12w
mov dword [rbp + 0x10], r13d
mov word [rbp + 0x18], r13w
mov edi, eax
jge 0x10000b4f6
mov dword [rbp + 0x28], eax
call fcn.1000083b0
mov rcx, qword [rsp + 0xa0]
cmp rcx, r13
je 0x10000b4dc
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x90]
cmp rcx, r13
je 0x10000b4ef
mov rax, qword [rcx]
call qword [rax + 0x10]
mov eax, edi
jmp 0x10000badc
mov dword [rbp + 0x28], r13d
call fcn.1000083b0
mov word [rbp + 0x16], r12w
mov word [rbp + 0x18], bx
lea rcx, [rbp + 8]
cmp qword [rsp + 0xa0], r13
jne 0x10000b542
mov dword [rbp + 0x10], r13d
mov dword [rbp + 0x28], 0x80004003
call fcn.1000083b0
mov rcx, qword [rsp + 0xa0]
cmp rcx, r13
je 0x10000b454
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x10000b454
mov dword [rbp + 0x10], r15d
mov dword [rbp + 0x28], r13d
call fcn.1000083b0
xor edx, edx
lea rax, [rsp + 0x98]
lea r9, [0x1000019b8]
lea rcx, [0x100001948]
lea r8d, [rdx + 3]
mov qword [rsp + 0x98], r13
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoCreateInstance]
lea rcx, [rbp + 8]
mov edi, eax
mov eax, 0x21
cmp edi, r13d
mov word [rbp + 0x16], ax
mov dword [rbp + 0x10], r13d
mov word [rbp + 0x18], r13w
jge 0x10000b5bf
mov dword [rbp + 0x28], edi
call fcn.1000083b0
mov rcx, qword [rsp + 0x98]
cmp rcx, r13
je 0x10000b4c9
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x10000b4c9
mov dword [rbp + 0x28], r13d
call fcn.1000083b0
mov r11d, 0x1f
mov word [rbp + 0x16], r11w
lea rcx, [rbp + 8]
mov word [rbp + 0x18], bx
cmp qword [rsp + 0x98], r13
jne 0x10000b611
mov dword [rbp + 0x10], r13d
mov dword [rbp + 0x28], 0x80004003
call fcn.1000083b0
mov rcx, qword [rsp + 0x98]
cmp rcx, r13
je 0x10000b526
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x10000b526
mov dword [rbp + 0x10], r15d
mov dword [rbp + 0x28], r13d
call fcn.1000083b0
mov rcx, qword [rsp + 0x98]
lea r8, [rbp + 0x578]
lea rdx, [0x1000019a8]
mov rax, qword [rcx]
call qword [rax]
mov r14d, 0x44
lea rcx, [rbp + 8]
cmp eax, r13d
mov word [rbp + 0x16], r14w
mov dword [rbp + 0x10], r13d
mov edi, eax
mov word [rbp + 0x18], r13w
jge 0x10000b660
mov dword [rbp + 0x28], eax
jmp 0x10000b59e
mov dword [rbp + 0x28], r13d
call fcn.1000083b0
cmp qword [rbp + 0x578], r13
mov word [rbp + 0x16], r14w
lea rcx, [rbp + 8]
mov word [rbp + 0x18], bx
je 0x10000b5e5
mov dword [rbp + 0x10], r15d
mov dword [rbp + 0x28], r13d
call fcn.1000083b0
mov rcx, qword [rbp + 0x540]
mov rdx, qword [rbp + 0x578]
lea r8, [0x100003820]
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rcx, [rbp + 8]
mov edi, eax
mov eax, 0x2e
cmp edi, r13d
mov word [rbp + 0x16], ax
mov dword [rbp + 0x10], r13d
mov word [rbp + 0x18], r13w
jl 0x10000b59b
mov dword [rbp + 0x28], r13d
call fcn.1000083b0
mov rcx, qword [rsp + 0x98]
mov rax, qword [rcx]
mov edx, r15d
call qword [rax + 0x28]
lea rcx, [rbp + 8]
mov edi, eax
mov eax, 0x46
cmp edi, r13d
mov word [rbp + 0x16], ax
mov dword [rbp + 0x10], r13d
mov word [rbp + 0x18], r13w
jl 0x10000b59b
mov dword [rbp + 0x28], r13d
call fcn.1000083b0
mov rcx, qword [rsp + 0x98]
mov rax, qword [rcx]
mov rdx, qword [rbp + 0x70]
xor r8d, r8d
call qword [rax + 0x18]
lea rcx, [rbp + 8]
mov edi, eax
mov eax, 0x47
cmp edi, r13d
mov word [rbp + 0x16], ax
mov dword [rbp + 0x10], r13d
mov word [rbp + 0x18], r13w
jl 0x10000b59b
mov dword [rbp + 0x28], r13d
call fcn.1000083b0
mov rcx, qword [rsp + 0x98]
mov qword [rsp + 0xa8], r13
mov rax, qword [rcx]
lea r8, [rsp + 0xa8]
lea rdx, [0x1000036f0]
call qword [rax]
mov r14d, 0x45
lea rcx, [rbp + 8]
cmp eax, r13d
mov word [rbp + 0x16], r14w
mov dword [rbp + 0x10], r13d
mov edi, eax
mov word [rbp + 0x18], r13w
jge 0x10000b7b6
mov dword [rbp + 0x28], eax
call fcn.1000083b0
mov rcx, qword [rsp + 0xa8]
cmp rcx, r13
je 0x10000b5a3
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x10000b5a3
mov dword [rbp + 0x28], r13d
call fcn.1000083b0
mov word [rbp + 0x16], r14w
mov word [rbp + 0x18], bx
lea rcx, [rbp + 8]
cmp qword [rsp + 0xa8], r13
jne 0x10000b802
mov dword [rbp + 0x10], r13d
mov dword [rbp + 0x28], 0x80004003
call fcn.1000083b0
mov rcx, qword [rsp + 0xa8]
cmp rcx, r13
je 0x10000b5f5
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x10000b5f5
mov dword [rbp + 0x10], r15d
mov dword [rbp + 0x28], r13d
call fcn.1000083b0
mov rcx, qword [rsp + 0xa8]
mov rdx, qword [rsp + 0xa0]
mov rax, qword [rcx]
call qword [rax + 0x38]
lea rcx, [rbp + 8]
mov ebx, eax
mov eax, 0x48
cmp ebx, r13d
mov word [rbp + 0x16], ax
mov dword [rbp + 0x10], r13d
mov word [rbp + 0x18], r13w
jge 0x10000b88c
mov dword [rbp + 0x28], ebx
call fcn.1000083b0
mov rcx, qword [rsp + 0xa8]
cmp rcx, r13
je 0x10000b85d
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x98]
cmp rcx, r13
je 0x10000b870
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0xa0]
cmp rcx, r13
je 0x10000b3fc
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x10000b3fc
mov dword [rbp + 0x28], r13d
call fcn.1000083b0
mov rdx, qword [rbp + 0x588]
lea rax, [rsp + 0x30]
xor r9d, r9d
mov r8d, r15d
mov rcx, rbp
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x20], rax
call fcn.10000a6b0
cmp eax, r13d
mov ebx, eax
jge 0x10000b8d5
mov rcx, qword [rsp + 0x30]
cmp rcx, r13
je 0x10000b84a
mov rdx, qword [rcx]
call qword [rdx + 0x10]
jmp 0x10000b84a
mov rbx, qword [rsp + 0x30]
cmp rbx, r13
je 0x10000b7e6
mov rcx, qword [rbp + 0x540]
mov rdx, rbx
mov rax, qword [rcx]
call qword [rax + 0x48]
lea rcx, [rbp + 8]
mov edi, eax
mov eax, 0x30
cmp edi, r13d
mov word [rbp + 0x16], ax
mov dword [rbp + 0x10], r13d
mov word [rbp + 0x18], r13w
jge 0x10000b927
mov dword [rbp + 0x28], edi
call fcn.1000083b0
mov r11, qword [rbx]
mov rcx, rbx
call qword [r11 + 0x10]
jmp 0x10000b79a
mov dword [rbp + 0x28], r13d
call fcn.1000083b0
mov rdx, qword [rbp + 0x578]
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov rcx, rbp
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x20], rax
call fcn.10000a6b0
cmp eax, r13d
mov edi, eax
jge 0x10000b979
mov rcx, qword [rsp + 0x30]
cmp rcx, r13
je 0x10000b96b
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 0x10]
jmp 0x10000b79a
mov rdi, qword [rsp + 0x30]
cmp rdi, r13
jne 0x10000b991
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
jmp 0x10000b7e6
mov rcx, qword [rbp + 0x540]
mov r8, rdi
mov rdx, rbx
mov rax, qword [rcx]
call qword [rax + 0x58]
lea rcx, [rbp + 8]
mov r12d, eax
mov eax, 0x2f
cmp r12d, r13d
mov word [rbp + 0x16], ax
mov dword [rbp + 0x10], r13d
mov word [rbp + 0x18], r13w
jge 0x10000ba33
mov dword [rbp + 0x28], r12d
call fcn.1000083b0
mov r11, qword [rdi]
mov rcx, rdi
call qword [r11 + 0x10]
mov r11, qword [rbx]
mov rcx, rbx
call qword [r11 + 0x10]
mov rcx, qword [rsp + 0xa8]
cmp rcx, r13
je 0x10000b9f2
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x98]
cmp rcx, r13
je 0x10000ba05
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0xa0]
cmp rcx, r13
je 0x10000ba18
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x90]
cmp rcx, r13
je 0x10000ba2b
mov rax, qword [rcx]
call qword [rax + 0x10]
mov eax, r12d
jmp 0x10000badc
mov dword [rbp + 0x28], r13d
call fcn.1000083b0
mov rcx, qword [rbp + 0x550]
mov rax, qword [rcx]
call qword [rax + 0x38]
lea rcx, [rbp + 8]
mov r12d, eax
mov eax, 0x4a
cmp r12d, r13d
mov word [rbp + 0x16], ax
mov dword [rbp + 0x10], r13d
mov word [rbp + 0x18], r13w
jl 0x10000b9c2
mov dword [rbp + 0x28], r13d
call fcn.1000083b0
mov dword [rbp + 0x164], r15d
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
mov r11, qword [rbx]
mov rcx, rbx
call qword [r11 + 0x10]
mov rcx, qword [rsp + 0xa8]
cmp rcx, r13
je 0x10000baa1
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x98]
cmp rcx, r13
je 0x10000bab4
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0xa0]
cmp rcx, r13
je 0x10000bac7
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x90]
cmp rcx, r13
je 0x10000bada
mov rax, qword [rcx]
call qword [rax + 0x10]
xor eax, eax
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret