Function at 0x140043dd0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rbp, r8
mov rdi, rdx
mov r12, rcx
test rdx, rdx
je 0x140044080
call fcn.140002ab0
mov r14, rax
mov qword [rsp + 0x30], rax
mov rcx, qword [rax]
or rcx, 6
mov qword [rsp + 0x28], rbp
xor eax, eax
mov qword [rsp + 0x20], rax
mov r9, rdi
xor r8d, r8d
xor edx, edx
call fcn.140081638
mov r15d, eax
mov r13, 0xffffffffffffffff
test eax, eax
cmovs r15d, r13d
test r15d, r15d
js 0x140044075
mov rcx, qword [r12]
mov rcx, qword [rcx - 0x18]
test rcx, rcx
je 0x140043e5c
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x140043e76
call fcn.1400021b0
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rax, rax
je 0x140044075
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x98], rbx
mov esi, 1
cmp rdi, 0x10000
jae 0x140044039
movzx edi, di
mov dword [rsp + 0x88], edi
xor edx, edx
lea rcx, [0x1400e3bf0]
call fcn.1400700a4
mov rbp, rax
mov r14d, esi
test rax, rax
je 0x140043fa0
mov eax, edi
shr rax, 4
inc rax
mov qword [rsp + 0x38], rax
nop
xor r9d, r9d
mov r8, rax
lea edx, [r9 + 6]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
mov rsi, rax
test rax, rax
je 0x140043f57
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140043f57
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
je 0x140043f57
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, eax
add rdx, rdi
mov eax, dword [rsp + 0x88]
mov ecx, eax
and ecx, 0xf
jbe 0x140043f4c
nop dword [rax]
cmp rdi, rdx
jae 0x140043f57
movzx eax, word [rdi]
lea rdi, [rdi + rax*2]
add rdi, 2
add ecx, 0xffffffff
jne 0x140043f30
mov eax, dword [rsp + 0x88]
cmp rdi, rdx
jae 0x140043f57
cmp word [rdi], 0
jne 0x140043f7b
mov edx, r14d
inc r14d
lea rcx, [0x1400e3bf0]
call fcn.1400700a4
mov rbp, rax
test rax, rax
je 0x140043f9b
mov rax, qword [rsp + 0x38]
jmp 0x140043ed0
test rbp, rbp
je 0x140043f9b
mov r8d, eax
mov rdx, rbp
lea rcx, [rsp + 0x98]
call fcn.1400440b0
mov rbx, qword [rsp + 0x98]
mov esi, 1
mov r14, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x90]
mov rdx, qword [r12]
sub esi, dword [rdx - 8]
mov eax, dword [rdx - 0xc]
sub eax, r15d
or esi, eax
jge 0x140043fcd
mov edx, r15d
mov rcx, r12
call fcn.1400419f0
mov rdx, qword [r12]
lea eax, [r15 + 1]
movsxd r8, eax
mov rcx, qword [r14]
or rcx, 4
mov qword [rsp + 0x28], rbp
xor edi, edi
mov qword [rsp + 0x20], rdi
mov r9, rbx
call fcn.140081870
mov rax, qword [r12]
cmp r15d, dword [rax - 0xc]
jg 0x14004406a
mov dword [rax - 0x10], r15d
movsxd rcx, r15d
mov rax, qword [r12]
mov word [rax + rcx*2], di
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], r13d
sub r13d, 1
jg 0x140044021
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rax, r13
nop dword [rax]
inc rax
cmp word [rdi + rax*2], 0
jne 0x140044040
mov r8d, eax
mov rdx, rdi
lea rcx, [rsp + 0x98]
call fcn.1400417f0
mov rbx, qword [rsp + 0x98]
jmp 0x140043fad
mov ecx, 0x80070057
call fcn.1400277b0
nop
mov ecx, 0x80004005
call fcn.1400277b0
int3
mov ecx, 0x80070057
call fcn.1400277b0
int3