Function at 0x18016d8b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub rsp, 0x68
mov dword [sym.extension.dll_Py_IgnoreEnvironmentFlag], 1
mov dword [sym.extension.dll_Py_NoSiteFlag], 1
call sym.extension.dll_Py_Initialize
call sym.extension.dll_PyEval_InitThreads
lea rdx, str.write
lea rcx, str.meterpreter_stdout
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 0x3f5
call sym.extension.dll_Py_InitModule4_64
test rax, rax
je 0x18016d912
lea rcx, str.stdout
mov rdx, rax
call sym.extension.dll_PySys_SetObject
lea rcx, str._PYTHON__Successfully_set_the_stdout_hook
test eax, eax
je 0x18016d919
lea rcx, str._PYTHON__Failed_to_set_the_stdout_hook
call fcn.18016d7e0
lea rdx, str.write
lea rcx, str.meterpreter_stderr
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 0x3f5
call sym.extension.dll_Py_InitModule4_64
test rax, rax
je 0x18016d95e
lea rcx, str.stderr
mov rdx, rax
call sym.extension.dll_PySys_SetObject
lea rcx, str._PYTHON__Successfully_set_the_stderr_hook
test eax, eax
je 0x18016d965
lea rcx, str._PYTHON__Failed_to_set_the_stderr_hook
call fcn.18016d7e0
mov qword [rsp + 0x80], rbx
call fcn.180028df0
call fcn.180046df0
call fcn.1800526d0
call fcn.180081400
mov rax, qword [0x180519618]
test rax, rax
jne 0x18016da74
lea r8d, [rax + 0x30]
lea rdx, [rsp + 0x30]
lea rcx, [fcn.18016d8b0]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x18016d9d2
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str._PYTHON__VirtualQuery_failed:__d
mov edx, eax
call fcn.18016d7e0
mov rbx, qword [rsp + 0x80]
add rsp, 0x68
ret
mov rbx, qword [rsp + 0x38]
lea rcx, str._PYTHON__Module_handle:__p
mov rdx, rbx
call fcn.18016d7e0
lea r8, [0x180348634]
mov edx, 0x539
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
test rax, rax
jne 0x18016da21
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str._PYTHON__Unable_to_find_resource:__d
mov edx, eax
call fcn.18016d7e0
mov rbx, qword [rsp + 0x80]
add rsp, 0x68
ret
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x18016da53
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str._PYTHON__Unable_to_load_core_library_resource:__d
mov edx, eax
call fcn.18016d7e0
mov rbx, qword [rsp + 0x80]
add rsp, 0x68
ret
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
add rax, 4
mov r8d, dword [rax - 4]
mov qword [0x180519618], rax
mov dword [0x180519620], r8d
jmp 0x18016da7b
mov r8d, dword [0x180519620]
lea rcx, str._PYTHON__coreLibPointer:__p__coreLibSize:__d
mov rdx, rax
call fcn.18016d7e0
mov rcx, qword [0x180519618]
test rcx, rcx
je 0x18016dbf2
mov edx, dword [0x180519620]
mov qword [rsp + 0x88], rsi
mov qword [rsp + 0x60], rdi
call sym.extension.dll_PyString_FromStringAndSize
lea rcx, str._PYTHON__libString_is__p
mov rdx, rax
mov rsi, rax
call fcn.18016d7e0
lea rcx, str.zlib
call sym.extension.dll_PyString_FromString
lea rcx, str._PYTHON__zlibModStr:__p
mov rdx, rax
mov rbx, rax
call fcn.18016d7e0
mov rcx, rbx
call sym.extension.dll_PyImport_Import
lea rcx, str._PYTHON__zlibMod:__p
mov rdx, rax
mov rbx, rax
call fcn.18016d7e0
lea rdx, str.decompress
mov rcx, rbx
call sym.extension.dll_PyObject_GetAttrString
lea rcx, str._PYTHON__zlibDecompress:__p
mov rdx, rax
mov rdi, rax
call fcn.18016d7e0
mov rdx, rsi
mov ecx, 1
call sym.extension.dll_PyTuple_Pack
lea rcx, str._PYTHON__zlibDecompressArgs:__p
mov rdx, rax
mov rbx, rax
call fcn.18016d7e0
mov rdx, rbx
mov rcx, rdi
call sym.extension.dll_PyObject_CallObject
lea rcx, str._PYTHON__zlibDecompressResult:__p
mov rdx, rax
mov rbx, rax
call fcn.18016d7e0
xor eax, eax
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x78]
mov rcx, rbx
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x70], rax
call sym.extension.dll_PyString_AsStringAndSize
mov r8, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
lea rcx, str._PYTHON__bytes:__p__u
call fcn.18016d7e0
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x78]
call sym.extension.dll_PyMarshal_ReadObjectFromString
lea rcx, str._PYTHON__modData:__p
mov rdx, rax
mov rdi, rax
call fcn.18016d7e0
lea rcx, str.__main__
call sym.extension.dll_PyImport_AddModule
mov rcx, rax
mov rbx, rax
call sym.extension.dll_PyModule_GetDict
lea rdx, str.met_lib_data
mov r8, rdi
mov rcx, rbx
call sym.extension.dll_PyModule_AddObject
lea rcx, str.eval_met_lib_data_0___met_init_True_
xor edx, edx
call sym.extension.dll_PyRun_SimpleStringFlags
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x88]
call sym.extension.dll_PyErr_Clear
cmp qword [0x1804ffea8], 0
lea rbx, str.initmsvcrt
je 0x18016dc50
nop dword [rax + rax]
mov rdx, qword [rbx]
lea rcx, str._PYTHON__Running__s
call fcn.18016d7e0
call qword [rbx + reloc.WS2_32.dll_htonl]
call sym.extension.dll_PyErr_Occurred
test rax, rax
je 0x18016dc45
call sym.extension.dll_PyErr_Print
mov rdx, qword [rbx]
lea rcx, str._PYTHON___s_errored
call fcn.18016d7e0
call sym.extension.dll_PyErr_Clear
add rbx, 0x10
cmp qword [rbx + 8], 0
jne 0x18016dc10
call fcn.18016e200
mov rbx, qword [rsp + 0x80]
add rsp, 0x68
jmp 0x18016ef50
push rbx
sub rsp, 0x30
lea rcx, str._PYTHON__Initialising_binding...
call fcn.18016ebd0
lea rcx, str.meterpreter_bindings
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0x3f5
call sym.extension.dll_Py_InitModule4_64
xor ecx, ecx
mov qword [0x180519648], rax
call fcn.18016ee00
mov rbx, qword [0x180519640]
mov rbx, qword [rbx]
test rbx, rbx
je 0x18016efb0
nop dword [rax + rax]
mov ecx, dword [rbx + 0x10]
call fcn.18016ee00
mov rbx, qword [rbx]
test rbx, rbx
jne 0x18016efa0
add rsp, 0x30
pop rbx
ret