Function at 0x140049320
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x270
mov rax, qword [0x1400ad368]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, qword [0x1400b0dd0]
mov rsi, rcx
mov rcx, rbx
call fcn.140038fa0
mov rbp, qword [rbx + 0x2718]
test rbp, rbp
jne 0x140049372
mov rbp, qword [rbx + 0x2710]
xor r14d, r14d
movzx r9d, ax
mov rcx, rbp
mov ebx, r14d
lea edx, [r14 + 6]
lea r8d, [r14 + 0x7e]
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
lea edi, [r14 + 0xa]
mov r15d, 0x103
test rax, rax
je 0x1400493e7
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
je 0x1400493e7
movzx ebx, word [rax]
lea rdx, [rax + 2]
mov ecx, edi
nop
lea rdx, [rdx + rbx*2]
movzx ebx, word [rdx]
add rdx, 2
sub ecx, 1
jne 0x1400493c0
cmp ebx, r15d
lea rcx, [rsp + 0x50]
cmova ebx, r15d
mov r8d, ebx
add r8, r8
call fcn.140053490
mov eax, ebx
mov word [rsp + rax*2 + 0x50], r14w
test ebx, ebx
jne 0x14004946f
mov edx, 6
mov r9d, 0x409
mov rcx, rbp
mov ebx, r14d
lea r8d, [rdx + 0x78]
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
je 0x140049467
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
je 0x140049467
movzx ebx, word [rax]
lea rdx, [rax + 2]
nop dword [rax]
nop dword [rax + rax]
lea rdx, [rdx + rbx*2]
movzx ebx, word [rdx]
add rdx, 2
sub edi, 1
jne 0x140049440
cmp ebx, r15d
lea rcx, [rsp + 0x50]
cmova ebx, r15d
mov r8d, ebx
add r8, r8
call fcn.140053490
mov eax, ebx
mov word [rsp + rax*2 + 0x50], r14w
movsx rcx, word [rsi + 0x474]
lea rdx, [rsp + 0x50]
mov rdi, 0xffffffffffffffff
mov rax, rdi
inc rax
cmp word [rdx + rax*2], r14w
jne 0x140049486
cmp ax, cx
jl 0x1400494d0
mov ebx, 0x107
lea rbp, [rsp + rcx*2 + 0x4a]
sub rbx, rcx
je 0x1400494d0
lfence
lea r8, [0x14009f500]
mov rdx, rbx
mov rcx, rbp
cmp rbx, 3
jbe 0x1400494c1
call fcn.140069780
jmp 0x1400494d0
lea r9, [rbx - 1]
call fcn.14005a91c
mov word [rbp + rbx*2 - 2], r14w
mov rcx, qword [rsi + 0x458]
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
mov rax, qword [rsi + 0x440]
lea rdx, [rsp + 0x38]
mov rbp, qword [rsi + 0x458]
mov ecx, 0xb
mov ebx, 7
cmp dword [rax + 0x24], r14d
movzx eax, word [rsp + 0x28]
cmovne bx, cx
mov ecx, 0xfff0
and ax, cx
mov rcx, rbp
or bx, ax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx eax, bl
mov ecx, 0xf0
shr al, 4
movzx edx, bx
xor dx, cx
xor al, bl
and al, 0xf
mov rcx, rbp
cmovne dx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rax, [rsp + 0x50]
nop word [rax + rax]
inc rdi
cmp word [rax + rdi*2], r14w
jne 0x140049550
mov r9, rdi
lea r8, [rsp + 0x50]
mov rdx, rbp
mov rcx, rsi
call fcn.14004a010
movzx edx, word [rsp + 0x40]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
cmp byte [rsi + 0x468], r14b
jne 0x1400495bf
call fcn.140069274
movzx eax, ax
cmp eax, 0xa
je 0x1400495b8
cmp eax, 0xd
je 0x1400495b8
cmp eax, 0x20
je 0x1400495ae
cmp eax, 0x58
je 0x1400495a5
cmp eax, 0x78
jne 0x140049584
mov byte [rsi + 0x468], 1
jmp 0x1400495bf
mov word [rsi + 0x438], r14w
jmp 0x1400495bf
dec word [rsi + 0x438]
mov rcx, qword [rsi + 0x450]
lea rdx, [rsi + 0x420]
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movsx rbp, word [rsi + 0x424]
lea rdi, [0x14009f508]
mov esi, 3
test rbp, rbp
je 0x14004960b
mov rbx, rbp
nop
mov ecx, 1
call fcn.140068a60
movzx ecx, word [rdi]
mov rdx, rax
call fcn.140069e08
sub rbx, 1
jne 0x1400495f0
add rdi, 2
sub rsi, 1
jne 0x1400495e7
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140050ca0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret