Function at 0x140002f04
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x490
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x490], rbx
mov rax, qword [0x1401567f8]
xor rax, rbp
mov qword [rbp + 0x440], rax
mov qword [rbp], r9
mov r13, r8
mov r12, rdx
xor edi, edi
mov ebx, edi
mov qword [rbp + 0x18], rbx
mov qword [rbp + 0x28], rcx
mov qword [rbp + 0x20], rdi
xor edx, edx
mov r8d, 0x408
lea rcx, [rbp + 0x30]
call fcn.1400ba120
mov qword [rbp + 0x30], rdi
test r12, r12
je 0x14000319f
or rax, 0xffffffffffffffff
inc rax
cmp word [r12 + rax*2], di
jne 0x140002f70
inc eax
cdqe
lea r15, [rax + rax]
mov eax, 0x80000000
add rax, r15
mov ecx, 0xffffffff
cmp rax, rcx
ja 0x14000303a
movsxd rsi, r15d
cmp r15d, 0x400
jg 0x140002fd6
mov rcx, rsi
call fcn.140002044
test al, al
je 0x140002fd6
lea rax, [rsi + 0xf]
cmp rax, rsi
ja 0x140002fc3
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.1400b81e0
sub rsp, rax
lea r14, [rsp + 0x40]
jmp 0x140003002
mov rax, rsi
not rax
cmp rax, 0x10
jb 0x1400031f3
lea rcx, [rsi + 0x10]
call fcn.1400cb070
test rax, rax
je 0x14000303a
mov qword [rax], rdi
mov rbx, rax
mov qword [rbp + 0x18], rax
lea r14, [rax + 0x10]
test r14, r14
je 0x14000303a
mov byte [r14], dil
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r14
or r9d, 0xffffffff
mov r8, r12
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
neg eax
sbb rsi, rsi
and rsi, r14
jmp 0x14000303d
mov rsi, rdi
test rsi, rsi
je 0x14000319f
xor edx, edx
lea r8d, [rdx + 0x60]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov r14, rax
mov qword [rbp + 8], rax
test rax, rax
jne 0x140003088
xor edx, edx
lea r8d, [rax + 2]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov r14, rax
mov qword [rbp + 8], rax
test rax, rax
jne 0x140003088
call fcn.140002268
mov esi, eax
jmp 0x140003175
mov r8, qword [rbp]
mov rdx, r13
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rsi, rax
test rax, rax
jne 0x1400030aa
call fcn.140002268
jmp 0x140003164
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r15, rax
mov qword [rbp + 0x10], rax
test rax, rax
je 0x1400030a0
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [rbp], esi
lea eax, [rsi + 1]
cmp eax, esi
jae 0x1400030e4
mov esi, 0x8007000e
jmp 0x140003166
mov ecx, eax
test eax, eax
je 0x140003113
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 1
jb 0x1400031fe
cmp rcx, 0x400
jbe 0x140003113
mov edx, ecx
lea rcx, [rbp + 0x30]
call fcn.1400264c0
jmp 0x14000311b
lea rax, [rbp + 0x38]
mov qword [rbp + 0x30], rax
jmp 0x14000312e
cmp qword [rbp + 0x30], rdi
je 0x1400030da
test rsi, rsi
je 0x140003148
mov r8, rsi
mov rdx, r15
mov rcx, qword [rbp + 0x30]
call fcn.1400b9a70
mov rax, qword [rbp + 0x30]
mov byte [rsi + rax], dil
mov r8d, dword [rbp + 0x4b0]
mov rdx, qword [rbp + 0x30]
lea rcx, [rbp + 0x20]
call fcn.140004544
mov esi, eax
test r14, r14
je 0x140003175
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rbp + 0x38]
cmp qword [rbp + 0x30], rax
je 0x140003189
lea rcx, [rbp + 0x30]
call fcn.1400253a0
nop
jmp 0x140003196
mov rcx, rbx
mov rbx, qword [rbx]
call fcn.1400ca5d8
test rbx, rbx
jne 0x14000318b
mov eax, esi
jmp 0x1400031ca
lea rax, [rbp + 0x38]
cmp qword [rbp + 0x30], rax
je 0x1400031b3
lea rcx, [rbp + 0x30]
call fcn.1400253a0
nop
jmp 0x1400031c0
mov rcx, rbx
mov rbx, qword [rbx]
call fcn.1400ca5d8
test rbx, rbx
jne 0x1400031b5
mov eax, 0x8007000e
mov rcx, qword [rbp + 0x440]
xor rcx, rbp
call fcn.1400b7620
mov rbx, qword [rbp + 0x490]
lea rsp, [rbp + 0x450]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80070216
call fcn.1400020e0
nop
mov ecx, 0x80070216
call fcn.1400020e0
int3