Function at 0x18000e4f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov edi, edx
mov rbx, rcx
mov rax, 0xffffffffffffffff
inc rax
cmp byte [r8 + rax], 0
jne 0x18000e506
lea rcx, [r8 - 1]
add rcx, rax
cmp rcx, r8
jbe 0x18000e52d
nop dword [rax]
cmp byte [rcx], 0x2e
je 0x18000e52d
dec rcx
cmp rcx, r8
ja 0x18000e520
inc rcx
lea rdx, [0x180063760]
call fcn.18003f9fc
test eax, eax
jne 0x18000e5bf
mov rbx, qword [rbx + 0xc0]
lea r8, [0x180063c70]
mov rcx, rbx
movzx edx, di
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdi, rax
test rax, rax
je 0x18000e5bf
mov rdx, rax
mov qword [rsp + 0x30], rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
cmp eax, 8
jb 0x18000e594
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
jne 0x18000e5a6
mov rsi, qword [rsp + 0x30]
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov edx, esi
mov rcx, rax
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x18001b570
mov rbx, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xf80]
mov eax, 0x1080
call fcn.180051850
sub rsp, rax
mov rax, qword [0x18006e068]
xor rax, rsp
mov qword [rbp + 0xf78], rax
xor r13d, r13d
mov ebx, edx
mov qword [rsp + 0x70], r13
mov rdi, rcx
cmp edx, 8
jl 0x18001bbe3
lea r8d, [r13 + 8]
mov dword [rbp + 0xf70], 0x474e5089
lea rdx, [rbp + 0xf70]
mov dword [rbp + 0xf74], 0xa1a0a0d
call fcn.1800519f0
test eax, eax
jne 0x18001bbe3
mov qword [rbp - 0x68], rdi
mov dword [rbp - 0x60], ebx
call fcn.180021750
mov rbx, rax
test rax, rax
je 0x18001b64e
mov dword [rax + 0x15c], 0x8000
mov dword [rax + 0x4c0], 0x2000
or dword [rax + 0x160], 0x300000
mov qword [rax + 0x138], r13
lea rax, [0x180024b40]
mov qword [rbx + 0x130], rax
cmp qword [rbx + 0x128], r13
je 0x18001b647
mov qword [rbx + 0x128], r13
mov qword [rbx + 0x2b8], r13
mov qword [rsp + 0x40], rbx
test rbx, rbx
je 0x18001bbe3
mov rax, qword [rbx + 0x440]
test rax, rax
je 0x18001b674
mov edx, 0x158
mov rcx, rbx
call rax
jmp 0x18001b67e
mov ecx, 0x158
call fcn.1800396a4
mov rdi, rax
test rax, rax
je 0x18001bbd7
xor edx, edx
mov r8d, 0x158
mov rcx, rax
call fcn.18002f520
mov rcx, rbx
mov qword [rsp + 0x50], rdi
call fcn.180020400
mov rcx, rax
mov rdx, rsp
call fcn.180054c00
mov rbx, qword [rsp + 0x40]
test eax, eax
je 0x18001b747
test rbx, rbx
je 0x18001bbe3
xor edx, edx
mov rcx, rbx
call fcn.180021940
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.180021940
mov rcx, rbx
mov qword [rsp + 0x40], r13
call fcn.180021280
lea rcx, [rbp - 0x50]
mov rdx, rbx
mov r8d, 0x540
call fcn.180031c80
xor edx, edx
mov r8d, 0x540
mov rcx, rbx
call fcn.18002f520
mov rax, qword [rbp + 0x3f8]
test rax, rax
je 0x18001b731
mov rdx, rbx
lea rcx, [rbp - 0x50]
call rax
lea rcx, [rbp - 0x50]
call fcn.180020480
jmp 0x18001bbe3
mov rcx, rbx
call fcn.18003609c
lea rcx, [rbp - 0x50]
call fcn.180020480
jmp 0x18001bbe3
test rbx, rbx
je 0x18001b77c
lea rax, [rbp - 0x68]
mov qword [rbx + 0x138], rax
lea rax, [0x18001b500]
mov qword [rbx + 0x130], rax
cmp qword [rbx + 0x128], r13
je 0x18001b775
mov qword [rbx + 0x128], r13
mov qword [rbx + 0x2b8], r13
mov rdi, qword [rsp + 0x50]
mov rcx, rbx
mov rdx, rdi
call fcn.180020970
test rbx, rbx
je 0x18001b7f1
test rdi, rdi
je 0x18001b7f1
movzx edx, byte [rdi + 0x26]
movzx ecx, byte [rdi + 0x28]
movzx eax, byte [rdi + 0x27]
movzx r14d, byte [rdi + 0x24]
mov r12d, dword [rdi]
mov r9d, r14d
mov r15d, dword [rdi + 4]
mov r8d, r15d
movzx esi, byte [rdi + 0x25]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x28], ecx
mov dword [rbp - 0x80], edx
mov edx, r12d
mov dword [rbp - 0x78], ecx
mov rcx, rbx
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x5c], r15d
mov dword [rsp + 0x58], r14d
mov dword [rsp + 0x48], esi
mov dword [rbp - 0x7c], eax
mov dword [rsp + 0x20], esi
call fcn.180023c30
jmp 0x18001b804
mov esi, dword [rsp + 0x48]
mov r14d, dword [rsp + 0x58]
mov r15d, dword [rsp + 0x5c]
mov r12d, dword [rsp + 0x60]
cmp esi, 3
jne 0x18001b838
test rbx, rbx
je 0x18001b838
mov eax, dword [rbx + 0x160]
test al, 0x40
je 0x18001b824
bt eax, 0x16
jae 0x18001bc15
jmp 0x18001b838
bts eax, 0xe
or dword [rbx + 0x164], 0x2001000
mov dword [rbx + 0x160], eax
test esi, esi
jne 0x18001b871
cmp r14d, 8
jge 0x18001b871
test rbx, rbx
je 0x18001b8b4
mov eax, dword [rbx + 0x160]
test al, 0x40
je 0x18001b85d
bt eax, 0x16
jae 0x18001bc1e
jmp 0x18001b871
bts eax, 0xe
or dword [rbx + 0x164], 0x1000
mov dword [rbx + 0x160], eax
test rbx, rbx
je 0x18001b8b4
test rdi, rdi
je 0x18001b8b4
mov eax, dword [rdi + 8]
and eax, 0x10
je 0x18001b8b4
mov eax, dword [rbx + 0x160]
test al, 0x40
je 0x18001b899
bt eax, 0x16
jae 0x18001bc27
jmp 0x18001b8ad
bts eax, 0xe
or dword [rbx + 0x164], 0x2001000
mov dword [rbx + 0x160], eax
or esi, 4
mov dword [rsp + 0x48], esi
cmp r14d, 0x10
jne 0x18001b8e9
test rbx, rbx
je 0x18001b8e9
mov eax, dword [rbx + 0x160]
test al, 0x40
je 0x18001b8d5
bt eax, 0x16
jae 0x18001bc30
jmp 0x18001b8e9
bts eax, 0xe
or dword [rbx + 0x164], 0x400
mov dword [rbx + 0x160], eax
cmp r14d, 8
jge 0x18001b90b
test rbx, rbx
je 0x18001b90b
cmp byte [rbx + 0x290], 8
jae 0x18001b90b
or dword [rbx + 0x164], 4
mov byte [rbx + 0x291], 8
test esi, 0xfffffffb
jne 0x18001b968
test rbx, rbx
je 0x18001b968
mov eax, dword [rbx + 0x160]
test al, 0x40
je 0x18001b92e
bt eax, 0x16
jae 0x18001bc39
jmp 0x18001b968
bts eax, 0xe
mov dword [rbx + 0x160], eax
test al, 0x40
je 0x18001b948
bt eax, 0x16
jae 0x18001bc42
jmp 0x18001b958
or dword [rbx + 0x164], 0x1000
mov dword [rbx + 0x160], eax
mov eax, dword [rbx + 0x164]
bts eax, 0xe
mov dword [rbx + 0x164], eax
test sil, 4
je 0x18001b97f
test rbx, rbx
je 0x18001b987
or dword [rbx + 0x164], 0x20000
jmp 0x18001b987
mov rcx, rbx
call fcn.1800205c0
mov rdi, qword [rsp + 0x70]
mov rsi, r13
test rdi, rdi
je 0x18001b9a5
mov rax, qword [rdi]
mov r8d, r15d
mov edx, r12d
mov rcx, rdi
call qword [rax + 0x30]
jmp 0x18001b9d8
lea rdx, [0x18006f000]
mov ecx, 0x20
call fcn.18002e110
mov qword [rbp - 0x70], rax
test rax, rax
je 0x18001b9d0
mov r8d, r15d
mov edx, r12d
mov rcx, rax
call fcn.180011440
mov rsi, rax
mov rdi, rsi
mov qword [rsp + 0x70], rsi
test rdi, rdi
je 0x18001bb37
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
cmp eax, r12d
jne 0x18001bb37
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
cmp eax, r15d
jne 0x18001bb37
mov r14d, r15d
lea rcx, [r14*8]
call fcn.1800396a4
mov rdx, qword [rdi]
mov rcx, rdi
mov r13, rax
call qword [rdx + 8]
mov rdx, qword [rdi]
mov rcx, rdi
mov rsi, rax
call qword [rdx + 0x20]
test r15d, r15d
je 0x18001ba50
movsxd rdx, eax
mov rcx, r13
shl rdx, 2
mov eax, r14d
nop
mov qword [rcx], rsi
lea rcx, [rcx + 8]
add rsi, rdx
sub rax, 1
jne 0x18001ba40
mov rdx, r13
mov rcx, rbx
call fcn.1800211a0
test rbx, rbx
je 0x18001badb
xor edx, edx
mov rcx, rbx
call fcn.180021940
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.180021940
mov rcx, rbx
mov qword [rsp + 0x40], 0
call fcn.180021280
lea rcx, [rbp + 0x4f0]
mov rdx, rbx
mov r8d, 0x540
call fcn.180031c80
xor edx, edx
mov r8d, 0x540
mov rcx, rbx
call fcn.18002f520
mov rax, qword [rbp + 0x938]
test rax, rax
je 0x18001bac7
mov rdx, rbx
lea rcx, [rbp + 0x4f0]
call rax
jmp 0x18001bacf
mov rcx, rbx
call fcn.18003609c
lea rcx, [rbp + 0x4f0]
call fcn.180020480
test r15d, r15d
je 0x18001bb27
mov r9, r13
mov rdx, qword [r9]
mov r8d, r12d
test r12d, r12d
jle 0x18001bb1d
nop
movzx eax, byte [rdx + 1]
dec r8d
movzx ecx, byte [rdx]
lea rdx, [rdx + 4]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx - 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx - 1]
shl ecx, 8
or ecx, eax
mov dword [rdx - 4], ecx
test r8d, r8d
jg 0x18001baf0
add r9, 8
sub r14, 1
jne 0x18001bae3
mov rcx, r13
call fcn.18003609c
mov rax, rdi
jmp 0x18001bbe5
test rsi, rsi
je 0x18001bb49
mov rax, qword [rsi]
mov edx, 1
mov rcx, rsi
call qword [rax]
test rbx, rbx
je 0x18001bbe3
xor edx, edx
mov rcx, rbx
call fcn.180021940
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.180021940
mov rcx, rbx
mov qword [rsp + 0x40], r13
call fcn.180021280
lea rcx, [rbp + 0xa30]
mov rdx, rbx
mov r8d, 0x540
call fcn.180031c80
xor edx, edx
mov r8d, 0x540
mov rcx, rbx
call fcn.18002f520
mov rax, qword [rbp + 0xe78]
test rax, rax
je 0x18001bbc1
mov rdx, rbx
lea rcx, [rbp + 0xa30]
call rax
lea rcx, [rbp + 0xa30]
call fcn.180020480
jmp 0x18001bbe3
mov rcx, rbx
call fcn.18003609c
lea rcx, [rbp + 0xa30]
call fcn.180020480
jmp 0x18001bbe3
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.1800214a0
xor eax, eax
mov rcx, qword [rbp + 0xf78]
xor rcx, rsp
call fcn.18002d490
lea r11, [rsp + 0x1080]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rcx, rbx
call fcn.1800203d0
int3
mov rcx, rbx
call fcn.1800203d0
int3
mov rcx, rbx
call fcn.1800203d0
int3
mov rcx, rbx
call fcn.1800203d0
int3
mov rcx, rbx
call fcn.1800203d0
int3
mov rcx, rbx
call fcn.1800203d0
int3