Function at 0x36248
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov r11, rsp
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2f8
mov rax, qword [0x000a7100]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
mov rax, qword [rsp + 0x368]
mov rsi, qword [rsp + 0x360]
mov rdi, qword [rsp + 0x370]
mov r12, qword [rsp + 0x380]
mov r14, qword [rsp + 0x390]
mov rbp, qword [rsp + 0x3a0]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x378]
mov qword [rsp + 0x90], r9
mov qword [rsp + 0xa8], rax
mov rax, qword [rsp + 0x388]
mov r13, r8
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x398]
mov qword [rsp + 0xa0], rdx
mov qword [rsp + 0x98], rax
xor eax, eax
lea r9, [rsp + 0x68]
lea rdx, [r11 - 0x288]
lea r8d, [rax + 3]
mov r15, rcx
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x78], rax
mov qword [r11 - 0x288], 0x10
mov qword [r11 - 0x280], 1
mov qword [r11 - 0x278], rax
call sub.ntoskrnl.exe_LdrFindResource_U
mov edx, eax
mov ebx, eax
mov eax, 0xc0000000
and edx, eax
cmp edx, eax
je 0x3678a
mov rdx, qword [rsp + 0x68]
lea r9, [rsp + 0x34]
lea r8, [rsp + 0x38]
mov rcx, r15
call sub.ntoskrnl.exe_LdrAccessResource
mov ecx, 0xc0000000
mov ebx, eax
and eax, ecx
cmp eax, ecx
je 0x3678a
mov edx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x50]
lea r8, [0x00095cd0]
mov qword [rsp + 0x20], rax
call fcn.00036038
test al, al
je 0x3678a
mov r15d, 0x208
lea rcx, [rsp + 0xd0]
xor edx, edx
mov r8, r15
call fcn.00091d10
mov rbx, qword [rsp + 0x50]
lea r8, [0x00095d10]
movsx eax, word [rbx + 2]
movsx r9d, word [rbx]
lea rcx, [rsp + 0xd0]
mov edx, 0x103
mov dword [rsp + 0x20], eax
call fcn.00014458
mov edx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x38]
lea r11, [rsp + 0x30]
lea r9, [rsp + 0x70]
lea r8, [rsp + 0xd0]
mov qword [rsp + 0x20], r11
call fcn.00036038
cmp al, 1
jne 0x36465
mov rdx, qword [rsp + 0x70]
mov eax, dword [rsp + 0x30]
test rdx, rdx
je 0x3645a
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x3645a
test rdi, rdi
je 0x36465
cmp dword [rdi], eax
jb 0x3645a
mov r8, rax
add r8, r8
call fcn.00091720
jmp 0x36465
test rdi, rdi
je 0x36465
cmp dword [rdi], eax
jae 0x36465
mov dword [rdi], eax
lea rcx, [rsp + 0xd0]
mov r8, r15
xor edx, edx
call fcn.00091d10
movsx r11d, word [rbx + 2]
movsx r9d, word [rbx]
mov edi, 0x103
lea r8, [0x00095d60]
lea rcx, [rsp + 0xd0]
mov rdx, rdi
mov dword [rsp + 0x20], r11d
call fcn.00014458
mov edx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x38]
lea r11, [rsp + 0x30]
lea r9, [rsp + 0x60]
lea r8, [rsp + 0xd0]
mov qword [rsp + 0x20], r11
call fcn.00036038
cmp al, 1
jne 0x36506
mov rdx, qword [rsp + 0x60]
mov eax, dword [rsp + 0x30]
test rdx, rdx
je 0x364fb
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x364fb
test rsi, rsi
je 0x36506
cmp dword [rsi], eax
jb 0x364fb
mov r8, rax
add r8, r8
call fcn.00091720
jmp 0x36506
test rsi, rsi
je 0x36506
cmp dword [rsi], eax
jae 0x36506
mov dword [rsi], eax
lea rcx, [rsp + 0xd0]
mov r8, r15
xor edx, edx
call fcn.00091d10
movsx r11d, word [rbx + 2]
movsx r9d, word [rbx]
lea r8, [0x00095db0]
lea rcx, [rsp + 0xd0]
mov rdx, rdi
mov dword [rsp + 0x20], r11d
call fcn.00014458
mov edx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x38]
lea r11, [rsp + 0x30]
lea r9, [rsp + 0x48]
lea r8, [rsp + 0xd0]
mov qword [rsp + 0x20], r11
call fcn.00036038
cmp al, 1
jne 0x365a8
mov rdx, qword [rsp + 0x48]
mov eax, dword [rsp + 0x30]
test rdx, rdx
je 0x36599
mov rcx, qword [rsp + 0xa8]
test rcx, rcx
je 0x36599
test r12, r12
je 0x365a8
cmp dword [r12], eax
jb 0x36599
mov r8, rax
add r8, r8
call fcn.00091720
jmp 0x365a8
test r12, r12
je 0x365a8
cmp dword [r12], eax
jae 0x365a8
mov dword [r12], eax
lea rcx, [rsp + 0xd0]
mov r8, r15
xor edx, edx
call fcn.00091d10
movsx r11d, word [rbx + 2]
movsx r9d, word [rbx]
lea r8, [0x00095e10]
lea rcx, [rsp + 0xd0]
mov rdx, rdi
mov dword [rsp + 0x20], r11d
call fcn.00014458
mov edx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x38]
lea r11, [rsp + 0x30]
lea r9, [rsp + 0x58]
lea r8, [rsp + 0xd0]
mov qword [rsp + 0x20], r11
call fcn.00036038
cmp al, 1
jne 0x3664a
mov rdx, qword [rsp + 0x58]
mov eax, dword [rsp + 0x30]
test rdx, rdx
je 0x3663b
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
je 0x3663b
test r13, r13
je 0x3664a
cmp dword [r13], eax
jb 0x3663b
mov r8, rax
add r8, r8
call fcn.00091720
jmp 0x3664a
test r13, r13
je 0x3664a
cmp dword [r13], eax
jae 0x3664a
mov dword [r13], eax
lea rcx, [rsp + 0xd0]
mov r8, r15
xor edx, edx
call fcn.00091d10
movsx r11d, word [rbx + 2]
movsx r9d, word [rbx]
lea r8, [0x00095e60]
lea rcx, [rsp + 0xd0]
mov rdx, rdi
mov dword [rsp + 0x20], r11d
call fcn.00014458
mov edx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x38]
lea r11, [rsp + 0x30]
lea r9, [rsp + 0x40]
lea r8, [rsp + 0xd0]
mov qword [rsp + 0x20], r11
call fcn.00036038
cmp al, 1
jne 0x366e9
mov rdx, qword [rsp + 0x40]
mov eax, dword [rsp + 0x30]
test rdx, rdx
je 0x366dc
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x366dc
test r14, r14
je 0x366e9
cmp dword [r14], eax
jb 0x366dc
mov r8, rax
add r8, r8
call fcn.00091720
jmp 0x366e9
test r14, r14
je 0x366e9
cmp dword [r14], eax
jae 0x366e9
mov dword [r14], eax
lea rcx, [rsp + 0xd0]
mov r8, r15
xor edx, edx
call fcn.00091d10
movsx r11d, word [rbx + 2]
movsx r9d, word [rbx]
lea r8, [0x00095ec0]
lea rcx, [rsp + 0xd0]
mov rdx, rdi
mov dword [rsp + 0x20], r11d
call fcn.00014458
mov edx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x38]
lea r11, [rsp + 0x30]
lea r9, [rsp + 0x78]
lea r8, [rsp + 0xd0]
mov qword [rsp + 0x20], r11
call fcn.00036038
cmp al, 1
jne 0x36788
mov rdx, qword [rsp + 0x78]
mov eax, dword [rsp + 0x30]
test rdx, rdx
je 0x3677b
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x3677b
test rbp, rbp
je 0x36788
cmp dword [rbp], eax
jb 0x3677b
mov r8, rax
add r8, r8
call fcn.00091720
jmp 0x36788
test rbp, rbp
je 0x36788
cmp dword [rbp], eax
jae 0x36788
mov dword [rbp], eax
xor ebx, ebx
mov eax, ebx
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.000916b0
add rsp, 0x2f8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret