Function at 0x180002f8c
Capabilities:
Extract resource via kernel32 functions
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x140
mov rax, qword [0x18001c290]
xor rax, rsp
mov qword [rsp + 0x130], rax
lea rdx, [rsp + 0x20]
mov r8d, 0x104
mov qword [0x18001fb90], rcx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [0x1800190d4]
lea rcx, [rsp + 0x20]
call fcn.18000506c
xor edx, edx
lea r8d, [rdx + 2]
mov rcx, rax
mov rbp, rax
call fcn.180005758
mov rcx, rbp
call fcn.180005654
movsxd rsi, eax
mov rcx, rsi
call fcn.180003b38
xor r8d, r8d
xor edx, edx
mov rcx, rbp
mov rdi, rax
call fcn.180005758
mov r9, rbp
mov r8, rsi
mov edx, 1
mov rcx, rdi
call fcn.180005298
mov rcx, rbp
call fcn.18000478c
mov ecx, 4
mov dword [0x18001fc20], esi
mov qword [0x18001fb88], rdi
call fcn.180003b38
mov r10, qword [0x18001fb88]
mov cl, byte [r10 + 0x3c]
mov r9, rax
xor r12d, r12d
mov byte [rax], cl
mov cl, byte [r10 + 0x3d]
xor r15d, r15d
mov byte [rax + 1], cl
mov cl, byte [r10 + 0x3e]
mov byte [rax + 2], cl
mov cl, byte [r10 + 0x3f]
mov byte [rax + 3], cl
mov r8d, dword [rax]
lea edx, [r8 + 0x144]
lea r14d, [r8 + 0x109]
mov dword [0x18001fb84], r8d
mov cl, byte [rdx + r10]
mov byte [rax], cl
lea eax, [rdx + 1]
movsxd rcx, r14d
mov al, byte [rax + r10]
mov byte [r9 + 1], al
lea eax, [rdx + 2]
mov al, byte [rax + r10]
mov byte [r9 + 2], al
lea eax, [rdx + 3]
mov al, byte [rax + r10]
mov byte [r9 + 3], al
mov eax, dword [r9]
mov dword [0x18001fb80], eax
mov eax, dword [0x18001fc20]
add eax, 0xfffffffc
mov dword [0x18001fb98], eax
lea eax, [r8 + 6]
movsx r13d, byte [rax + r10]
test r13d, r13d
jle 0x18000318f
mov r8d, dword [0x18001fc2c]
lea rax, [r10 + 1]
add rcx, 0xf
mov rbx, r10
mov rdi, r10
mov rsi, r10
add rcx, rax
sub rbx, rax
sub rdi, rax
sub rsi, rax
mov al, byte [rbx + rcx]
mov byte [r9], al
mov al, byte [rcx]
mov byte [r9 + 1], al
mov al, byte [rdi + rcx + 2]
mov byte [r9 + 2], al
mov al, byte [rsi + rcx + 3]
mov byte [r9 + 3], al
mov r11d, dword [r9]
mov eax, r11d
cdq
and edx, 0xfff
add eax, edx
mov ebp, eax
and eax, 0xfff
sub eax, edx
sar ebp, 0xc
test eax, eax
jle 0x18000314a
lea r11d, [rbp + 1]
shl r11d, 0xc
add r8d, r11d
cmp byte [rbx + rcx - 0xf], 0x72
mov dword [0x18001fc2c], r8d
jne 0x18000316f
cmp byte [rcx - 0xf], 0x73
jne 0x18000316f
cmp byte [rdi + rcx - 0xd], 0x72
jne 0x18000316f
cmp byte [rsi + rcx - 0xc], 0x63
je 0x180003181
inc r15d
add r14d, 0x28
add rcx, 0x28
cmp r15d, r13d
jge 0x18000318f
jmp 0x180003107
sub r8d, r11d
lea r12d, [r14 + 0x13]
mov dword [0x18001fc2c], r8d
movsxd rcx, r12d
lea r8, [0x1800190dc]
mov edx, 0x91
mov al, byte [rcx + r10]
mov byte [r9], al
mov al, byte [rcx + r10 + 1]
mov byte [r9 + 1], al
mov al, byte [rcx + r10 + 2]
mov byte [r9 + 2], al
mov al, byte [rcx + r10 + 3]
mov rcx, qword [0x18001fb90]
mov byte [r9 + 3], al
mov eax, dword [r9]
mov dword [0x18001fd34], eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, qword [0x18001fb90]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
xor edx, edx
mov ecx, eax
and ecx, 0xfff
sub eax, ecx
mov ecx, 0x200
sub eax, dword [0x18001fb90]
mov dword [0x18001fc2c], eax
mov eax, dword [0x18001fb80]
div ecx
test edx, edx
je 0x18000321a
inc eax
add eax, 0xb
shl eax, 9
mov dword [0x18001fc24], eax
xor eax, eax
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.180003c80
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret