Function at 0x140004950
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x130
mov qword [rsp + 0xa0], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x140048200]
xor rax, rsp
mov qword [rsp + 0x128], rax
mov r12, rcx
add rcx, 0x280
call fcn.140001fb0
mov r8d, 2
lea rdx, str.129
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x140004ccc
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140004ccc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140004ccc
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
lea edi, [rax - 0x28]
mov edx, 0x400
lea rcx, [rsp + 0xb0]
call fcn.14001831c
nop
xor r9d, r9d
mov r8d, edi
lea rdx, [rbx + 0x28]
lea rcx, [rsp + 0xb0]
call fcn.140018368
xor r13d, r13d
mov qword [rsp + 0x20], r13
mov r9d, 0x1000
lea r8d, [r13 + 1]
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x30]
call fcn.140013458
nop
mov edi, dword [rsp + 0x50]
test dil, 1
jne 0x140004a5c
mov rdx, qword [rsp + 0x48]
lea ecx, [r13 + 4]
call fcn.140013860
int3
mov rcx, qword [rsp + 0x68]
lea rax, [rcx + 4]
mov rdx, qword [rsp + 0x70]
cmp rax, rdx
jbe 0x140004a8c
sub ecx, edx
lea edx, [rcx + 4]
lea rcx, [rsp + 0x30]
call fcn.1400127bc
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
mov edi, dword [rsp + 0x50]
add rcx, 4
mov qword [rsp + 0x68], rcx
test dil, 1
jne 0x140004aab
mov rdx, qword [rsp + 0x48]
mov ecx, 4
call fcn.140013860
int3
lea rax, [rcx + 4]
cmp rax, rdx
jbe 0x140004ad1
sub ecx, edx
lea edx, [rcx + 4]
lea rcx, [rsp + 0x30]
call fcn.1400127bc
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
mov edi, dword [rsp + 0x50]
add rcx, 4
mov qword [rsp + 0x68], rcx
test dil, 1
jne 0x140004af0
mov rdx, qword [rsp + 0x48]
mov ecx, 4
call fcn.140013860
int3
lea rax, [rcx + 4]
cmp rax, rdx
jbe 0x140004b16
sub ecx, edx
lea edx, [rcx + 4]
lea rcx, [rsp + 0x30]
call fcn.1400127bc
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
mov edi, dword [rsp + 0x50]
mov r15d, dword [rcx]
add rcx, 4
mov qword [rsp + 0x68], rcx
test dil, 1
jne 0x140004b38
mov rdx, qword [rsp + 0x48]
mov ecx, 4
call fcn.140013860
int3
lea rax, [rcx + 4]
cmp rax, rdx
jbe 0x140004b5e
sub ecx, edx
lea edx, [rcx + 4]
lea rcx, [rsp + 0x30]
call fcn.1400127bc
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
mov edi, dword [rsp + 0x50]
mov r14d, dword [rcx]
add rcx, 4
mov qword [rsp + 0x68], rcx
test dil, 1
jne 0x140004b80
mov rdx, qword [rsp + 0x48]
mov ecx, 4
call fcn.140013860
int3
lea rax, [rcx + 4]
cmp rax, rdx
jbe 0x140004b9d
sub ecx, edx
lea edx, [rcx + 4]
lea rcx, [rsp + 0x30]
call fcn.1400127bc
mov rcx, qword [rsp + 0x68]
movsxd rsi, dword [rcx]
add rcx, 4
mov qword [rsp + 0x68], rcx
mov rcx, rsi
call fcn.140008cf8
mov rbp, rax
mov r8d, esi
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140012520
lea rcx, [rsp + 0x30]
call fcn.140012f6c
mov ecx, 0x1335ca
call fcn.14001fc6c
mov byte [rsp + 0x120], 0
mov rbx, r13
call fcn.14001fc84
mov edi, eax
mov eax, 0x84210843
imul edi
add edx, edi
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x3e
sub edi, edx
cmp dil, 0x1a
jae 0x140004c16
add dil, 0x41
mov byte [rsp + rbx + 0x100], dil
jmp 0x140004c3c
cmp dil, 0x34
jae 0x140004c2a
add dil, 0x47
mov byte [rsp + rbx + 0x100], dil
jmp 0x140004c3c
cmp dil, 0x3e
jae 0x140004c3c
sub dil, 4
mov byte [rsp + rbx + 0x100], dil
inc rbx
cmp rbx, 0x20
jl 0x140004be3
lea r9, [rsp + 0x100]
mov r8d, esi
mov rdx, rbp
mov rcx, r12
call fcn.1400082c0
mov rbx, rax
test rax, rax
jne 0x140004c68
mov ecx, r13d
jmp 0x140004c7a
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8d, ecx
mov rdx, rbx
lea rcx, [r12 + 0x280]
call fcn.1400021a0
mov rcx, rbx
call fcn.140008d00
mov rcx, rbp
call fcn.140008d00
test r15d, r15d
sete r13b
mov dword [r12 + 0x270], r13d
mov dword [r12 + 0x274], r14d
lea rcx, [rsp + 0x30]
call fcn.1400133fc
nop
lea rcx, [rsp + 0xb0]
call fcn.1400187ac
mov rcx, qword [rsp + 0x128]
xor rcx, rsp
call fcn.14001eee0
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret