Function at 0x140005240
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x130
mov qword [rsp + 0xa0], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x14004b200]
xor rax, rsp
mov qword [rsp + 0x128], rax
mov rbp, rcx
add rcx, 0x250
call fcn.140001c70
mov r8d, 2
lea rdx, str.129
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x14000573b
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14000573b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x14000573b
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
lea edi, [rax - 0x28]
mov edx, 0x400
lea rcx, [rsp + 0xb0]
call fcn.14001ad40
nop
xor r9d, r9d
mov r8d, edi
lea rdx, [rbx + 0x28]
lea rcx, [rsp + 0xb0]
call fcn.14001ad8c
xor r12d, r12d
mov qword [rsp + 0x20], r12
mov r9d, 0x1000
lea r8d, [r12 + 1]
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x30]
call fcn.140014be8
nop
mov ecx, 0x1335ca
call fcn.140021f44
mov byte [rsp + 0x120], r12b
mov rbx, r12
nop dword [rax]
call fcn.140021f5c
mov edi, eax
mov eax, 0x84210843
imul edi
add edx, edi
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x3e
sub edi, edx
cmp dil, 0x1a
jae 0x140005383
add dil, 0x41
mov byte [rsp + rbx + 0x100], dil
jmp 0x1400053a9
cmp dil, 0x34
jae 0x140005397
add dil, 0x47
mov byte [rsp + rbx + 0x100], dil
jmp 0x1400053a9
cmp dil, 0x3e
jae 0x1400053a9
sub dil, 4
mov byte [rsp + rbx + 0x100], dil
inc rbx
cmp rbx, 0x20
jl 0x140005350
mov edi, dword [rsp + 0x50]
test dil, 1
jne 0x1400053cc
mov rdx, qword [rsp + 0x48]
mov ecx, 4
call fcn.140014ff0
int3
mov rcx, qword [rsp + 0x68]
lea rax, [rcx + 4]
mov rdx, qword [rsp + 0x70]
cmp rax, rdx
jbe 0x1400053fc
sub ecx, edx
lea edx, [rcx + 4]
lea rcx, [rsp + 0x30]
call fcn.140013f4c
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
mov edi, dword [rsp + 0x50]
add rcx, 4
mov qword [rsp + 0x68], rcx
test dil, 1
jne 0x14000541b
mov rdx, qword [rsp + 0x48]
mov ecx, 4
call fcn.140014ff0
int3
lea rax, [rcx + 4]
cmp rax, rdx
jbe 0x140005441
sub ecx, edx
lea edx, [rcx + 4]
lea rcx, [rsp + 0x30]
call fcn.140013f4c
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
mov edi, dword [rsp + 0x50]
add rcx, 4
mov qword [rsp + 0x68], rcx
test dil, 1
jne 0x140005460
mov rdx, qword [rsp + 0x48]
mov ecx, 4
call fcn.140014ff0
int3
lea rax, [rcx + 4]
cmp rax, rdx
jbe 0x140005486
sub ecx, edx
lea edx, [rcx + 4]
lea rcx, [rsp + 0x30]
call fcn.140013f4c
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
mov edi, dword [rsp + 0x50]
mov r14d, dword [rcx]
add rcx, 4
mov qword [rsp + 0x68], rcx
test dil, 1
jne 0x1400054a8
mov rdx, qword [rsp + 0x48]
mov ecx, 4
call fcn.140014ff0
int3
lea rax, [rcx + 4]
cmp rax, rdx
jbe 0x1400054ce
sub ecx, edx
lea edx, [rcx + 4]
lea rcx, [rsp + 0x30]
call fcn.140013f4c
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
mov edi, dword [rsp + 0x50]
mov r13d, dword [rcx]
add rcx, 4
mov qword [rsp + 0x68], rcx
test dil, 1
jne 0x1400054f0
mov rdx, qword [rsp + 0x48]
mov ecx, 4
call fcn.140014ff0
int3
lea rax, [rcx + 4]
cmp rax, rdx
jbe 0x14000550d
sub ecx, edx
lea edx, [rcx + 4]
lea rcx, [rsp + 0x30]
call fcn.140013f4c
mov rcx, qword [rsp + 0x68]
movsxd rdi, dword [rcx]
add rcx, 4
mov qword [rsp + 0x68], rcx
mov rcx, rdi
call fcn.14000b338
mov rsi, rax
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140013cb0
lea r9, [rsp + 0x100]
mov r8d, edi
mov rdx, rsi
mov rcx, rbp
call fcn.14000a250
mov rbx, rax
test rax, rax
jne 0x140005557
mov ecx, r12d
jmp 0x140005569
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8d, ecx
mov rdx, rbx
lea rcx, [rbp + 0x250]
call fcn.140001e50
mov rcx, rbx
call fcn.14000b330
mov rcx, rsi
call fcn.14000b330
test byte [rsp + 0x50], 1
jne 0x1400055a2
mov rdx, qword [rsp + 0x48]
mov ecx, 4
call fcn.140014ff0
int3
mov rcx, qword [rsp + 0x68]
lea rax, [rcx + 4]
mov rdx, qword [rsp + 0x70]
cmp rax, rdx
jbe 0x1400055c9
sub ecx, edx
lea edx, [rcx + 4]
lea rcx, [rsp + 0x30]
call fcn.140013f4c
mov rcx, qword [rsp + 0x68]
movsxd rdi, dword [rcx]
add rcx, 4
mov qword [rsp + 0x68], rcx
mov rcx, rdi
call fcn.14000b338
mov rsi, rax
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140013cb0
lea r9, [rsp + 0x100]
mov r8d, edi
mov rdx, rsi
mov rcx, rbp
call fcn.14000a250
mov rbx, rax
test rax, rax
jne 0x140005613
mov ecx, r12d
jmp 0x140005625
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8d, ecx
mov rdx, rbx
lea rcx, [rbp + 0x258]
call fcn.140001e50
mov rcx, rbx
call fcn.14000b330
mov rcx, rsi
call fcn.14000b330
test byte [rsp + 0x50], 1
jne 0x14000565e
mov rdx, qword [rsp + 0x48]
mov ecx, 4
call fcn.140014ff0
int3
mov rcx, qword [rsp + 0x68]
lea rax, [rcx + 4]
mov rdx, qword [rsp + 0x70]
cmp rax, rdx
jbe 0x140005685
sub ecx, edx
lea edx, [rcx + 4]
lea rcx, [rsp + 0x30]
call fcn.140013f4c
mov rcx, qword [rsp + 0x68]
movsxd rdi, dword [rcx]
add rcx, 4
mov qword [rsp + 0x68], rcx
mov rcx, rdi
call fcn.14000b338
mov rsi, rax
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140013cb0
lea r9, [rsp + 0x100]
mov r8d, edi
mov rdx, rsi
mov rcx, rbp
call fcn.14000a250
mov rbx, rax
test rax, rax
jne 0x1400056cf
mov ecx, r12d
jmp 0x1400056e1
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8d, ecx
mov rdx, rbx
lea rcx, [rbp + 0x260]
call fcn.140001e50
mov rcx, rbx
call fcn.14000b330
mov rcx, rsi
call fcn.14000b330
test r14d, r14d
sete r12b
mov dword [rbp + 0x244], r12d
mov dword [rbp + 0x248], r13d
lea rcx, [rsp + 0x30]
call fcn.1400146fc
nop
lea rcx, [rsp + 0x30]
call fcn.140014b8c
nop
lea rcx, [rsp + 0xb0]
call fcn.14001b1d0
mov rcx, qword [rsp + 0x128]
xor rcx, rsp
call fcn.1400215a0
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret