Function at 0x14008b630
Capabilities:
Check if file exists
Extract resource via kernel32 functions
Get file attributes
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x680]
sub rsp, 0x780
mov rax, qword [0x14036e3c8]
xor rax, rsp
mov qword [rbp + 0x670], rax
mov edi, r9d
mov dword [rsp + 0x68], r9d
mov dword [rsp + 0x78], r8d
mov r14, rdx
mov qword [rbp - 0x80], rdx
mov r13, rcx
mov qword [rsp + 0x70], rcx
xor esi, esi
xor r15b, r15b
mov byte [rsp + 0x40], r15b
xor bl, bl
mov byte [rsp + 0x41], bl
mov dword [rsp + 0x60], 0x64
lea r12d, [rsi + 1]
lea r9, [0x140292780]
test rdx, rdx
je 0x14008b783
cmp word [rdx], si
je 0x14008b783
xor ecx, ecx
nop dword [rax + rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r9 + rcx*2 - 2]
jne 0x14008b6ec
cmp rcx, 8
jne 0x14008b6c0
mov rdi, r12
mov r8d, r12d
mov dword [rsp + 0x44], r12d
mov edx, r12d
mov dword [rsp + 0x48], edx
jmp 0x14008be3b
call fcn.1400708a0
mov rcx, rax
mov r8, r14
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r15, rax
test rax, rax
je 0x14008ba76
call fcn.1400708a0
mov rcx, rax
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r13, rax
test rax, rax
jne 0x14008b738
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov r13, qword [rsp + 0x70]
jmp 0x14008ba76
call fcn.1400708a0
mov rcx, rax
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test eax, eax
je 0x14008b72e
mov ecx, esi
call fcn.140243670
mov rdi, rax
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, rax
mov r8d, esi
mov rcx, rdi
call fcn.140245860
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov r13, qword [rsp + 0x70]
jmp 0x14008bd20
call fcn.1400708c0
mov rdx, rax
lea rcx, [rbp + 0x50]
call fcn.14006b460
nop
call fcn.1400708d0
mov rcx, rax
call fcn.14006c390
test al, al
je 0x14008bb2d
lea rcx, [rbp + 0xe0]
call fcn.14006b4c0
nop
lea rcx, [rbp + 0x170]
call fcn.14006b4c0
nop
call fcn.140070940
mov rdx, rax
lea rcx, [rbp + 0x290]
call fcn.14006b460
nop
lea rcx, [rbp + 0x290]
call fcn.14006c390
test al, al
jne 0x14008b884
mov r8, r13
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x290]
call fcn.14006b7c0
nop
mov rdx, rax
lea rcx, [rbp + 0xe0]
call fcn.14006b670
nop
lea rcx, [rbp - 0x40]
call fcn.140003ea0
lea rdx, [rbp + 0xe0]
lea rcx, [rbp - 0x40]
call fcn.14008b1e0
nop
mov rdx, rax
lea rcx, [rbp + 0x170]
call fcn.14006b670
nop
lea rcx, [rbp - 0x40]
call fcn.140003ea0
lea rcx, [rbp + 0xe0]
call fcn.14006b7b0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne r15b
mov byte [rsp + 0x40], r15b
lea rcx, [rbp + 0x170]
call fcn.14006b7b0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
mov byte [rsp + 0x41], bl
lea rcx, [rbp + 0x290]
call fcn.14006c390
test al, al
jne 0x14008b8a5
test r15b, r15b
jne 0x14008b939
test bl, bl
jne 0x14008b93d
mov r8, r13
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x50]
call fcn.14006b7c0
nop
mov rdx, rax
lea rcx, [rbp + 0xe0]
call fcn.14006b670
nop
lea rcx, [rbp - 0x40]
call fcn.140003ea0
lea rdx, [rbp + 0xe0]
lea rcx, [rbp - 0x40]
call fcn.14008b1e0
nop
mov rdx, rax
lea rcx, [rbp + 0x170]
call fcn.14006b670
nop
lea rcx, [rbp - 0x40]
call fcn.140003ea0
lea rcx, [rbp + 0xe0]
call fcn.14006b7b0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne r15b
mov byte [rsp + 0x40], r15b
lea rcx, [rbp + 0x170]
call fcn.14006b7b0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
mov byte [rsp + 0x41], bl
test bl, bl
je 0x14008b95b
cmp edi, 0x96
jae 0x14008b94a
test r15b, r15b
jne 0x14008b95b
mov dword [rsp + 0x60], 0xc8
lea rcx, [rbp + 0x170]
jmp 0x14008b962
lea rcx, [rbp + 0xe0]
call fcn.14006b7b0
xor r15d, r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], Ordinal_133
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, r12d
mov edx, 0x80000000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14008b9d1
lea rcx, [rbp + 0x290]
call fcn.140003ea0
nop
lea rcx, [rbp + 0x170]
call fcn.140003ea0
nop
lea rcx, [rbp + 0xe0]
call fcn.140003ea0
nop
lea rcx, [rbp + 0x50]
call fcn.140003ea0
jmp 0x14008ba76
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test eax, eax
jne 0x14008b9ed
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14008b99c
mov dword [rsp + 0x70], r15d
mov rcx, rsi
lea rdx, [0x140327600]
call fcn.140243678
mov rdi, rax
mov rcx, rbx
test rax, rax
je 0x14008bb00
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x70]
mov r8d, esi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x70], esi
je 0x14008bb07
mov rcx, rdi
call fcn.1402434a4
nop
lea rcx, [rbp + 0x290]
call fcn.140003ea0
nop
lea rcx, [rbp + 0x170]
call fcn.140003ea0
nop
lea rcx, [rbp + 0xe0]
call fcn.140003ea0
nop
lea rcx, [rbp + 0x50]
call fcn.140003ea0
mov edi, dword [rsp + 0x68]
mov r8d, 0xffffffff
mov rdx, r13
lea rcx, [rbp + 0x3b0]
call fcn.14006b490
nop
lea rdx, [rbp + 0x3b0]
lea rcx, [rbp - 0x40]
call fcn.14008b1e0
nop
lea rcx, [rbp + 0x3b0]
call fcn.14006b7b0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne r15b
mov byte [rsp + 0x40], r15b
lea rcx, [rbp - 0x40]
call fcn.14006b7b0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne byte [rsp + 0x41]
je 0x14008bd2e
cmp edi, 0x96
jae 0x14008baef
test r15b, r15b
jne 0x14008bd2e
mov dword [rsp + 0x60], 0xc8
lea rcx, [rbp - 0x40]
jmp 0x14008bd35
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp + 0x290]
call fcn.140003ea0
nop
lea rcx, [rbp + 0x170]
call fcn.140003ea0
nop
lea rcx, [rbp + 0xe0]
jmp 0x14008bd11
call fcn.1400708d0
mov rdx, rax
lea rcx, [rbp + 0x50]
call fcn.14006ba20
call fcn.140070d30
test al, al
je 0x14008bb4e
call fcn.1400708e0
jmp 0x14008bb65
lea rcx, [rbp + 0x50]
call fcn.14006b7b0
mov rcx, rax
xor edx, edx
lea r8d, [rdx + 2]
call fcn.140091cf0
mov rbx, rax
test rax, rax
je 0x14008b9c3
mov r8d, 0xffffffff
mov rdx, r13
lea rcx, [rbp + 0x200]
call fcn.14006b490
nop
lea rdx, [rbp + 0x200]
lea rcx, [rbp + 0x320]
call fcn.14008b1e0
nop
lea rcx, [rbp + 0x200]
call fcn.14006b7b0
mov rdx, rax
lea rax, [rbp + 0x440]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x5c]
mov r8b, 1
mov rcx, rbx
call fcn.140091640
test eax, eax
sete r15b
mov byte [rsp + 0x40], r15b
lea rcx, [rbp + 0x320]
call fcn.14006b7b0
mov rdx, rax
lea rax, [rbp + 0x440]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x5c]
mov r8b, 1
mov rcx, rbx
call fcn.140091640
test eax, eax
sete byte [rsp + 0x41]
test eax, eax
jne 0x14008bc76
cmp edi, 0x96
jae 0x14008bc14
test r15b, r15b
jne 0x14008bc76
mov dword [rsp + 0x60], 0xc8
lea rcx, [rbp + 0x320]
call fcn.14006b7b0
mov rdx, rax
lea rax, [rbp + 0x440]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x5c]
mov r8b, 1
mov rcx, rbx
call fcn.140091640
test eax, eax
je 0x14008bc7f
call fcn.140070d30
test al, al
jne 0x14008bc5d
mov rcx, rbx
call fcn.140091430
nop
lea rcx, [rbp + 0x320]
call fcn.140003ea0
nop
lea rcx, [rbp + 0x200]
jmp 0x14008b9bd
lea rcx, [rbp + 0x200]
jmp 0x14008bc23
mov esi, dword [rbp + 0x66c]
test esi, esi
je 0x14008bc4b
mov ecx, esi
call fcn.140243670
mov rdi, rax
mov dword [rsp + 0x20], 3
mov r9d, esi
mov r8, rax
mov edx, dword [rsp + 0x5c]
mov rcx, rbx
call fcn.140092420
test eax, eax
je 0x14008bceb
cmp eax, 0x600
je 0x14008bceb
mov rcx, rdi
call fcn.1402434a4
call fcn.140070d30
test al, al
jne 0x14008bcd2
mov rcx, rbx
call fcn.140091430
nop
lea rcx, [rbp + 0x320]
call fcn.140003ea0
nop
lea rcx, [rbp + 0x200]
jmp 0x14008ba63
call fcn.140070d30
test al, al
jne 0x14008bcfd
mov rcx, rbx
call fcn.140091430
nop
lea rcx, [rbp + 0x320]
call fcn.140003ea0
nop
lea rcx, [rbp + 0x200]
call fcn.140003ea0
nop
lea rcx, [rbp + 0x50]
call fcn.140003ea0
test rdi, rdi
jne 0x14008be20
jmp 0x14008ba72
lea rcx, [rbp + 0x3b0]
call fcn.14006b7b0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], Ordinal_133
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, r12d
mov edx, 0x80000000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14008bd8b
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test eax, eax
jne 0x14008bda6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp - 0x40]
call fcn.140003ea0
nop
lea rcx, [rbp + 0x3b0]
call fcn.140003ea0
jmp 0x14008c1b8
xor r15d, r15d
mov dword [rsp + 0x68], r15d
mov rcx, rsi
lea rdx, [0x140327600]
call fcn.140243678
mov rdi, rax
mov rcx, rbx
test rax, rax
je 0x14008bdfa
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x68]
mov r8d, esi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x68], esi
je 0x14008be01
mov rcx, rdi
call fcn.1402434a4
mov edi, r15d
jmp 0x14008be01
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp - 0x40]
call fcn.140003ea0
nop
lea rcx, [rbp + 0x3b0]
call fcn.140003ea0
test rdi, rdi
je 0x14008c1b8
mov r8d, r12d
mov dword [rsp + 0x44], r12d
mov edx, r12d
mov dword [rsp + 0x48], edx
test r14, r14
je 0x14008be58
lea r9, [0x140292780]
xor r15d, r15d
xor ecx, ecx
movzx eax, word [r14 + rcx*2]
inc rcx
cmp ax, word [r9 + rcx*2 - 2]
jne 0x14008be58
cmp rcx, 8
jne 0x14008be40
jmp 0x14008beab
mov dword [rsp + 0x28], 4
lea rax, [rbp - 0x78]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x44]
mov edx, esi
mov rcx, rdi
call fcn.1400c3830
mov r15, rax
mov rcx, rdi
call fcn.1402434a4
test r15, r15
je 0x14008c1b8
mov r8d, dword [rsp + 0x44]
test r8d, r8d
jle 0x14008c1b0
mov edx, dword [rsp + 0x48]
test edx, edx
jle 0x14008c1b0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x58], xmm0
mov dword [rbp - 0x48], 0
mov dword [rbp - 0x70], Ordinal_46
mov dword [rbp - 0x6c], r8d
mov eax, edx
neg eax
mov dword [rbp - 0x68], eax
mov qword [rbp - 0x64], 0x200001
imul edx, r8d
shl edx, 2
mov dword [rbp - 0x5c], edx
xor dil, dil
mov byte [rsp + 0x42], dil
mov qword [rsp + 0x50], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
xor r8d, r8d
lea rdx, [rbp - 0x70]
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateDIBSection]
mov rsi, rax
mov qword [rsp + 0x68], rax
test rax, rax
je 0x14008c1b8
mov dword [rsp + 0x58], 0
test r14, r14
je 0x14008bfa7
xor ecx, ecx
lea rdx, [0x140292780]
nop
movzx eax, word [r14 + rcx*2]
inc rcx
cmp ax, word [rdx + rcx*2 - 2]
jne 0x14008bfa7
cmp rcx, 8
jne 0x14008bf40
mov qword [rsp + 0x70], 0
cmp word [r13], 0x23
jne 0x14008bf72
mov rcx, r13
call qword [sym.imp.USER32.dll_CharNextW]
mov r13, rax
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x70]
mov rcx, r13
call fcn.14025bde8
mov ecx, eax
shr ecx, 0x18
mov byte [rsp + 0x5b], cl
mov byte [rsp + 0x5a], al
mov ecx, eax
shr ecx, 8
mov byte [rsp + 0x59], cl
shr eax, 0x10
mov byte [rsp + 0x58], al
lea r15, [rsp + 0x58]
xor r10d, r10d
mov eax, dword [rsp + 0x48]
imul eax, dword [rsp + 0x44]
test eax, eax
jle 0x14008c0eb
lea r8, [r15 + 3]
mov rsi, 0xfffffffffffffffe
sub rsi, r15
mov r12, r15
not r12
mov r13, 0xfffffffffffffffd
sub r13, r15
mov r14d, dword [rsp + 0x78]
nop
mov r9, r8
sub r9, r15
movzx ecx, byte [r8]
mov rax, qword [rsp + 0x50]
mov byte [r9 + rax], cl
lea r11, [r8 + r13]
lea rbx, [rsi + r8]
lea rdi, [r12 + r8]
cmp cl, 0xff
jae 0x14008c066
movzx ecx, byte [r8]
movzx eax, byte [r8 - 1]
imul ecx, eax
mov eax, 0x80808081
mul ecx
shr edx, 7
mov rax, qword [rsp + 0x50]
mov byte [r11 + rax], dl
movzx ecx, byte [r8 - 2]
movzx eax, byte [r8]
imul ecx, eax
mov eax, 0x80808081
mul ecx
shr edx, 7
mov rax, qword [rsp + 0x50]
mov byte [rbx + rax], dl
movzx ecx, byte [r8 - 3]
movzx eax, byte [r8]
imul ecx, eax
mov eax, 0x80808081
mul ecx
shr edx, 7
mov rax, qword [rsp + 0x50]
mov byte [rdi + rax], dl
mov byte [rsp + 0x42], 1
jmp 0x14008c08e
movzx ecx, byte [r8 - 1]
mov rax, qword [rsp + 0x50]
mov byte [r11 + rax], cl
movzx ecx, byte [r8 - 2]
mov rax, qword [rsp + 0x50]
mov byte [rbx + rax], cl
movzx ecx, byte [r8 - 3]
mov rax, qword [rsp + 0x50]
mov byte [rdi + rax], cl
mov rax, qword [rsp + 0x50]
cmp dword [r11 + rax], r14d
jne 0x14008c0c4
mov byte [r11 + rax], 0
mov rax, qword [rsp + 0x50]
mov byte [rbx + rax], 0
mov rax, qword [rsp + 0x50]
mov byte [rdi + rax], 0
mov rax, qword [rsp + 0x50]
mov byte [r9 + rax], 0
mov dil, 1
mov byte [rsp + 0x42], dil
jmp 0x14008c0c9
movzx edi, byte [rsp + 0x42]
inc r10d
add r8, 4
mov eax, dword [rsp + 0x48]
imul eax, dword [rsp + 0x44]
cmp r10d, eax
jl 0x14008bfe0
mov r14, qword [rbp - 0x80]
mov rsi, qword [rsp + 0x68]
test r14, r14
je 0x14008c117
xor ecx, ecx
lea rdx, [0x140292780]
nop dword [rax]
movzx eax, word [r14 + rcx*2]
inc rcx
cmp ax, word [rdx + rcx*2 - 2]
jne 0x14008c117
cmp rcx, 8
jne 0x14008c100
jmp 0x14008c11f
mov rcx, r15
call fcn.1400c3820
mov ecx, 0xb8
call fcn.140242f80
mov rbx, rax
mov qword [rbp - 0x80], rax
test rax, rax
je 0x14008c143
lea rcx, [rax + 0x28]
call fcn.14006b4c0
xor r15d, r15d
jmp 0x14008c149
xor r15d, r15d
mov ebx, r15d
mov qword [rbx], rsi
mov rax, qword [rsp + 0x50]
mov qword [rbx + 8], rax
mov r8d, dword [rsp + 0x60]
cmp r8d, 0xc8
jne 0x14008c17d
mov eax, dword [rsp + 0x44]
cdq
sub eax, edx
sar eax, 1
mov dword [rbx + 0x18], eax
mov eax, dword [rsp + 0x48]
cdq
sub eax, edx
sar eax, 1
mov dword [rbx + 0x1c], eax
jmp 0x14008c18b
mov ecx, dword [rsp + 0x44]
mov dword [rbx + 0x18], ecx
mov ecx, dword [rsp + 0x48]
mov dword [rbx + 0x1c], ecx
mov byte [rbx + 0x20], dil
mov byte [rbx + 0x21], 0
movzx eax, byte [rsp + 0x40]
mov byte [rbx + 0x22], al
movzx eax, byte [rsp + 0x41]
mov byte [rbx + 0x23], al
mov dword [rbx + 0x24], r8d
mov qword [rbx + 0x10], r15
mov rax, rbx
jmp 0x14008c1ba
mov rcx, r15
call fcn.1400c3820
xor eax, eax
mov rcx, qword [rbp + 0x670]
xor rcx, rsp
call fcn.1402435c0
lea r11, [rsp + 0x780]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret