Function at 0x1401b9b20
Capabilities:
Extract resource via kernel32 functions
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x4f8
mov qword [rsp + 0x488], 0xfffffffffffffffe
mov dword [rsp + 0x480], 0
mov rdx, qword [rsp + 0x520]
lea rcx, [rsp + 0x3e0]
call fcn.140010e20
mov qword [rsp + 0x490], rax
mov rax, qword [rsp + 0x490]
mov qword [rsp + 0x498], rax
mov rcx, qword [rsp + 0x498]
call fcn.140010eb0
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.140002090
nop
lea rcx, [rsp + 0x3e0]
call fcn.140002e10
lea rcx, [rsp + 0x70]
call fcn.140007b70
movzx eax, al
test eax, eax
je 0x1401b9bd6
mov dword [rsp + 0x3e8], 0
lea rcx, [rsp + 0x70]
call fcn.140001470
mov eax, dword [rsp + 0x3e8]
jmp 0x1401ba35f
mov r8d, 1
lea rdx, [rsp + 0x3f0]
lea rcx, [rsp + 0x70]
call fcn.140006ac0
mov qword [rsp + 0x4a0], rax
mov rax, qword [rsp + 0x4a0]
mov qword [rsp + 0x4a8], rax
mov eax, dword [rsp + 0x480]
or eax, 1
mov dword [rsp + 0x480], eax
lea rdx, [0x140219d8c]
mov rcx, qword [rsp + 0x4a8]
call fcn.140006cf0
movzx eax, al
test eax, eax
jne 0x1401b9c8b
mov r8d, 1
lea rdx, [rsp + 0x3f8]
lea rcx, [rsp + 0x70]
call fcn.140006ac0
mov qword [rsp + 0x4b0], rax
mov eax, dword [rsp + 0x480]
or eax, 2
mov dword [rsp + 0x480], eax
lea rdx, [0x140219ddc]
mov rcx, qword [rsp + 0x4b0]
call fcn.140006cf0
movzx eax, al
test eax, eax
jne 0x1401b9c8b
mov dword [rsp + 0x4b8], 0
jmp 0x1401b9c96
mov dword [rsp + 0x4b8], 1
movzx eax, byte [rsp + 0x4b8]
mov byte [rsp + 0x3ec], al
mov eax, dword [rsp + 0x480]
and eax, 2
test eax, eax
je 0x1401b9cc9
and dword [rsp + 0x480], 0xfffffffd
lea rcx, [rsp + 0x3f8]
call fcn.140001470
nop
mov eax, dword [rsp + 0x480]
and eax, 1
test eax, eax
je 0x1401b9cec
and dword [rsp + 0x480], 0xfffffffe
lea rcx, [rsp + 0x3f0]
call fcn.140001470
movzx eax, byte [rsp + 0x3ec]
test eax, eax
je 0x1401b9d48
mov r8d, 1
lea rdx, [rsp + 0x400]
lea rcx, [rsp + 0x70]
call fcn.1400069a0
mov qword [rsp + 0x4c0], rax
mov rax, qword [rsp + 0x4c0]
mov qword [rsp + 0x4c8], rax
mov rdx, qword [rsp + 0x4c8]
lea rcx, [rsp + 0x70]
call fcn.140002d20
nop
lea rcx, [rsp + 0x400]
call fcn.140001470
lea rcx, [rsp + 0x70]
call fcn.1400012c0
lea r8, [rsp + 0x58]
mov rdx, rax
lea rcx, [0x1403acd98]
call fcn.140027950
test eax, eax
je 0x1401b9da9
mov rcx, qword [rsp + 0x510]
mov rax, qword [rsp + 0x60]
mov qword [rcx], rax
mov rcx, qword [rsp + 0x518]
mov eax, dword [rsp + 0x58]
mov dword [rcx], eax
mov dword [rsp + 0x408], 1
lea rcx, [rsp + 0x70]
call fcn.140001470
mov eax, dword [rsp + 0x408]
jmp 0x1401ba35f
xor r8d, r8d
lea rdx, [0x14021a36c]
lea rcx, [rsp + 0x70]
call fcn.140006720
test eax, eax
jl 0x1401b9de2
mov dword [rsp + 0x40c], 0
lea rcx, [rsp + 0x70]
call fcn.140001470
mov eax, dword [rsp + 0x40c]
jmp 0x1401ba35f
lea rcx, [rsp + 0x20]
call fcn.140076030
nop
lea rdx, [0x1403acb30]
add rdx, 0x228
lea r8, str._tftp_
lea rcx, [rsp + 0x410]
call fcn.1400010b0
mov qword [rsp + 0x4d0], rax
mov rax, qword [rsp + 0x4d0]
mov qword [rsp + 0x4d8], rax
lea r8, [rsp + 0x70]
mov rdx, qword [rsp + 0x4d8]
lea rcx, [rsp + 0x50]
call fcn.140006b70
nop
lea rcx, [rsp + 0x410]
call fcn.140001470
lea rcx, [rsp + 0x50]
call fcn.1400012c0
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.140076134
test eax, eax
je 0x1401b9fb8
lea rcx, [rsp + 0x20]
call fcn.140075d3c
lea rcx, [rsp + 0x20]
call fcn.140075d88
mov dword [rsp + 0x58], eax
lea rcx, [rsp + 0x20]
call fcn.140075c68
lea rcx, [rsp + 0x50]
call fcn.1400012c0
lea rdx, [0x14021a388]
mov rcx, rax
call fcn.1400a9d50
mov qword [rsp + 0x78], rax
cmp qword [rsp + 0x78], 0
jne 0x1401b9eed
mov dword [rsp + 0x418], 0
lea rcx, [rsp + 0x50]
call fcn.140001470
nop
lea rcx, [rsp + 0x20]
call fcn.14007608c
nop
lea rcx, [rsp + 0x70]
call fcn.140001470
mov eax, dword [rsp + 0x418]
jmp 0x1401ba35f
mov ecx, dword [rsp + 0x58]
call fcn.140071aa8
mov qword [rsp + 0x420], rax
mov rax, qword [rsp + 0x420]
mov qword [rsp + 0x60], rax
mov edx, dword [rsp + 0x58]
mov r9, qword [rsp + 0x78]
mov r8d, 1
mov rcx, qword [rsp + 0x60]
call fcn.1400ac7f4
mov rcx, qword [rsp + 0x78]
call fcn.1400a9ff0
mov rdx, qword [rsp + 0x510]
mov rax, qword [rsp + 0x60]
mov qword [rdx], rax
mov rcx, qword [rsp + 0x518]
mov eax, dword [rsp + 0x58]
mov dword [rcx], eax
lea rdi, [rsp + 0x460]
lea rsi, [rsp + 0x58]
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x70]
call fcn.1400012c0
lea r8, [rsp + 0x460]
mov rdx, rax
lea rcx, [0x1403acd98]
call fcn.1400279d0
mov dword [rsp + 0x428], 1
lea rcx, [rsp + 0x50]
call fcn.140001470
nop
lea rcx, [rsp + 0x20]
call fcn.14007608c
nop
lea rcx, [rsp + 0x70]
call fcn.140001470
mov eax, dword [rsp + 0x428]
jmp 0x1401ba35f
lea rcx, [rsp + 0x20]
call fcn.140075c68
lea rcx, [rsp + 0x70]
call fcn.1400012c0
mov rdi, rax
call fcn.14000f720
lea r8, [0x14021a390]
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rsp + 0x68], rax
lea rdx, [0x14021a3a8]
lea rcx, [rsp + 0x430]
call fcn.1400eeb20
mov qword [rsp + 0x4e0], rax
lea rdx, [0x14021a398]
mov rcx, qword [rsp + 0x4e0]
call fcn.140006d30
mov byte [rsp + 0x42c], al
lea rcx, [rsp + 0x430]
call fcn.140001470
movzx edx, byte [rsp + 0x42c]
test edx, edx
je 0x1401ba0e2
lea rdx, [0x14021a3b8]
lea rcx, [rsp + 0x70]
call fcn.140006050
test eax, eax
jne 0x1401ba076
call fcn.14000f720
lea r8, [0x14021a3d0]
lea rdx, str.oem_gpxe.pxe
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rsp + 0x68], rax
lea rdx, [0x14021a3f8]
lea rcx, [rsp + 0x70]
call fcn.140006050
test eax, eax
jne 0x1401ba0ac
call fcn.14000f720
lea r8, [0x14021a410]
lea rdx, str.oem_gpxex.pxe
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rsp + 0x68], rax
lea rdx, [0x14021a438]
lea rcx, [rsp + 0x70]
call fcn.140006050
test eax, eax
jne 0x1401ba0e2
call fcn.14000f720
lea r8, [0x14021a450]
lea rdx, [0x14021a458]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rsp + 0x68], rax
cmp qword [rsp + 0x68], 0
je 0x1401ba1e8
call fcn.14000f720
mov rdx, qword [rsp + 0x68]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x58], eax
call fcn.14000f720
mov rdx, qword [rsp + 0x68]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x80], rax
mov ecx, dword [rsp + 0x58]
call fcn.140071aa8
mov qword [rsp + 0x438], rax
mov rax, qword [rsp + 0x438]
mov qword [rsp + 0x60], rax
mov r8d, dword [rsp + 0x58]
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
call fcn.1400a8d20
mov rdx, qword [rsp + 0x510]
mov rax, qword [rsp + 0x60]
mov qword [rdx], rax
mov rcx, qword [rsp + 0x518]
mov eax, dword [rsp + 0x58]
mov dword [rcx], eax
lea rdi, [rsp + 0x470]
lea rsi, [rsp + 0x58]
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x70]
call fcn.1400012c0
lea r8, [rsp + 0x470]
mov rdx, rax
lea rcx, [0x1403acd98]
call fcn.1400279d0
mov dword [rsp + 0x440], 1
lea rcx, [rsp + 0x50]
call fcn.140001470
nop
lea rcx, [rsp + 0x20]
call fcn.14007608c
nop
lea rcx, [rsp + 0x70]
call fcn.140001470
mov eax, dword [rsp + 0x440]
jmp 0x1401ba35f
lea rcx, [0x140219e5c]
call fcn.1400a9170
mov rdi, rax
lea rcx, [rsp + 0x70]
call fcn.1400012c0
mov r8, rdi
lea rdx, [0x14021a478]
mov rcx, rax
call fcn.1400a938c
test eax, eax
jne 0x1401ba326
lea rcx, [rsp + 0x90]
call fcn.1401cd320
nop
lea rax, [rsp + 0x448]
mov qword [rsp + 0x450], rax
mov r8d, 3
mov rdx, qword [rsp + 0x450]
lea rcx, [rsp + 0x70]
call fcn.1400069a0
mov qword [rsp + 0x4e8], rax
mov rdx, qword [rsp + 0x4e8]
lea rcx, [rsp + 0x90]
call fcn.1401d2c30
mov dword [rsp + 0x3d4], 0
mov dword [rsp + 0x3d0], 0
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x90]
call fcn.1401d1940
nop
cmp dword [rsp + 0x3d4], 0xffffffff
je 0x1401ba30b
lea r9, [rsp + 0x3d4]
lea r8, [0x140219eac]
lea rdx, [rsp + 0x3d8]
lea rcx, [rsp + 0x88]
call fcn.140006540
lea rcx, [rsp + 0x3d8]
call fcn.140007b70
movzx eax, al
test eax, eax
je 0x1401ba2eb
lea rcx, [rsp + 0x3d8]
call fcn.140001470
jmp 0x1401ba30b
mov eax, dword [rsp + 0x3d0]
add eax, 1
mov dword [rsp + 0x3d0], eax
lea rcx, [rsp + 0x3d8]
call fcn.140001470
jmp 0x1401ba29a
lea rcx, [rsp + 0x88]
call fcn.140001470
nop
lea rcx, [rsp + 0x90]
call fcn.140005d50
mov dword [rsp + 0x458], 0
lea rcx, [rsp + 0x50]
call fcn.140001470
nop
lea rcx, [rsp + 0x20]
call fcn.14007608c
nop
lea rcx, [rsp + 0x70]
call fcn.140001470
mov eax, dword [rsp + 0x458]
jmp 0x1401ba35f
add rsp, 0x4f8
pop rdi
pop rsi
ret