Function at 0x18004b2d0
Capabilities:
Extract resource via kernel32 functions
Read file via mapping

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
xor ebx, ebx
mov edi, ebx
mov qword [rsp + 0x48], rbx
mov r12, 0xffffffffffffffff
mov qword [rsp + 0x50], r12
mov r15d, ebx
mov qword [rsp + 0x58], rbx
mov r14d, ebx
mov qword [rsp + 0x60], rbx
mov r13, qword [sym.imp.KERNEL32.dll_CreateFileW]
lea rcx, [0x180033800]
mov eax, dword [rsp + 0xd0]
test eax, eax
cmovne r13, rcx
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x180033580]
cmovne rsi, rcx
mov qword [rsp + 0x68], rsi
test r13, r13
je 0x18004b362
test rsi, rsi
je 0x18004b362
cmp r8d, 0x5c
jae 0x18004b374
lea ecx, [rbx + 0x7a]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov dword [rsp + 0xb8], eax
mov rcx, qword [rsp + 0xb0]
cmp dword [rsp + 0xd8], ebx
jne 0x18004b41e
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
call r13
mov r12, rax
mov qword [rsp + 0x50], rax
cmp rax, 0xffffffffffffffff
je 0x18004b432
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor edx, edx
mov r8d, 0x1000002
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov r15, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x18004b432
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r14, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x18004b432
jmp 0x18004b42a
xor edx, edx
lea r8d, [rdx + 2]
call qword [0x1800d4958]
mov qword [rsp + 0x48], rax
mov rdi, rax
mov ecx, dword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
test rdi, rdi
je 0x18004b524
mov edx, 1
lea r8d, [rdx + 0xf]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x18004b511
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rax
test rax, rax
je 0x18004b511
movzx esi, word [rax]
mov dword [rsp + 0xb8], esi
mov edx, dword [rsp + 0xc0]
lea ecx, [rsi + rsi]
add rcx, 4
cmp rcx, rdx
jbe 0x18004b4ad
shr rdx, 1
lea esi, [rdx - 4]
mov dword [rsp + 0xb8], esi
mov r13d, 1
jmp 0x18004b4b0
mov r13d, ebx
mov eax, esi
test eax, eax
jle 0x18004b4e7
mov ebx, eax
mov r8d, eax
mov rdx, r9
mov rcx, qword [rsp + 0xc8]
call fcn.1800ab630
mov rax, qword [rsp + 0xc8]
mov dword [rbx + rax], 0x58324546
test r13d, r13d
je 0x18004b4e2
mov word [rax], si
mov ebx, 1
mov dword [rsp + 0x40], ebx
mov rsi, qword [rsp + 0x68]
jmp 0x18004b511
cmp dword [rsp + 0xd8], 0
je 0x18004b524
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test r14, r14
je 0x18004b532
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test r15, r15
je 0x18004b540
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp r12, 0xffffffffffffffff
je 0x18004b54b
mov rcx, r12
call rsi
mov eax, ebx
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret