Function at 0x1800049b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xe8
xor edx, edx
mov edi, 0xea60
mov r15d, edx
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rdx
mov r12d, edx
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x50], rdx
mov r14d, edx
mov dword [rax + 8], edx
mov r13d, edx
mov qword [rax + 0x20], rdx
mov esi, edx
cmp ecx, edi
jb 0x180004a08
mov eax, 0x493e0
mov edi, ecx
cmp ecx, eax
cmova edi, eax
mov qword [rsp + 0xe0], rbx
mov qword [rsp + 0xd8], rbp
call fcn.1800042e0
test eax, eax
je 0x180004e98
mov rcx, qword [0x180020eb0]
lea r8, [0x1800171c0]
mov edx, 0x66
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov edx, 0x30
lea ecx, [rdx - 0x2f]
mov rbx, rax
call fcn.180006488
mov edx, edi
mov rcx, rax
mov rbp, rax
call fcn.180004730
test eax, eax
jne 0x180004b7e
mov r9, rbp
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
lea r9, [rbp + 0x10]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x40], rsi
je 0x180004e98
test rax, rax
je 0x180004e98
test rbx, rbx
jne 0x180004aae
mov ebx, 0x490
jmp 0x180004b1b
mov rcx, qword [0x180020eb0]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r14, rax
test rax, rax
jne 0x180004ad0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x180004b13
mov rcx, qword [0x180020eb0]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, r14
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
call fcn.1800045e0
mov ebx, eax
test eax, eax
jne 0x180004b10
call fcn.180004500
mov r15, rax
test rax, rax
jne 0x180004bab
mov ebx, 0x490
mov r12, rsi
mov r14d, dword [rsp + 0x120]
mov rdi, qword [rsp + 0x40]
test rdi, rdi
je 0x180004b2e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x180004b41
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r12, r12
je 0x180004b5e
mov r9d, 0x8000
mov r8d, 0x30
mov rdx, r12
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
test r15, r15
je 0x180004b6c
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r13, r13
je 0x180004b7c
mov edx, r14d
mov rcx, r13
call fcn.1800047e0
mov eax, ebx
mov rcx, qword [rsp + 0x128]
mov rbp, qword [rsp + 0xd8]
mov rbx, qword [rsp + 0xe0]
mov qword [rcx], rsi
add rsp, 0xe8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
xor edx, edx
mov r9d, 0x1000
mov rcx, rax
lea r8d, [rdx + 0x30]
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbx, rax
mov qword [rsp + 0x130], rax
test rax, rax
jne 0x180004bed
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov r12, qword [rsp + 0x130]
jmp 0x180004b13
lea rax, [rsp + 0x58]
mov r9d, 0x30
mov r8, rbp
mov rdx, rbx
mov rcx, r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x180004c25
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12, qword [rsp + 0x130]
mov ebx, eax
jmp 0x180004b13
cmp qword [rsp + 0x58], 0x30
je 0x180004c3f
mov r12, qword [rsp + 0x130]
mov ebx, 0x12b
jmp 0x180004b13
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov qword [rsp + 0x30], rsi
mov r9d, r12d
mov ecx, eax
mov rax, qword [0x180020ea8]
mov r8, r14
mov edx, 2
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], 1
call qword [rax + 0x2e8]
mov ebx, eax
test eax, eax
jne 0x180004be0
mov r14, qword [rsp + 0x40]
mov edx, edi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r12, qword [rsp + 0x130]
mov ebx, eax
test eax, eax
jne 0x180004b13
lea rax, [rsp + 0x50]
lea r9d, [rbx + 0x30]
mov r8, rbp
mov rdx, r12
mov rcx, r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x180004ccf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x180004b13
cmp qword [rsp + 0x50], 0x30
je 0x180004ce1
mov ebx, 0x12b
jmp 0x180004b13
lea r9, [rsp + 0x120]
lea r8, [rsp + 0x138]
mov rdx, rbp
mov rcx, r15
mov qword [rsp + 0x50], rsi
call fcn.180004840
mov ebx, eax
test eax, eax
jne 0x180004d1e
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
jne 0x180004d2b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov r13, qword [rsp + 0x138]
jmp 0x180004b13
mov edx, edi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, eax
test eax, eax
jne 0x180004d1e
mov r14d, dword [rsp + 0x120]
mov r13, qword [rsp + 0x138]
test r14d, r14d
je 0x180004e91
lea rbp, [r13 + 0x20]
nop dword [rax]
mov rdx, qword [rbp - 0x20]
mov rcx, rsi
call fcn.1800043d0
lea rdx, [0x1800171c4]
mov rcx, rax
call fcn.1800043d0
mov ecx, dword [rbp - 0x14]
mov edx, 0x64
mov dword [rsp + 0x20], ecx
lea r9, [0x1800171c8]
lea r8d, [rdx - 0x46]
lea rcx, [rsp + 0x60]
mov rbx, rax
call fcn.180006dbc
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.1800043d0
lea rdx, [0x1800171c4]
mov rcx, rax
call fcn.1800043d0
mov rbx, rbp
mov esi, 0x10
mov rdi, rax
nop word [rax + rax]
movzx ecx, byte [rbx]
mov edx, 0x64
lea r9, str._02x
mov dword [rsp + 0x20], ecx
lea rcx, [rsp + 0x60]
lea r8d, [rdx - 0x61]
call fcn.180006dbc
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.1800043d0
lea rbx, [rbx + 1]
mov rdi, rax
dec rsi
jne 0x180004dd0
lea rdx, [0x1800171c4]
mov rcx, rax
call fcn.1800043d0
lea rbx, [rbp - 0x10]
mov esi, 0x10
mov rdi, rax
nop word [rax + rax]
movzx ecx, byte [rbx]
mov edx, 0x64
lea r9, str._02x
mov dword [rsp + 0x20], ecx
lea rcx, [rsp + 0x60]
lea r8d, [rdx - 0x61]
call fcn.180006dbc
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.1800043d0
lea rbx, [rbx + 1]
mov rdi, rax
dec rsi
jne 0x180004e30
lea rdx, str.:::_n
mov rcx, rax
call fcn.1800043d0
add rbp, 0x30
mov rsi, rax
dec r14
jne 0x180004d60
mov r14d, dword [rsp + 0x120]
xor ebx, ebx
jmp 0x180004b1b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x180004b1b