Function at 0x50afe0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
mov rax, rsp
sub rsp, 0x98
mov qword [rax + 0x20], rdi
mov qword [rax - 0x10], r13
mov r13, rdx
xor edx, edx
lea r8d, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
test rax, rax
mov rdi, rax
je 0x50b306
lea rax, [rsp + 0x48]
lea r8, [0x0050af80]
mov edx, recvfrom
mov rcx, rdi
movsxd r9, eax
mov qword [rsp + 0xa0], rbx
xor bl, bl
mov dword [rsp + 0x48], 0xffffffff
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
mov r11d, dword [rsp + 0x48]
cmp r11d, 0xffffffff
je 0x50b2f3
test r11d, 0xffff0000
mov qword [rsp + 0xb0], rsi
jne 0x50b079
movzx edx, r11w
mov r8d, recvfrom
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rsi, rax
mov qword [rsp + 0x58], rax
jmp 0x50b0a2
mov rdx, qword [0x00773080]
mov r8d, recvfrom
mov rcx, rdi
test rdx, rdx
cmove rdx, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rsi, rax
mov qword [rsp + 0x58], rax
test rsi, rsi
je 0x50b2e2
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x50b2e2
mov qword [rsp + 0xa8], rbp
mov qword [rsp + 0x90], r12
mov rcx, rax
mov qword [rsp + 0x80], r14
mov qword [rsp + 0x78], r15
call qword [sym.imp.KERNEL32.dll_LockResource]
movzx edx, word [rax + 4]
lea r12, [rax + 4]
mov ecx, 0x40
shl rdx, 2
mov rbp, rax
lea r14, [rax + 6]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x50], rax
xor eax, eax
mov edx, 0x40000000
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
mov rcx, r13
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileA]
test rax, rax
mov r15, rax
je 0x50b2ba
xor r13d, r13d
lea r9, [rsp + 0x40]
mov rdx, rbp
lea r8d, [r13 + 6]
mov rcx, rax
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
movzx edx, word [r12]
lea r9d, [r13 + 1]
shl edx, 4
xor r8d, r8d
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebp, r13d
cmp word [r12], bp
jbe 0x50b235
mov r13, qword [rsp + 0x50]
lea rsi, [r14 + 0xc]
nop
nop
movzx edx, word [rsi]
mov r8d, 3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceA]
test rax, rax
mov rbx, rax
je 0x50b21b
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, rbx
mov rcx, rdi
mov dword [rsp + 0x44], eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov qword [rsp + 0x60], rax
je 0x50b212
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov r8d, dword [rsp + 0x44]
mov rdx, qword [rsp + 0x60]
lea r9, [rsp + 0x40]
mov rcx, r15
mov dword [r13], eax
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
movzx eax, word [r12]
inc ebp
add rsi, 0xe
add r13, 4
cmp ebp, eax
jl 0x50b190
xor r13d, r13d
xor r9d, r9d
xor r8d, r8d
mov rcx, r15
lea edx, [r9 + 6]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp word [r12], 0
mov esi, r13d
jbe 0x50b2aa
mov rbx, qword [rsp + 0x50]
nop
nop
mov rax, qword [r14]
lea rcx, [rsp + 0x60]
lea r9, [rsp + 0x40]
mov qword [rcx], rax
mov rax, qword [r14 + 8]
lea rdx, [rsp + 0x60]
mov qword [rcx + 8], rax
mov eax, dword [rbx]
mov r8d, reloc.WS2_32.dll_recv
mov rcx, r15
mov qword [rsp + 0x20], r13
mov dword [rsp + 0x6c], eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
movzx eax, word [r12]
inc esi
add r14, 0xe
add rbx, 4
cmp esi, eax
jl 0x50b260
mov rcx, r15
mov bl, 1
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r15, qword [rsp + 0x78]
mov r14, qword [rsp + 0x80]
mov r12, qword [rsp + 0x90]
mov rbp, qword [rsp + 0xa8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rsi, qword [rsp + 0xb0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov al, bl
mov rbx, qword [rsp + 0xa0]
mov r13, qword [rsp + 0x88]
mov rdi, qword [rsp + 0xb8]
add rsp, 0x98
ret