Function at 0x14000b600
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
mov edi, dword [0x14015a560]
xor r15d, r15d
mov qword [rsp + 0x20], rcx
mov ebp, 0x200
mov ecx, dword [0x14015b550]
mov qword [rsp + 0x28], r15
lea eax, [rcx - 0x200]
cmp eax, 0xfe00
cmova ecx, ebp
mov dword [0x140109f38], ecx
cmp edi, 3
jne 0x14000b67c
cmp word [0x14015b436], r15w
jne 0x14000b680
cmp byte [0x14015b423], r15b
mov eax, 7
cmovne edi, eax
cmp byte [0x14015b424], r15b
je 0x14000b680
lea edi, [rax + 1]
jmp 0x14000b680
test edi, edi
je 0x14000b6e9
cmp dword [0x14015a200], 1
jne 0x14000b6e9
mov edi, 0xa
lea rcx, str.Writing_protective_message_SBR
call fcn.140041aa0
mov rbx, qword [0x14015a338]
mov edx, 0x1c4
mov rcx, rbx
mov r8d, 0xa
mov ebp, 0x4400
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rsi, rax
test rax, rax
jne 0x14000b70c
call fcn.140041e50
mov r8, rax
lea rdx, str.msg.txt
lea rcx, str.Could_not_locate_resource__s:__s
call fcn.140041aa0
lea rcx, str.Could_not_access_message
jmp 0x14000b932
mov ecx, edi
sub ecx, 7
je 0x14000b8e1
sub ecx, 1
je 0x14000b7db
cmp ecx, 2
je 0x14000b68e
mov eax, 1
jmp 0x14000b939
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r12, rax
test rax, rax
jne 0x14000b747
call fcn.140041e50
mov r8, rax
lea rdx, str.msg.txt
lea rcx, str.Could_not_load_resource__s:__s
call fcn.140041aa0
lea rcx, str.Could_not_access_message
jmp 0x14000b932
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, 1
mov ecx, 0x1000
mov r14d, eax
call fcn.1400966e0
mov rsi, rax
test rax, rax
jne 0x14000b78c
lea rdx, str.msg.txt
lea rcx, str.Could_not_allocate_resource__s
call fcn.140041aa0
lea rcx, str.Could_not_access_message
jmp 0x14000b932
mov ebx, 0x1000
mov rcx, r12
cmp r14d, ebx
cmovb ebx, r14d
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r8d, ebx
mov rcx, rsi
mov rdx, rax
call fcn.140093550
cmp r14d, 0x1000
jbe 0x14000b9b4
lea r8d, [r14 - 0x1000]
lea rdx, str.msg.txt
lea rcx, str.WARNING:_Resource__s_was_truncated_by__d_bytes_
call fcn.140041aa0
jmp 0x14000b9b4
mov rcx, qword [0x140111630]
test rcx, rcx
je 0x14000b826
movsxd rdx, dword [0x14015b528]
call fcn.14003d720
test eax, eax
lea rcx, [0x1400d9848]
lea rdx, [0x1400d984c]
cmovne rdx, rcx
lea rcx, str.Writing_Grub_2.0_SBR__from_download___s
call fcn.140041aa0
mov rsi, qword [0x140111630]
mov r14d, dword [0x14015b528]
jmp 0x14000b9b4
lea rcx, str.Writing_Grub_2.0_SBR__from_embedded_
call fcn.140041aa0
mov rbx, qword [0x14015a338]
mov edx, 0x1c3
mov rcx, rbx
mov r8d, 0xa
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rsi, rax
test rax, rax
jne 0x14000b87c
call fcn.140041e50
mov r8, rax
lea rdx, str.core.img
lea rcx, str.Could_not_locate_resource__s:__s
call fcn.140041aa0
lea rcx, str.Could_not_access_core.img
jmp 0x14000b932
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r12, rax
test rax, rax
jne 0x14000b8b4
call fcn.140041e50
mov r8, rax
lea rdx, str.core.img
lea rcx, str.Could_not_load_resource__s:__s
call fcn.140041aa0
lea rcx, str.Could_not_access_core.img
jmp 0x14000b932
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, r12
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rsi, rax
test rax, rax
jne 0x14000b9b4
lea rcx, str.Could_not_access_core.img
jmp 0x14000b932
lea rcx, str.Writing_Grub4Dos_SBR
call fcn.140041aa0
mov rbx, qword [0x14015a338]
mov edx, 0x1c2
mov rcx, rbx
mov r8d, 0xa
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rsi, rax
test rax, rax
jne 0x14000b958
call fcn.140041e50
mov r8, rax
lea rdx, str.grldr.mbr
lea rcx, str.Could_not_locate_resource__s:__s
call fcn.140041aa0
lea rcx, str.grldr.mbr_is_either_not_present_or_too_small
call fcn.140041aa0
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r12, rax
test rax, rax
jne 0x14000b984
call fcn.140041e50
mov r8, rax
lea rdx, str.grldr.mbr
lea rcx, str.Could_not_load_resource__s:__s
jmp 0x14000b926
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, r12
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
je 0x14000b92b
cmp r14d, ebp
jbe 0x14000b92b
lea rsi, [rax + 0x200]
add r14d, 0xfffffe00
lea eax, [r14 + rbp]
cmp eax, dword [0x14015b5b0]
jbe 0x14000b9e2
lea rcx, str.__SBR_size_is_too_large___You_may_need_to_uncheck_Add_fixes_for_old_BIOSes.
call fcn.140041aa0
cmp edi, 0xa
jne 0x14000b937
mov rcx, rsi
call fcn.14009b5a0
jmp 0x14000b937
mov r9d, r14d
lea rcx, [rsp + 0x20]
mov edx, ebp
mov r8, rsi
call fcn.1400600b0
mov rcx, qword [0x140111630]
mov ebx, eax
call fcn.14009b5a0
mov qword [0x140111630], r15
cmp edi, 0xa
jne 0x14000ba16
mov rcx, rsi
call fcn.14009b5a0
test ebx, ebx
setne r15b
mov eax, r15d
jmp 0x14000b939