Function at 0x1000fd4c4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
xor r14d, r14d
mov r15, r9
mov rsi, r8
mov rdi, rcx
mov ebx, 0x80070057
test rdx, rdx
jne 0x1000fd530
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000fd931
test byte [rcx + 0x1c], 1
je 0x1000fd931
mov rcx, qword [rcx + 0x10]
lea edx, [r14 + 0x3f]
lea r8, [0x10001dbd8]
call fcn.100034764
jmp 0x1000fd931
call fcn.1000fe6b4
mov ebx, eax
test eax, eax
jns 0x1000fd579
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000fd931
test byte [rcx + 0x1c], 1
je 0x1000fd931
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dbd8]
mov edx, 0x40
mov r9d, ebx
call fcn.100036328
jmp 0x1000fd931
xor edx, edx
mov rcx, rsi
lea r8d, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov r12, rax
test rax, rax
jne 0x1000fd5e1
call sub.KERNEL32.dll_GetLastError
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000fd924
test byte [rcx + 0x1c], 1
je 0x1000fd924
lea edx, [r12 + 0x41]
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dbd8]
mov r9d, ebx
call fcn.100036328
jmp 0x1000fd924
lea r8, [0x1000274f0]
lea rdx, [0x100027518]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x1000fd63b
call sub.KERNEL32.dll_GetLastError
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000fd924
test byte [rcx + 0x1c], 1
je 0x1000fd924
mov edx, 0x42
jmp 0x1000fd5c9
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r13d, eax
lea ecx, [rax - 0x98]
cmp ecx, 0x7ff68
ja 0x1000fd8e3
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r14, rax
test rax, rax
jne 0x1000fd6ad
call sub.KERNEL32.dll_GetLastError
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000fd916
test byte [rcx + 0x1c], 1
je 0x1000fd916
lea edx, [r14 + 0x44]
jmp 0x1000fd8b8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rsi, rax
test rax, rax
jne 0x1000fd6fa
call sub.KERNEL32.dll_GetLastError
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000fd916
test byte [rcx + 0x1c], 1
je 0x1000fd916
lea edx, [rsi + 0x45]
jmp 0x1000fd8b8
cmp dword [rax], 0x414d5153
je 0x1000fd732
mov ebx, 0x90070a0b
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000fd916
test byte [rcx + 0x1c], 1
je 0x1000fd916
mov edx, 0x46
jmp 0x1000fd906
lea rdx, [rdi + 0xc]
lea rcx, [rax + 0x18]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x1000fd778
mov ebx, 0x90070a0b
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000fd916
test byte [rcx + 0x1c], 1
je 0x1000fd916
mov edx, 0x47
lea r9, [rsi + 0x18]
jmp 0x1000fd871
mov eax, dword [rdi + 8]
cmp dword [rsi + 4], eax
je 0x1000fd7b0
mov ebx, 0x90070a0b
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000fd916
test byte [rcx + 0x1c], 1
je 0x1000fd916
mov edx, 0x48
jmp 0x1000fd906
lea rbx, [rsi + 0x10]
test rbx, rbx
je 0x1000fd7e6
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntdll.dll_NtQuerySystemTime]
test eax, eax
js 0x1000fd7e6
mov eax, dword [rbx]
xor ecx, ecx
mov dword [rsp + 0x68], eax
mov eax, dword [rbx + 4]
mov dword [rsp + 0x6c], eax
mov rax, qword [rsp + 0x20]
cmp qword [rsp + 0x68], rax
setle cl
jmp 0x1000fd7eb
mov ecx, 1
test ecx, ecx
je 0x1000fd81f
mov ebx, 0x90070a0a
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000fd916
test byte [rcx + 0x1c], 1
je 0x1000fd916
mov edx, 0x49
jmp 0x1000fd906
lea r8, [0x100027100]
mov r9d, 1
mov rdx, r15
mov rcx, rdi
call fcn.1000fce78
mov ebx, eax
test eax, eax
jns 0x1000fd886
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000fd916
test byte [rcx + 0x1c], 1
je 0x1000fd916
lea r9, [0x100002f60]
test r15, r15
mov edx, 0x4a
cmovne r9, r15
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dbd8]
call fcn.100034788
jmp 0x1000fd916
mov r8d, r13d
mov rdx, rsi
mov rcx, rdi
call fcn.1000fde14
mov ebx, eax
test eax, eax
jns 0x1000fd8cd
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000fd916
test byte [rcx + 0x1c], 1
je 0x1000fd916
mov edx, 0x4b
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dbd8]
mov r9d, ebx
call fcn.100036328
jmp 0x1000fd916
mov eax, dword [rdi + 0xa0]
sub eax, dword [rdi + 0x90]
xor ebx, ebx
mov dword [rdi + 0x98], eax
jmp 0x1000fd916
mov ebx, 0x90070a0b
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000fd924
test byte [rcx + 0x1c], 1
je 0x1000fd924
mov edx, 0x43
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dbd8]
call fcn.100034764
test r14, r14
je 0x1000fd924
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeResource]
test r12, r12
je 0x1000fd931
mov rcx, r12
call sub.KERNEL32.dll_FreeLibrary
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret