Function at 0x180021840
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4a0
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x30], 0xfffffffffffffffe
mov qword [rbp + 0x4a0], rbx
mov rax, qword [0x180066180]
xor rax, rbp
mov qword [rbp + 0x450], rax
mov r13, r9
mov r12, r8
mov r15, rdx
xor edi, edi
mov ebx, edi
mov qword [rbp + 8], rbx
mov qword [rbp + 0x28], rcx
mov qword [rbp + 0x20], rdi
mov qword [rbp + 0x40], rdi
test rdx, rdx
je 0x180021af1
or rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], 0
jne 0x1800218a2
inc eax
movsxd rsi, eax
add rsi, rsi
mov eax, 0x80000000
add rax, rsi
mov ecx, 0xffffffff
cmp rax, rcx
ja 0x18002196e
cmp esi, 0x400
jg 0x180021907
movsxd r14, esi
mov rcx, r14
call fcn.180020ce0
test al, al
je 0x180021907
lea rax, [r14 + 0xf]
cmp rax, r14
ja 0x1800218f4
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.18002c7f0
sub rsp, rax
lea r14, [rsp + 0x40]
jmp 0x180021937
movsxd rcx, esi
or rax, 0xffffffffffffffff
sub rax, rcx
cmp rax, 0x10
jb 0x180021ae6
add rcx, 0x10
call fcn.18002accc
test rax, rax
je 0x18002196e
mov qword [rax], rdi
mov rbx, rax
mov qword [rbp + 8], rax
lea r14, [rax + 0x10]
test r14, r14
je 0x18002196e
mov byte [r14], 0
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r14
or r9d, 0xffffffff
mov r8, r15
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
cmove r14, rdi
mov rdi, r14
test rdi, rdi
je 0x180021af1
xor edx, edx
lea r8d, [rdx + 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
mov qword [rbp + 0x10], rax
test rax, rax
jne 0x1800219b9
xor edx, edx
lea r8d, [rax + 2]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
mov qword [rbp + 0x10], rax
test rax, rax
jne 0x1800219b9
call fcn.180020e50
mov edi, eax
jmp 0x180021ab9
mov r8, r13
mov rdx, r12
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdi, rax
test rax, rax
jne 0x1800219da
call fcn.180020e50
jmp 0x180021aa8
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r14, rax
mov qword [rbp + 0x18], rax
test rax, rax
jne 0x1800219fc
call fcn.180020e50
jmp 0x180021aa8
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [rbp], edi
lea eax, [rdi + 1]
cmp eax, edi
jae 0x180021a1e
mov edi, 0x8007000e
jmp 0x180021aaa
mov ecx, eax
test eax, eax
je 0x180021a53
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 1
jb 0x180021a49
cmp rcx, 0x400
jbe 0x180021a53
mov edx, ecx
lea rcx, [rbp + 0x40]
call fcn.180025a00
jmp 0x180021a5b
mov ecx, 0x80070216
call fcn.180002bd0
lea rax, [rbp + 0x48]
mov qword [rbp + 0x40], rax
jmp 0x180021a6c
cmp qword [rbp + 0x40], 0
jne 0x180021a7a
mov edi, 0x8007000e
jmp 0x180021aaa
mov r9, rdi
mov r8, r14
mov rdx, rdi
mov rcx, qword [rbp + 0x40]
call fcn.180002ad0
mov rax, qword [rbp + 0x40]
mov byte [rdi + rax], 0
mov r8d, dword [rbp + 0x4c0]
mov rdx, qword [rbp + 0x40]
lea rcx, [rbp + 0x20]
call fcn.180022f80
mov edi, eax
test rsi, rsi
je 0x180021ab9
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rbp + 0x48]
cmp qword [rbp + 0x40], rax
je 0x180021acd
lea rcx, [rbp + 0x40]
call fcn.1800259f0
nop
test rbx, rbx
je 0x180021ae2
mov rcx, rbx
mov rbx, qword [rbx]
call fcn.180029a40
test rbx, rbx
jne 0x180021ad2
mov eax, edi
jmp 0x180021b25
mov ecx, 0x80070216
call fcn.180002bd0
nop
lea rax, [rbp + 0x48]
cmp qword [rbp + 0x40], rax
je 0x180021b05
lea rcx, [rbp + 0x40]
call fcn.1800259f0
nop
test rbx, rbx
je 0x180021b20
nop word [rax + rax]
mov rcx, rbx
mov rbx, qword [rbx]
call fcn.180029a40
test rbx, rbx
jne 0x180021b10
mov eax, 0x8007000e
mov rcx, qword [rbp + 0x450]
xor rcx, rbp
call fcn.1800289d0
mov rbx, qword [rbp + 0x4a0]
lea rsp, [rbp + 0x460]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret