Function at 0x140005570
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rdi
sub rsp, 0x58
mov rax, qword [0x140026050]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, rcx
mov rcx, qword [0x140027b00]
mov rbx, rdx
lea rax, [rcx + 0x70]
cmp rax, rdx
je 0x1400055ab
mov rcx, rax
call fcn.140001f80
mov rcx, qword [0x140027b00]
mov r8d, dword [rbx + 8]
mov dword [rsp + 0x30], r8d
test r8d, r8d
je 0x14000583f
dec r8d
je 0x140005846
dec r8d
je 0x140005836
dec r8d
je 0x14000563f
cmp r8d, 2
jne 0x14000586a
mov rdx, qword [rcx + 0x80]
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
call fcn.140003cb0
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], 5
mov qword [rsp + 0x38], rax
call qword [0x140027b20]
mov rcx, qword [0x140027af0]
mov rdx, rax
call qword [0x140027c18]
mov rcx, rax
call qword [0x140027b58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x14000586a
mov r8, qword [rcx + 0x80]
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x50], rsi
mov eax, dword [r8 + 8]
mov ebx, dword [r8 + 0xc]
cdq
and edx, 0xf
add eax, edx
sar eax, 4
lea ecx, [rax*2 + 2]
mov eax, ebx
imul eax, ecx
movsxd rcx, eax
call fcn.140008f58
mov r8, qword [0x140027b00]
lea ebp, [rbx - 1]
mov rcx, qword [r8 + 0x80]
xor edi, edi
xor r11d, r11d
mov r10, qword [rcx + 0x48]
mov rsi, rax
test ebp, ebp
js 0x1400057c9
xor edx, edx
xor ebx, ebx
mov rax, qword [r8 + 0x80]
mov r9d, dword [rax + 8]
test r9d, r9d
jle 0x1400057a8
nop word [rax + rax]
mov eax, dword [r10 + rdx*4]
inc r11d
inc rdx
test eax, eax
je 0x1400056d2
xor al, al
jmp 0x1400056d4
mov al, 1
cmp r9d, 7
jle 0x140005749
add al, al
xor ecx, ecx
cmp dword [r10 + rdx*4], ecx
sete cl
or cl, al
xor eax, eax
add cl, cl
cmp dword [r10 + rdx*4 + 4], eax
sete al
or al, cl
xor ecx, ecx
add al, al
cmp dword [r10 + rdx*4 + 8], ecx
sete cl
or cl, al
xor eax, eax
add cl, cl
cmp dword [r10 + rdx*4 + 0xc], eax
sete al
or al, cl
xor ecx, ecx
add al, al
cmp dword [r10 + rdx*4 + 0x10], ecx
sete cl
or cl, al
xor eax, eax
add cl, cl
cmp dword [r10 + rdx*4 + 0x14], eax
sete al
or al, cl
xor ecx, ecx
add al, al
cmp dword [r10 + rdx*4 + 0x18], ecx
sete cl
sub r9d, 7
add rdx, 7
or al, cl
add r11d, 7
jmp 0x14000578d
lea r8d, [r9 - 1]
test r8d, r8d
jle 0x140005780
add r11d, r8d
nop word [rax + rax]
mov ecx, dword [r10 + rdx*4]
add al, al
inc rdx
test ecx, ecx
je 0x140005771
xor ecx, ecx
jmp 0x140005776
mov ecx, 1
dec r8d
or al, cl
test r8d, r8d
jg 0x140005760
mov ecx, 8
sub ecx, r9d
shl al, cl
xor r9d, r9d
dec r9d
mov byte [rbx + rsi], al
inc edi
inc rbx
test r9d, r9d
jg 0x1400056c0
mov r8, qword [0x140027b00]
mov eax, edi
and eax, 0x80000001
jge 0x1400057b8
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
je 0x1400057c1
inc edi
inc rbx
dec ebp
jns 0x1400056a1
mov rax, qword [r8 + 0x80]
mov r9d, 1
mov qword [rsp + 0x20], rsi
mov edx, dword [rax + 0xc]
mov ecx, dword [rax + 8]
mov r8d, r9d
call qword [0x140027b18]
lea rcx, [rsp + 0x30]
mov rbx, rax
mov qword [rsp + 0x38], rax
call qword [0x140027b20]
mov rcx, qword [0x140027af0]
mov rdx, rax
call qword [0x140027c18]
mov rcx, rax
call qword [0x140027b58]
mov rcx, rbx
call qword [0x140027b58]
mov rcx, rsi
call fcn.14000873c
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x80]
jmp 0x14000586a
movsxd rax, dword [rcx + 0x7c]
mov qword [rsp + 0x38], rax
mov eax, dword [rcx + 0x3c]
mov dword [rsp + 0x34], eax
lea rcx, [rsp + 0x30]
call qword [0x140027b20]
mov rcx, qword [0x140027af0]
mov rdx, rax
call qword [0x140027c18]
mov rcx, rax
call qword [0x140027b58]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400073b0
add rsp, 0x58
pop rdi
pop rbx
ret