Function at 0x18000cc60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x490
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x490], rbx
mov rax, qword [0x1800ccee8]
xor rax, rbp
mov qword [rbp + 0x440], rax
mov r12, r9
mov r15, r8
mov rsi, rdx
xor r13d, r13d
mov ebx, r13d
mov qword [rbp + 8], rbx
mov qword [rbp + 0x28], rcx
mov qword [rbp + 0x20], r13
mov qword [rbp + 0x30], r13
test rdx, rdx
je 0x18000cf05
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rdx + rax*2], 0
jne 0x18000ccc0
inc eax
cdqe
lea r14, [rax + rax]
mov eax, 0x80000000
add rax, r14
mov ecx, 0xffffffff
cmp rax, rcx
ja 0x18000cd8a
movsxd rdi, r14d
cmp r14d, 0x400
jg 0x18000cd26
mov rcx, rdi
call fcn.180010f10
test al, al
je 0x18000cd26
lea rax, [rdi + 0xf]
cmp rax, rdi
ja 0x18000cd13
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.180014130
sub rsp, rax
lea rdi, [rsp + 0x40]
jmp 0x18000cd52
mov rax, rdi
not rax
cmp rax, 0x10
jb 0x18000cf5e
lea rcx, [rdi + 0x10]
call fcn.1800246e8
test rax, rax
je 0x18000cd8a
mov qword [rax], r13
mov rbx, rax
mov qword [rbp + 8], rax
lea rdi, [rax + 0x10]
test rdi, rdi
je 0x18000cd8a
mov byte [rdi], 0
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rdi
mov r9d, 0xffffffff
mov r8, rsi
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
cmove rdi, r13
jmp 0x18000cd8d
mov rdi, r13
test rdi, rdi
je 0x18000cf05
xor edx, edx
lea r8d, [rdx + 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
mov qword [rbp + 0x10], rax
test rax, rax
jne 0x18000cdd8
xor edx, edx
lea r8d, [rax + 2]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
mov qword [rbp + 0x10], rax
test rax, rax
jne 0x18000cdd8
call fcn.1800037d0
mov edi, eax
jmp 0x18000ced8
mov r8, r12
mov rdx, r15
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdi, rax
test rax, rax
jne 0x18000cdf9
call fcn.1800037d0
jmp 0x18000cec7
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r14, rax
mov qword [rbp + 0x18], rax
test rax, rax
jne 0x18000ce1b
call fcn.1800037d0
jmp 0x18000cec7
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [rbp], edi
lea eax, [rdi + 1]
cmp eax, edi
jae 0x18000ce3d
mov edi, 0x8007000e
jmp 0x18000cec9
mov ecx, eax
test eax, eax
je 0x18000ce70
xor edx, edx
mov rax, 0xffffffffffffffff
div rcx
cmp rax, 1
jb 0x18000cf69
cmp rcx, 0x400
jbe 0x18000ce70
mov rdx, rcx
lea rcx, [rbp + 0x30]
call fcn.1800035e0
jmp 0x18000ce78
lea rax, [rbp + 0x38]
mov qword [rbp + 0x30], rax
jmp 0x18000ce89
cmp qword [rbp + 0x30], 0
jne 0x18000ce97
mov edi, 0x8007000e
jmp 0x18000cec9
test rdi, rdi
je 0x18000ceab
mov r8, rdi
mov rdx, r14
mov rcx, qword [rbp + 0x30]
call fcn.180016390
mov rax, qword [rbp + 0x30]
mov byte [rdi + rax], 0
mov r8d, dword [rbp + 0x4b0]
mov rdx, qword [rbp + 0x30]
lea rcx, [rbp + 0x20]
call fcn.18000c800
mov edi, eax
test rsi, rsi
je 0x18000ced8
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rbp + 0x38]
cmp qword [rbp + 0x30], rax
je 0x18000ceec
lea rcx, [rbp + 0x30]
call fcn.180006d40
nop
test rbx, rbx
je 0x18000cf01
mov rcx, rbx
mov rbx, qword [rbx]
call fcn.1800246d4
test rbx, rbx
jne 0x18000cef1
mov eax, edi
jmp 0x18000cf35
lea rax, [rbp + 0x38]
cmp qword [rbp + 0x30], rax
je 0x18000cf19
lea rcx, [rbp + 0x30]
call fcn.180006d40
nop
test rbx, rbx
je 0x18000cf30
nop
mov rcx, rbx
mov rbx, qword [rbx]
call fcn.1800246d4
test rbx, rbx
jne 0x18000cf20
mov eax, 0x8007000e
mov rcx, qword [rbp + 0x440]
xor rcx, rbp
call fcn.180014190
mov rbx, qword [rbp + 0x490]
lea rsp, [rbp + 0x450]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80070216
call fcn.1800038b0
nop
mov ecx, 0x80070216
call fcn.1800038b0
int3