Function at 0x140005da8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x290
mov rax, qword [0x140026110]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor ebx, ebx
mov word [rsp + 0x38], r8w
mov rbp, rdx
mov qword [rsp + 0x50], rdx
mov r15, rcx
mov byte [rsp + 0x30], bl
xor edx, edx
mov byte [rsp + 0x32], bl
lea r8d, [rbx + 2]
mov byte [rsp + 0x31], bl
mov rcx, rbp
mov edi, ebx
mov r13d, ebx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
nop dword [rax + rax]
lea r14d, [rbx + 1]
mov r12, rax
test rax, rax
je 0x140006460
xor r9d, r9d
lea edx, [rbx + 0x10]
mov r8d, r14d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x140006460
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadResource]
nop dword [rax + rax]
test rax, rax
je 0x140006460
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
nop dword [rax + rax]
mov rdx, rbx
mov rcx, r12
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
nop dword [rax + rax]
mov dword [rsp + 0x3c], eax
cmp eax, 0x5c
jae 0x140005e9f
mov r9d, eax
lea r8, str.Invalid_file_version__bad_size__d_._n
xor edx, edx
mov rcx, rbp
call fcn.1400038f0
jmp 0x140006475
xor ebx, ebx
test rsi, rsi
je 0x140006460
lea rdx, [0x14001a8d0]
mov ecx, eax
mov r14d, eax
call fcn.140016adc
mov qword [rsp + 0x58], rax
mov rdi, rax
test rax, rax
jne 0x140005ee6
lea r9, str.Out_of_memory
xor r8d, r8d
lea rdx, [0x14001a968]
lea ecx, [rbx + 4]
call fcn.140003930
jmp 0x140006478
mov r8, r14
mov rdx, rsi
mov rcx, rdi
call sub.msvcrt.dll_memcpy
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop dword [rax + rax]
mov r12, rbx
mov qword [rsp + 0x60], rbx
movzx ebx, word [rdi]
mov eax, 8
add eax, ebx
xor ebp, ebp
mov word [rdi], ax
lea eax, [rbx + 8]
mov dword [rsp + 0x34], eax
test ebx, ebx
je 0x140005f52
lea rdx, [0x14001c610]
lea rcx, [rdi + 6]
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x140005f5a
lea r9, [rdi + 6]
xor edx, edx
lea r8, str.Invalid_VERSION_resource__expected__VS_VERSION_INFO___found___s___n
lea rcx, [0x14001a968]
call fcn.1400038f0
mov bl, bpl
jmp 0x14000609b
mov eax, dword [rdi + 0x30]
lea rsi, [rdi + 0x5c]
shl rax, 0x20
sub ebx, 0x5c
mov qword [0x140026838], rax
mov dword [0x140026838], ebp
test ebx, ebx
jle 0x140005f52
lea rcx, [r14 + rdi]
mov qword [rsp + 0x40], rcx
lea rax, [rsi + 8]
cmp rax, rcx
ja 0x140006446
lea rcx, [rsi + 6]
lea rdx, [0x14001c750]
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x140005fca
movzx ecx, word [rsi]
mov eax, 0xfffc
add cx, 3
and cx, ax
je 0x140005f52
movzx eax, cx
sub ebx, eax
movzx eax, cx
mov rcx, qword [rsp + 0x40]
add rsi, rax
test ebx, ebx
jg 0x140005f82
jmp 0x140005f52
movzx ebp, word [rsi]
lea r8, str._04x
movzx r9d, word [rsp + 0x38]
lea rcx, [rsp + 0x68]
mov ebx, 8
lea eax, [rbx + rbp]
sub ebp, 0x24
mov word [rsi], ax
lea edx, [rbx - 3]
add rsi, 0x24
call fcn.140004328
mov rax, r14
sub rax, rsi
sub rax, rdi
sub rax, 0xa
cmp rax, rbx
jae 0x140006025
lea r8, str.Buffer_overflow_encountered_while_adding_checksum_to_version_resource._n
xor edx, edx
lea rcx, [0x14001a968]
call fcn.1400038f0
mov bl, r12b
jmp 0x14000609b
add word [rsi], bx
or r14, 0xffffffffffffffff
mov rax, qword [rsp + 0x68]
mov rbx, r14
mov qword [rsi + 6], rax
xor edx, edx
inc rbx
cmp word [rsi + rbx*2 + 6], dx
jne 0x14000603a
add bx, bx
mov eax, 0xfffc
add bx, 0xb
and rbx, rax
add rbx, rsi
jmp 0x140006095
lea rax, [rbx + 8]
cmp rax, qword [rsp + 0x40]
ja 0x14000600b
lea rdx, [0x14001c770]
lea rcx, [rbx + 6]
call sub.msvcrt.dll_wcscmp
xor edx, edx
test eax, eax
je 0x1400060ee
movzx ecx, word [rbx]
mov eax, 0xfffc
add cx, 3
and cx, ax
je 0x140006099
movzx eax, cx
sub ebp, eax
movzx eax, cx
add rbx, rax
test ebp, ebp
jg 0x140006058
mov bl, dl
test rdi, rdi
je 0x1400060a8
mov rcx, rdi
call sub.msvcrt.dll_free
test r13, r13
je 0x1400060b5
mov rcx, r13
call sub.msvcrt.dll_free
mov al, byte [rsp + 0x31]
and al, byte [rsp + 0x32]
test bl, al
setne al
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1400168f0
mov rbx, qword [rsp + 0x2e8]
add rsp, 0x290
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, dword [rsp + 0x34]
lea rdx, [0x14001a8d0]
mov ebp, ebx
sub ebp, edi
call fcn.140016adc
mov qword [rsp + 0x48], rax
mov r13, rax
test rax, rax
jne 0x14000612d
lea r9, str.Out_of_memory
xor r8d, r8d
lea rdx, [0x14001a968]
lea ecx, [rax + 4]
call fcn.140003930
jmp 0x140006020
mov r8d, dword [rsp + 0x34]
xor edx, edx
mov rcx, r13
call sub.msvcrt.dll_memset
cmp ebp, dword [rsp + 0x34]
jg 0x14000643a
mov r8d, ebp
mov rdx, rdi
mov rcx, r13
call sub.msvcrt.dll_memcpy
mov eax, 8
add word [rbx], ax
lea ecx, [rax - 4]
mov rax, r14
add word [rbx + 2], cx
xor ecx, ecx
inc rax
cmp word [rbx + rax*2 + 6], cx
jne 0x140006168
add ax, ax
mov ecx, 0xfffc
add ax, 0xb
and ax, cx
movzx r8d, ax
movzx eax, ax
add eax, ebp
mov dword [rsp + 0x40], eax
lea rsi, [r8 + rbx]
cmp eax, dword [rsp + 0x34]
ja 0x14000642e
mov eax, dword [rsp + 0x3c]
sub rax, rbx
add rax, rdi
cmp rax, r8
jb 0x14000642e
mov ecx, ebp
mov rdx, rbx
add rcx, r13
call sub.msvcrt.dll_memcpy
mov ebp, dword [rsp + 0x3c]
mov eax, edi
sub eax, esi
add eax, ebp
cmp eax, 2
jl 0x14000642e
mov edx, 0x2e
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_wcschr]
nop dword [rax + rax]
xor ebx, ebx
test rax, rax
je 0x140006495
movzx eax, word [rax + 2]
lea rcx, [rsp + 0x80]
sub ax, 0x61
lea r8, str._s.mui
mov r9, rsi
mov edx, 0x100
cmp ax, 0x19
jbe 0x14000621a
lea r8, str._s.MUI
call fcn.140004328
test eax, eax
js 0x140006495
lea rax, [rsp + 0x80]
mov r8, r14
inc r8
cmp word [rax + r8*2], bx
jne 0x140006232
mov ebx, dword [rsp + 0x40]
mov r9d, dword [rsp + 0x34]
mov ecx, ebx
lea rax, [rbx + 2]
lea rax, [rax + r8*2]
cmp rax, r9
ja 0x14000642e
lea r8, [r8*2 + 2]
add rcx, r13
lea rdx, [rsp + 0x80]
call sub.msvcrt.dll_memcpy
lea rcx, [rsp + 0x80]
mov rax, r14
xor edx, edx
inc rax
cmp word [rcx + rax*2], dx
jne 0x14000627d
lea ecx, [rbx + 2]
lea ecx, [rcx + rax*2]
inc r14
cmp word [rsi + r14*2], dx
jne 0x14000628c
mov ebx, dword [rsp + 0x34]
lea rdx, [r14 + 1]
lea rdx, [rsi + rdx*2]
mov eax, edi
sub eax, edx
add eax, ecx
add eax, ebp
cmp eax, ebx
jg 0x14000642e
mov r8, rbp
add rcx, r13
sub r8, rdx
add r8, rdi
call sub.msvcrt.dll_memcpy
movzx r9d, word [rsp + 0x38]
mov r8d, ebx
mov rdx, r13
call fcn.140005cb4
mov rdx, qword [rsp + 0x50]
mov rcx, r15
call fcn.140004f80
mov rcx, qword [r15 + 0x28]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
nop dword [rax + rax]
mov r8, r15
mov edx, 0x10
mov rcx, r15
mov qword [r15 + 0x30], rax
call fcn.140004b60
xor r8d, r8d
mov r14, rax
mov ebx, r8d
mov dword [rsp + 0x3c], ebx
mov rdx, qword [rax + 8]
mov rcx, qword [rax + 0x18]
sub rcx, rdx
sar rcx, 3
test ecx, ecx
je 0x1400063e1
mov edi, dword [rsp + 0x34]
mov r12, r13
mov r13d, ebx
mov r9, r15
mov rcx, r15
mov r8, qword [rdx + r13*8]
mov edx, 0x10
call fcn.140004bdc
xor r8d, r8d
mov rsi, rax
mov ebp, r8d
mov rdx, qword [rax + 8]
mov rcx, qword [rax + 0x18]
sub rcx, rdx
sar rcx, 1
test ecx, ecx
je 0x1400063b5
mov byte [rsp + 0x30], 1
mov rcx, qword [r15 + 0x30]
mov eax, ebp
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], r12
movzx r9d, word [rdx + rax*2]
mov edx, 0x10
mov rax, qword [r14 + 8]
mov r8, qword [rax + r13*8]
call qword [sym.imp.KERNEL32.dll_UpdateResourceW]
nop dword [rax + rax]
mov rdx, qword [rsi + 8]
test eax, eax
mov rax, qword [rsi + 0x18]
setne byte [rsp + 0x32]
sub rax, rdx
sar rax, 1
inc ebp
cmp ebp, eax
jb 0x140006369
mov ebx, dword [rsp + 0x3c]
mov rdx, qword [r14 + 8]
inc ebx
mov rax, qword [r14 + 0x18]
sub rax, rdx
mov dword [rsp + 0x3c], ebx
sar rax, 3
cmp ebx, eax
jb 0x140006332
mov rdi, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov r13, qword [rsp + 0x48]
mov rcx, qword [r15 + 8]
test rcx, rcx
je 0x1400063fc
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop dword [rax + rax]
xor eax, eax
mov qword [r15 + 8], rax
mov rcx, qword [r15 + 0x30]
call fcn.140011944
mov bl, byte [rsp + 0x30]
test eax, eax
setne al
mov byte [rsp + 0x31], al
test bl, bl
jne 0x14000609b
mov rcx, qword [r15 + 0x28]
lea r8, str.Does_not_contain_RT_VERSION_type._n
xor edx, edx
call fcn.1400038f0
jmp 0x140006478
lea r8, str.Buffer_overflow_in_UpdateVersion._n
jmp 0x140006012
lea r8, str.Buffer_overflow_in_the_UpdateVersion._n
jmp 0x140006012
lea r8, str.Buffer_overflow_encountered_while_adding_checksum_to_version_resource._n
xor edx, edx
lea rcx, [0x14001a968]
call fcn.1400038f0
jmp 0x140005f52
lea r9, str.No_version_resource._n
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.140003968
mov bl, dil
test r12, r12
je 0x14000609b
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop dword [rax + rax]
jmp 0x14000609b
jmp 0x14000609b