Function at 0x14002fde0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
sub rsp, 0xa0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov rbp, r8
mov ebx, edx
mov rdi, rcx
mov rax, qword [r8]
lea rdx, str._Undef_
mov rcx, r8
call qword [rax + reloc.WS2_32.dll_htonl]
mov eax, ebx
shr eax, 4
inc eax
movzx edx, ax
mov r8d, 6
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x140030165
mov rdx, rax
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r12, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
and ebx, 0xf
jbe 0x14002fe82
mov edx, ebx
nop word [rax + rax]
movzx ecx, word [rdi]
inc ecx
movsxd rcx, ecx
lea rdi, [rdi + rcx*2]
sub rdx, 1
jne 0x14002fe70
movzx esi, word [rdi]
mov ecx, 8
call fcn.1400797fc
xor r13d, r13d
test rax, rax
je 0x14002fea1
lea rcx, [rsp + 0x28]
mov qword [rax], rcx
jmp 0x14002fea4
mov rax, r13
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], r13
xor r8d, r8d
movzx eax, si
inc eax
movsxd rdx, eax
lea rcx, [rsp + 0x28]
call fcn.14002bfc0
mov rbx, qword [rsp + 0x40]
cmp rbx, qword [rsp + 0x48]
jbe 0x14002fede
call fcn.1400796a8
mov rax, qword [rsp + 0x28]
test rax, rax
jne 0x14002fef2
call fcn.1400796a8
mov r11, r13
jmp 0x14002fef5
mov r11, qword [rax]
cmp rbx, qword [r11 + 0x20]
jb 0x14002ff00
call fcn.1400796a8
movzx esi, si
lea r8, [rsi + rsi]
lea rdx, [rdi + 2]
mov rcx, rbx
call fcn.14007ad70
mov rax, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
sub rax, rdx
sar rax, 1
cmp rsi, rax
jb 0x14002ff32
call fcn.1400796a8
mov rdx, qword [rsp + 0x40]
mov word [rdx + rsi*2], r13w
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeResource]
lea r12, vtable.UnicodeStringStorage.0
mov qword [rsp + 0x58], r12
mov ecx, 8
call fcn.1400797fc
test rax, rax
je 0x14002ff65
lea rcx, [rsp + 0x60]
mov qword [rax], rcx
jmp 0x14002ff68
mov rax, r13
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x78], r13
mov qword [rsp + 0x80], r13
mov qword [rsp + 0x88], r13
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x1400d1b20]
repne scasw ax, word [rdi]
not rcx
mov rdx, rcx
xor r8d, r8d
lea rcx, [rsp + 0x60]
call fcn.14002bfc0
mov rdx, qword [rsp + 0x80]
mov rdi, rdx
mov rbx, qword [rsp + 0x78]
sub rdi, rbx
sar rdi, 1
add rdi, rdi
cmp rbx, rdx
jbe 0x14002ffc8
call fcn.1400796a8
mov rax, qword [rsp + 0x60]
test rax, rax
jne 0x14002ffdc
call fcn.1400796a8
mov rdx, r13
jmp 0x14002ffdf
mov rdx, qword [rax]
cmp rbx, qword [rdx + 0x20]
jb 0x14002ffea
call fcn.1400796a8
mov r8, rdi
lea rdx, [0x1400d1b20]
mov rcx, rbx
call fcn.14007ad70
nop
mov rdi, qword [rsp + 0x40]
cmp rdi, qword [rsp + 0x48]
jbe 0x14003000e
call fcn.1400796a8
mov rax, qword [rsp + 0x28]
test rax, rax
jne 0x140030022
call fcn.1400796a8
mov rdx, r13
jmp 0x140030025
mov rdx, qword [rax]
cmp rdi, qword [rdx + 0x20]
jb 0x140030030
call fcn.1400796a8
lea rsi, [0x1400d1b20]
test rdi, rdi
cmovne rsi, rdi
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
mov rdx, rcx
xor r8d, r8d
lea rcx, [rsp + 0x60]
call fcn.14002bfc0
mov rdx, qword [rsp + 0x80]
mov rbx, rdx
mov rdi, qword [rsp + 0x78]
sub rbx, rdi
sar rbx, 1
add rbx, rbx
cmp rdi, rdx
jbe 0x140030080
call fcn.1400796a8
mov rax, qword [rsp + 0x60]
test rax, rax
jne 0x140030094
call fcn.1400796a8
mov rdx, r13
jmp 0x140030097
mov rdx, qword [rax]
cmp rdi, qword [rdx + 0x20]
jb 0x1400300a2
call fcn.1400796a8
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call fcn.14007ad70
mov rax, qword [rbp]
lea rdx, [0x1400d1b20]
mov rcx, rbp
call qword [rax + reloc.WS2_32.dll_htonl]
mov rdi, qword [rsp + 0x78]
cmp rdi, qword [rsp + 0x80]
jbe 0x1400300d5
call fcn.1400796a8
mov rax, qword [rsp + 0x60]
test rax, rax
jne 0x1400300e9
call fcn.1400796a8
mov rdx, r13
jmp 0x1400300ec
mov rdx, qword [rax]
cmp rdi, qword [rdx + 0x20]
jb 0x1400300f7
call fcn.1400796a8
mov rax, qword [rbp]
mov rdx, rdi
mov rcx, rbp
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov qword [rsp + 0x58], r12
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140030119
call fcn.140078e60
mov qword [rsp + 0x78], r13
mov qword [rsp + 0x80], r13
mov qword [rsp + 0x88], r13
mov rcx, qword [rsp + 0x60]
call fcn.140078e60
nop
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140030148
call fcn.140078e60
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], r13
mov rcx, qword [rsp + 0x28]
call fcn.140078e60
mov al, 1
jmp 0x140030167
mov al, 1
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret