Function at 0x180009b40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov edi, edx
mov rbx, rcx
mov rax, 0xffffffffffffffff
inc rax
cmp byte [r8 + rax], 0
jne 0x180009b56
lea rcx, [r8 - 1]
add rcx, rax
cmp rcx, r8
jbe 0x180009b7d
nop dword [rax]
cmp byte [rcx], 0x2e
je 0x180009b7d
dec rcx
cmp rcx, r8
ja 0x180009b70
inc rcx
lea rdx, [0x18006f2d0]
call fcn.18004a50c
test eax, eax
jne 0x180009c0f
mov rbx, qword [rbx + 0xc0]
lea r8, [0x18006f7e0]
mov rcx, rbx
movzx edx, di
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdi, rax
test rax, rax
je 0x180009c0f
mov rdx, rax
mov qword [rsp + 0x30], rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
cmp eax, 8
jb 0x180009be4
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
jne 0x180009bf6
mov rsi, qword [rsp + 0x30]
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov edx, esi
mov rcx, rax
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x180016bc0
mov rbx, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xf80]
mov eax, 0x1080
call fcn.18005cae0
sub rsp, rax
mov rax, qword [0x180078228]
xor rax, rsp
mov qword [rbp + 0xf78], rax
xor r13d, r13d
mov ebx, edx
mov qword [rsp + 0x70], r13
mov rdi, rcx
cmp edx, 8
jl 0x180017233
lea r8d, [r13 + 8]
mov dword [rbp + 0xf70], 0x474e5089
lea rdx, [rbp + 0xf70]
mov dword [rbp + 0xf74], 0xa1a0a0d
call fcn.1800365f0
test eax, eax
jne 0x180017233
mov qword [rbp - 0x68], rdi
mov dword [rbp - 0x60], ebx
call fcn.18001cda0
mov rbx, rax
test rax, rax
je 0x180016c9e
mov dword [rax + 0x15c], 0x8000
mov dword [rax + 0x4c0], 0x2000
or dword [rax + 0x160], 0x300000
mov qword [rax + 0x138], r13
lea rax, [0x180020190]
mov qword [rbx + 0x130], rax
cmp qword [rbx + 0x128], r13
je 0x180016c97
mov qword [rbx + 0x128], r13
mov qword [rbx + 0x2b8], r13
mov qword [rsp + 0x40], rbx
test rbx, rbx
je 0x180017233
mov rax, qword [rbx + 0x440]
test rax, rax
je 0x180016cc4
mov edx, 0x158
mov rcx, rbx
call rax
jmp 0x180016cce
mov ecx, 0x158
call fcn.180040888
mov rdi, rax
test rax, rax
je 0x180017227
xor edx, edx
mov r8d, 0x158
mov rcx, rax
call fcn.1800362d0
mov rcx, rbx
mov qword [rsp + 0x50], rdi
call fcn.18001ba50
mov rcx, rax
mov rdx, rsp
call fcn.18005cec0
mov rbx, qword [rsp + 0x40]
test eax, eax
je 0x180016d97
test rbx, rbx
je 0x180017233
xor edx, edx
mov rcx, rbx
call fcn.18001cf90
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.18001cf90
mov rcx, rbx
mov qword [rsp + 0x40], r13
call fcn.18001c8d0
lea rcx, [rbp - 0x50]
mov rdx, rbx
mov r8d, 0x540
call fcn.180035ec0
xor edx, edx
mov r8d, 0x540
mov rcx, rbx
call fcn.1800362d0
mov rax, qword [rbp + 0x3f8]
test rax, rax
je 0x180016d81
mov rdx, rbx
lea rcx, [rbp - 0x50]
call rax
lea rcx, [rbp - 0x50]
call fcn.18001bad0
jmp 0x180017233
mov rcx, rbx
call fcn.180040874
lea rcx, [rbp - 0x50]
call fcn.18001bad0
jmp 0x180017233
test rbx, rbx
je 0x180016dcc
lea rax, [rbp - 0x68]
mov qword [rbx + 0x138], rax
lea rax, [0x180016b50]
mov qword [rbx + 0x130], rax
cmp qword [rbx + 0x128], r13
je 0x180016dc5
mov qword [rbx + 0x128], r13
mov qword [rbx + 0x2b8], r13
mov rdi, qword [rsp + 0x50]
mov rcx, rbx
mov rdx, rdi
call fcn.18001bfc0
test rbx, rbx
je 0x180016e41
test rdi, rdi
je 0x180016e41
movzx edx, byte [rdi + 0x26]
movzx ecx, byte [rdi + 0x28]
movzx eax, byte [rdi + 0x27]
movzx r14d, byte [rdi + 0x24]
mov r12d, dword [rdi]
mov r9d, r14d
mov r15d, dword [rdi + 4]
mov r8d, r15d
movzx esi, byte [rdi + 0x25]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x28], ecx
mov dword [rbp - 0x80], edx
mov edx, r12d
mov dword [rbp - 0x78], ecx
mov rcx, rbx
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x5c], r15d
mov dword [rsp + 0x58], r14d
mov dword [rsp + 0x48], esi
mov dword [rbp - 0x7c], eax
mov dword [rsp + 0x20], esi
call fcn.18001f280
jmp 0x180016e54
mov esi, dword [rsp + 0x48]
mov r14d, dword [rsp + 0x58]
mov r15d, dword [rsp + 0x5c]
mov r12d, dword [rsp + 0x60]
cmp esi, 3
jne 0x180016e88
test rbx, rbx
je 0x180016e88
mov eax, dword [rbx + 0x160]
test al, 0x40
je 0x180016e74
bt eax, 0x16
jae 0x180017265
jmp 0x180016e88
bts eax, 0xe
or dword [rbx + 0x164], 0x2001000
mov dword [rbx + 0x160], eax
test esi, esi
jne 0x180016ec1
cmp r14d, 8
jge 0x180016ec1
test rbx, rbx
je 0x180016f04
mov eax, dword [rbx + 0x160]
test al, 0x40
je 0x180016ead
bt eax, 0x16
jae 0x18001726e
jmp 0x180016ec1
bts eax, 0xe
or dword [rbx + 0x164], 0x1000
mov dword [rbx + 0x160], eax
test rbx, rbx
je 0x180016f04
test rdi, rdi
je 0x180016f04
mov eax, dword [rdi + 8]
and eax, 0x10
je 0x180016f04
mov eax, dword [rbx + 0x160]
test al, 0x40
je 0x180016ee9
bt eax, 0x16
jae 0x180017277
jmp 0x180016efd
bts eax, 0xe
or dword [rbx + 0x164], 0x2001000
mov dword [rbx + 0x160], eax
or esi, 4
mov dword [rsp + 0x48], esi
cmp r14d, 0x10
jne 0x180016f39
test rbx, rbx
je 0x180016f39
mov eax, dword [rbx + 0x160]
test al, 0x40
je 0x180016f25
bt eax, 0x16
jae 0x180017280
jmp 0x180016f39
bts eax, 0xe
or dword [rbx + 0x164], 0x400
mov dword [rbx + 0x160], eax
cmp r14d, 8
jge 0x180016f5b
test rbx, rbx
je 0x180016f5b
cmp byte [rbx + 0x290], 8
jae 0x180016f5b
or dword [rbx + 0x164], 4
mov byte [rbx + 0x291], 8
test esi, 0xfffffffb
jne 0x180016fb8
test rbx, rbx
je 0x180016fb8
mov eax, dword [rbx + 0x160]
test al, 0x40
je 0x180016f7e
bt eax, 0x16
jae 0x180017289
jmp 0x180016fb8
bts eax, 0xe
mov dword [rbx + 0x160], eax
test al, 0x40
je 0x180016f98
bt eax, 0x16
jae 0x180017292
jmp 0x180016fa8
or dword [rbx + 0x164], 0x1000
mov dword [rbx + 0x160], eax
mov eax, dword [rbx + 0x164]
bts eax, 0xe
mov dword [rbx + 0x164], eax
test sil, 4
je 0x180016fcf
test rbx, rbx
je 0x180016fd7
or dword [rbx + 0x164], 0x20000
jmp 0x180016fd7
mov rcx, rbx
call fcn.18001bc10
mov rdi, qword [rsp + 0x70]
mov rsi, r13
test rdi, rdi
je 0x180016ff5
mov rax, qword [rdi]
mov r8d, r15d
mov edx, r12d
mov rcx, rdi
call qword [rax + 0x30]
jmp 0x180017028
lea rdx, [0x180081b0c]
mov ecx, 0x20
call fcn.180035218
mov qword [rbp - 0x70], rax
test rax, rax
je 0x180017020
mov r8d, r15d
mov edx, r12d
mov rcx, rax
call fcn.18000ca90
mov rsi, rax
mov rdi, rsi
mov qword [rsp + 0x70], rsi
test rdi, rdi
je 0x180017187
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
cmp eax, r12d
jne 0x180017187
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
cmp eax, r15d
jne 0x180017187
mov r14d, r15d
lea rcx, [r14*8]
call fcn.180040888
mov rdx, qword [rdi]
mov rcx, rdi
mov r13, rax
call qword [rdx + 8]
mov rdx, qword [rdi]
mov rcx, rdi
mov rsi, rax
call qword [rdx + 0x20]
test r15d, r15d
je 0x1800170a0
movsxd rdx, eax
mov rcx, r13
shl rdx, 2
mov eax, r14d
nop
mov qword [rcx], rsi
lea rcx, [rcx + 8]
add rsi, rdx
sub rax, 1
jne 0x180017090
mov rdx, r13
mov rcx, rbx
call fcn.18001c7f0
test rbx, rbx
je 0x18001712b
xor edx, edx
mov rcx, rbx
call fcn.18001cf90
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.18001cf90
mov rcx, rbx
mov qword [rsp + 0x40], 0
call fcn.18001c8d0
lea rcx, [rbp + 0x4f0]
mov rdx, rbx
mov r8d, 0x540
call fcn.180035ec0
xor edx, edx
mov r8d, 0x540
mov rcx, rbx
call fcn.1800362d0
mov rax, qword [rbp + 0x938]
test rax, rax
je 0x180017117
mov rdx, rbx
lea rcx, [rbp + 0x4f0]
call rax
jmp 0x18001711f
mov rcx, rbx
call fcn.180040874
lea rcx, [rbp + 0x4f0]
call fcn.18001bad0
test r15d, r15d
je 0x180017177
mov r9, r13
mov rdx, qword [r9]
mov r8d, r12d
test r12d, r12d
jle 0x18001716d
nop
movzx eax, byte [rdx + 1]
dec r8d
movzx ecx, byte [rdx]
lea rdx, [rdx + 4]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx - 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx - 1]
shl ecx, 8
or ecx, eax
mov dword [rdx - 4], ecx
test r8d, r8d
jg 0x180017140
add r9, 8
sub r14, 1
jne 0x180017133
mov rcx, r13
call fcn.180040874
mov rax, rdi
jmp 0x180017235
test rsi, rsi
je 0x180017199
mov rax, qword [rsi]
mov edx, 1
mov rcx, rsi
call qword [rax]
test rbx, rbx
je 0x180017233
xor edx, edx
mov rcx, rbx
call fcn.18001cf90
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.18001cf90
mov rcx, rbx
mov qword [rsp + 0x40], r13
call fcn.18001c8d0
lea rcx, [rbp + 0xa30]
mov rdx, rbx
mov r8d, 0x540
call fcn.180035ec0
xor edx, edx
mov r8d, 0x540
mov rcx, rbx
call fcn.1800362d0
mov rax, qword [rbp + 0xe78]
test rax, rax
je 0x180017211
mov rdx, rbx
lea rcx, [rbp + 0xa30]
call rax
lea rcx, [rbp + 0xa30]
call fcn.18001bad0
jmp 0x180017233
mov rcx, rbx
call fcn.180040874
lea rcx, [rbp + 0xa30]
call fcn.18001bad0
jmp 0x180017233
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.18001caf0
xor eax, eax
mov rcx, qword [rbp + 0xf78]
xor rcx, rsp
call fcn.180034520
lea r11, [rsp + 0x1080]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rcx, rbx
call fcn.18001ba20
int3
mov rcx, rbx
call fcn.18001ba20
int3
mov rcx, rbx
call fcn.18001ba20
int3
mov rcx, rbx
call fcn.18001ba20
int3
mov rcx, rbx
call fcn.18001ba20
int3
mov rcx, rbx
call fcn.18001ba20
int3