Function at 0x140008604
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x480
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x480], rbx
mov rax, qword [0x140017008]
xor rax, rbp
mov qword [rbp + 0x430], rax
mov r13, r9
mov r12, r8
mov r15, rdx
xor esi, esi
mov ebx, esi
mov qword [rbp], rbx
mov qword [rbp + 0x10], rcx
mov qword [rbp + 8], rsi
mov qword [rbp + 0x20], rsi
test rdx, rdx
je 0x140008868
or rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], si
jne 0x14000865e
inc eax
cdqe
lea r14, [rax + rax]
mov eax, 0x80000000
add rax, r14
mov ecx, 0xffffffff
cmp rax, rcx
ja 0x140008729
movsxd rdi, r14d
cmp r14d, 0x400
jg 0x1400086c3
mov rcx, rdi
call fcn.140006ddc
test al, al
je 0x1400086c3
lea rax, [rdi + 0xf]
cmp rax, rdi
ja 0x1400086b0
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.14000f1e0
sub rsp, rax
lea rsi, [rsp + 0x40]
jmp 0x1400086f0
mov rax, rdi
not rax
cmp rax, 0x10
jb 0x1400088c8
lea rcx, [rdi + 0x10]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
test rax, rax
je 0x140008729
mov qword [rax], rsi
mov rbx, rax
mov qword [rbp], rax
lea rsi, [rax + 0x10]
xor eax, eax
test rsi, rsi
je 0x140008729
mov byte [rsi], al
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rsi
or r9d, 0xffffffff
mov r8, r15
xor edx, edx
lea ecx, [rax + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
neg eax
sbb rdi, rdi
and rdi, rsi
jmp 0x14000872c
mov rdi, rsi
test rdi, rdi
je 0x140008868
xor edx, edx
lea r8d, [rdx + 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
jne 0x14000876f
xor edx, edx
lea r8d, [rax + 2]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
jne 0x14000876f
call fcn.1400065dc
mov edi, eax
jmp 0x14000883d
mov r8, r13
mov rdx, r12
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdi, rax
test rax, rax
jne 0x140008790
call fcn.1400065dc
jmp 0x14000882c
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r14, rax
test rax, rax
je 0x140008786
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
lea ecx, [rdi + 1]
cmp ecx, eax
jae 0x1400087c0
mov edi, 0x8007000e
jmp 0x14000882e
test rcx, rcx
je 0x1400087d8
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 1
jb 0x1400088bd
cmp rcx, 0x400
jbe 0x1400087ef
mov rdx, rcx
lea rcx, [rbp + 0x20]
call fcn.1400065fc
jmp 0x1400087f7
lea rax, [rbp + 0x28]
mov qword [rbp + 0x20], rax
cmp qword [rbp + 0x20], 0
je 0x1400087b9
mov r9, rdi
mov r8, r14
mov rdx, rdi
mov rcx, qword [rbp + 0x20]
call fcn.1400067a4
mov rax, qword [rbp + 0x20]
mov byte [rdi + rax], 0
mov r8d, dword [rbp + 0x4a0]
mov rdx, qword [rbp + 0x20]
lea rcx, [rbp + 8]
call fcn.140008468
mov edi, eax
test rsi, rsi
je 0x14000883d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rbp + 0x28]
cmp qword [rbp + 0x20], rax
je 0x140008851
lea rcx, [rbp + 0x20]
call fcn.1400065b8
nop
jmp 0x14000885f
mov rcx, rbx
mov rbx, qword [rbx]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test rbx, rbx
jne 0x140008853
mov eax, edi
jmp 0x140008894
lea rax, [rbp + 0x28]
cmp qword [rbp + 0x20], rax
je 0x14000887c
lea rcx, [rbp + 0x20]
call fcn.1400065b8
nop
jmp 0x14000888a
mov rcx, rbx
mov rbx, qword [rbx]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test rbx, rbx
jne 0x14000887e
mov eax, 0x8007000e
mov rcx, qword [rbp + 0x430]
xor rcx, rbp
call fcn.14000e0a0
mov rbx, qword [rbp + 0x480]
lea rsp, [rbp + 0x440]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80070216
call fcn.1400074c0
int3
mov ecx, 0x80070216
call fcn.1400074c0
int3