Function at 0x1400021b8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x490
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x490], rbx
mov rax, qword [0x14001d040]
xor rax, rbp
mov qword [rbp + 0x440], rax
mov qword [rbp], r9
mov r13, r8
mov r12, rdx
xor esi, esi
mov ebx, esi
mov qword [rbp + 8], rbx
mov qword [rbp + 0x28], rcx
mov qword [rbp + 0x20], rsi
mov qword [rbp + 0x30], rsi
test rdx, rdx
je 0x140002447
or rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], si
jne 0x140002213
inc eax
cdqe
lea r15, [rax + rax]
mov eax, 0x80000000
add rax, r15
mov ecx, 0xffffffff
cmp rax, rcx
ja 0x1400022dd
movsxd rdi, r15d
cmp r15d, 0x400
jg 0x140002278
mov rcx, rdi
call fcn.140001254
test al, al
je 0x140002278
lea rax, [rdi + 0xf]
cmp rax, rdi
ja 0x140002265
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.1400129e0
sub rsp, rax
lea r14, [rsp + 0x40]
jmp 0x1400022a5
mov rax, rdi
not rax
cmp rax, 0x10
jb 0x14000249c
lea rcx, [rdi + 0x10]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
test rax, rax
je 0x1400022dd
mov qword [rax], rsi
mov rbx, rax
mov qword [rbp + 8], rax
lea r14, [rax + 0x10]
test r14, r14
je 0x1400022dd
mov byte [r14], sil
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r14
or r9d, 0xffffffff
mov r8, r12
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
neg eax
sbb rdi, rdi
and rdi, r14
jmp 0x1400022e0
mov rdi, rsi
test rdi, rdi
je 0x140002447
xor edx, edx
lea r8d, [rdx + 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov r14, rax
mov qword [rbp + 0x10], rax
test rax, rax
jne 0x14000232b
xor edx, edx
lea r8d, [rax + 2]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov r14, rax
mov qword [rbp + 0x10], rax
test rax, rax
jne 0x14000232b
call fcn.1400013dc
mov edi, eax
jmp 0x14000241c
mov r8, qword [rbp]
mov rdx, r13
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdi, rax
test rax, rax
jne 0x14000234d
call fcn.1400013dc
jmp 0x14000240b
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r15, rax
mov qword [rbp + 0x18], rax
test rax, rax
je 0x140002343
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [rbp], edi
lea eax, [rdi + 1]
cmp eax, edi
jae 0x140002387
mov edi, 0x8007000e
jmp 0x14000240d
mov ecx, eax
test eax, eax
jne 0x140002392
mov rcx, rsi
jmp 0x1400023a5
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 1
jb 0x1400024ab
cmp rcx, 0x400
jbe 0x1400023bc
mov rdx, rcx
lea rcx, [rbp + 0x30]
call fcn.140007ca0
jmp 0x1400023c4
lea rax, [rbp + 0x38]
mov qword [rbp + 0x30], rax
jmp 0x1400023d7
cmp qword [rbp + 0x30], rsi
je 0x14000237d
mov r9, rdi
mov r8, r15
mov rdx, rdi
mov rcx, qword [rbp + 0x30]
call fcn.140001314
mov rax, qword [rbp + 0x30]
mov byte [rdi + rax], sil
mov r8d, dword [rbp + 0x4b0]
mov rdx, qword [rbp + 0x30]
lea rcx, [rbp + 0x20]
call fcn.140003850
mov edi, eax
test r14, r14
je 0x14000241c
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rbp + 0x38]
cmp qword [rbp + 0x30], rax
je 0x140002430
lea rcx, [rbp + 0x30]
call fcn.1400077b4
nop
jmp 0x14000243e
mov rcx, rbx
mov rbx, qword [rbx]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test rbx, rbx
jne 0x140002432
mov eax, edi
jmp 0x140002473
lea rax, [rbp + 0x38]
cmp qword [rbp + 0x30], rax
je 0x14000245b
lea rcx, [rbp + 0x30]
call fcn.1400077b4
nop
jmp 0x140002469
mov rcx, rbx
mov rbx, qword [rbx]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test rbx, rbx
jne 0x14000245d
mov eax, 0x8007000e
mov rcx, qword [rbp + 0x440]
xor rcx, rbp
call fcn.140011250
mov rbx, qword [rbp + 0x490]
lea rsp, [rbp + 0x450]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80070216
call fcn.1400012f0
nop
jmp 0x1400024aa
nop
mov ecx, 0x80070216
call fcn.1400012f0
int3