Function at 0x1800b8120
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov r11, rsp
push rdi
push r14
push r15
sub rsp, 0x80
mov qword [r11 - 0x58], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rax, qword [0x1801c1080]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, rcx
xor r15d, r15d
mov dword [r11 - 0x78], r15d
cmp qword [rcx + 0x28], r15
jne 0x1800b83c6
mov eax, dword [rcx + 0x1bc]
test eax, eax
jne 0x1800b8203
cmp word [rcx + 0x1c8], r15w
je 0x1800b83c6
mov ecx, 0x268
call fcn.18010280c
mov rsi, rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], r15w
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rbx + r8*2 + 0x1c8], 0
jne 0x1800b81b0
lea rdx, [rbx + 0x1c8]
lea rcx, [rsp + 0x50]
call fcn.18004f440
nop
mov dword [rsp + 0x20], 1
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.1800b93b0
nop
lea rcx, [rbx + 0x20]
mov rdx, rax
call fcn.1800662a0
nop
lea rcx, [rsp + 0x50]
call fcn.18004f5d0
jmp 0x1800b83c6
cmp eax, 1
jne 0x1800b835d
mov rcx, qword [rcx + 0x1c8]
test rcx, rcx
je 0x1800b83c6
lea r8, [rbx + 0x1d4]
movzx edx, word [rbx + 0x1d0]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x1800b83c6
mov rdx, rax
mov rcx, qword [rbx + 0x1c8]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov rdx, rdi
mov rcx, qword [rbx + 0x1c8]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbp, rax
mov qword [rsp + 0x38], rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
test rax, rax
je 0x1800b8352
mov edi, esi
mov edx, esi
mov ecx, 0x42
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rsi, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x1800b82b2
mov r8d, edi
mov rdx, r14
mov rcx, rax
call fcn.180109540
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
test rsi, rsi
je 0x1800b8352
mov ecx, 0x60
call fcn.18010280c
mov rdi, rax
mov qword [rsp + 0x48], rax
lea rax, vtable.CSmartObjectImpl_class_IDBFile_.0
mov qword [rdi], rax
mov dword [rdi + 8], r15d
lea rax, vtable.CDBMemFile.0
mov qword [rdi], rax
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], r15
mov dword [rdi + 0x20], r15d
mov qword [rdi + 0x30], r15
lea rax, vtable.CSmartPtr_class_IDBParser_.0
mov qword [rdi + 0x28], rax
lea rcx, [rdi + 0x38]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
nop
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x1800b8345
call qword [sym.imp.KERNEL32.dll_GlobalSize]
mov dword [rdi + 0x20], eax
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov qword [rdi + 0x18], rax
test rax, rax
je 0x1800b8345
mov edx, dword [rdi + 0x20]
cmp edx, 0x10
jle 0x1800b8345
lea r8, [rdi + 0x30]
mov rcx, rax
call fcn.1800bafa0
nop
lea rcx, [rbx + 0x20]
mov rdx, rdi
call fcn.1800662a0
nop
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x1800b83c6
cmp eax, 2
jne 0x1800b83c6
cmp word [rcx + 0x1c8], r15w
je 0x1800b83c6
mov qword [rsp + 0x30], r15
lea rax, vtable.CSmartPtr_class_CDBSharedMemFile_.0
mov qword [rsp + 0x28], rax
add rcx, 0x38
lea rdx, [rsp + 0x30]
call fcn.1800ba0a0
mov rdi, qword [rsp + 0x30]
mov qword [rsp + 0x30], r15
mov rcx, qword [rbx + 0x28]
call sym.cloudinputx64.dll_protected:_void___cdecl_boost::serialization::singleton_class_boost::serialization::extended_type_info_typeid_struct_weasel::CandidateInfo__::constructor_void____ptr64
test rax, rax
je 0x1800b83ac
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x10]
mov qword [rbx + 0x28], rdi
xor ecx, ecx
call sym.cloudinputx64.dll_protected:_void___cdecl_boost::serialization::singleton_class_boost::serialization::extended_type_info_typeid_struct_weasel::CandidateInfo__::constructor_void____ptr64
test rax, rax
je 0x1800b83c6
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x10]
nop
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1801027e0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret