Function at 0x14012a950
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x140
mov qword [rsp + 0x130], 0xfffffffffffffffe
mov rdi, rdx
mov r13, rcx
xor r12b, r12b
mov rax, qword [rdx + 8]
movzx ecx, word [rax]
call fcn.1401651e0
mov rbx, rax
mov qword [rsp + 0x198], rax
test rax, rax
je 0x14012b48f
mov eax, dword [rdi + 0x10]
cmp eax, 1
jne 0x14012b45f
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
xor esi, esi
mov qword [rsp + 0x40], rsi
lea ecx, [rax + 0xf]
call fcn.14029806c
mov qword [rsp + 0x190], rax
test rax, rax
je 0x14012a9e6
lea rdx, [0x14032e818]
mov rcx, rax
call fcn.140127020
mov rbx, rax
jmp 0x14012a9e9
mov rbx, rsi
mov rax, qword [r13]
mov rcx, r13
call qword [rax]
mov r9, rbx
xor r8d, r8d
mov edx, dword [r13 + 0xb8]
mov rcx, rax
call qword [sym.imp.USER32.dll_PostMessageW]
lea rdi, [0x1403fe1b0]
cmp word [0x1403fe1b0], 0
jne 0x14012aa2a
mov r8d, 0x104
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
or rbx, 0xffffffffffffffff
nop
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x14012aa30
mov qword [rsp + 0x70], rsi
test ebx, ebx
jne 0x14012aa51
lea rax, [0x140323de0]
mov qword [rsp + 0x68], rax
jmp 0x14012aa76
mov edx, ebx
lea rcx, [rsp + 0x68]
call fcn.1401e9030
movsxd r9, ebx
mov eax, dword [rsp + 0x70]
inc eax
movsxd rdx, eax
mov r8, rdi
mov rcx, qword [rsp + 0x68]
call fcn.14029b4d8
mov edx, ebx
lea rcx, [rsp + 0x68]
call fcn.1401ea290
nop
lea rcx, [rsp + 0xb8]
call fcn.1400ed230
nop
mov qword [rsp + 0x60], rsi
mov edx, 0xf
lea rcx, [rsp + 0x58]
call fcn.1401e9030
mov eax, dword [rsp + 0x60]
inc eax
movsxd rdx, eax
mov r9d, 0xf
lea r8, [0x14032e878]
mov rcx, qword [rsp + 0x58]
call fcn.14029b4d8
mov edx, 0xf
lea rcx, [rsp + 0x58]
call fcn.1401ea290
nop
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0xf8]
call fcn.1400d1690
nop
cmp dword [rsp + 0x60], 0
jle 0x14012ab01
mov rcx, qword [rsp + 0x58]
call fcn.140298600
lea rax, vtable.Core::ByteArray.0
mov qword [rsp + 0xc8], rax
mov edi, esi
mov dword [rsp + 0xd0], esi
mov qword [rsp + 0xd8], rsi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xe0], rax
mov edx, 0x18d
xor ecx, ecx
lea r8d, [rcx + 0xa]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r14, rax
test rax, rax
je 0x14012ac19
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
movsxd rbx, eax
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r14, rax
test rax, rax
je 0x14012ac19
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r15, rax
test ebx, ebx
je 0x14012abb3
mov r8, rbx
mov edx, 8
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0xd8], rax
test rax, rax
je 0x14012abaf
mov edi, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x14012abb6
xor bl, bl
jmp 0x14012abcd
mov rax, rsi
test ebx, ebx
jle 0x14012abcb
mov r9, rbx
movsxd rdx, edi
mov r8, r15
mov rcx, rax
call fcn.140299fc8
mov bl, 1
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeResource]
test bl, bl
je 0x14012ac19
xor r9d, r9d
lea edx, [r9 + 2]
mov r8d, 0x40000000
lea rcx, [rsp + 0xf8]
call fcn.1401f2360
mov rbx, rax
test rax, rax
je 0x14012ac19
mov rax, qword [rax]
mov r8d, edi
mov rdx, qword [rsp + 0xd8]
mov rcx, rbx
call qword [rax + 0x48]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x20]
mov qword [rsp + 0x90], rsi
mov edx, 0x11
lea rcx, [rsp + 0x88]
call fcn.1401e9030
mov eax, dword [rsp + 0x90]
inc eax
movsxd rdx, eax
mov r9d, 0x11
lea r8, str.HitmanPro_x64.exe
mov rcx, qword [rsp + 0x88]
call fcn.14029b4d8
mov edx, 0x11
lea rcx, [rsp + 0x88]
call fcn.1401ea290
nop
mov qword [rsp + 0x80], rsi
mov edx, 0xd
lea rcx, [rsp + 0x78]
call fcn.1401e9030
mov eax, dword [rsp + 0x80]
inc eax
movsxd rdx, eax
mov r9d, 0xd
lea r8, str.HitmanPro.exe
mov rcx, qword [rsp + 0x78]
call fcn.14029b4d8
mov edx, 0xd
lea rcx, [rsp + 0x78]
call fcn.1401ea290
nop
mov qword [rsp + 0xa0], rsi
mov edx, 0xd
lea rcx, [rsp + 0x98]
call fcn.1401e9030
mov eax, dword [rsp + 0xa0]
inc eax
movsxd rdx, eax
mov r9d, 0xd
lea r8, str.HitmanPro.exe
mov rcx, qword [rsp + 0x98]
call fcn.14029b4d8
mov edx, 0xd
lea rcx, [rsp + 0x98]
call fcn.1401ea290
nop
lea r8, [rsp + 0x98]
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0xe8]
call fcn.1400d1690
nop
cmp dword [rsp + 0xa0], 0
jle 0x14012ad3e
mov rcx, qword [rsp + 0x98]
call fcn.140298600
mov ecx, 0x90
call fcn.14029806c
test rax, rax
je 0x14012ad5a
mov rcx, rax
call fcn.1401f28d0
mov rbx, rax
jmp 0x14012ad5d
mov rbx, rsi
mov qword [rsp + 0x58], rbx
lea rax, vtable.Core::SharedPtr_class_Core::Net::WebClient_.0
mov qword [rsp + 0x108], rax
mov qword [rsp + 0x110], rbx
mov r15, rsi
mov qword [rsp + 0x118], rsi
test rbx, rbx
je 0x14012adb9
mov ecx, 4
call fcn.14029806c
mov r15, rax
test rax, rax
je 0x14012ada7
mov dword [rax], esi
mov qword [rsp + 0x118], rax
jmp 0x14012adb2
mov r15, rsi
mov qword [rsp + 0x118], rsi
mov dword [r15], 1
mov ecx, 0x18
call fcn.14029806c
test rax, rax
je 0x14012ade3
lea rcx, vtable.DelegateCall_Member_class_HitmanPro35::UI::KickstartPanel__void____ptr64__class_Core::DownloadProgressChangedEventArgs____ptr64_.0
mov qword [rax], rcx
mov qword [rax + 8], r13
lea rcx, [0x14012b530]
mov qword [rax + 0x10], rcx
jmp 0x14012ade6
mov rax, rsi
mov qword [rsp + 0x190], rax
lea rcx, [rbx + 0x18]
mov rax, qword [rcx]
lea rdx, [rsp + 0x190]
call qword [rax]
mov ecx, 0x18
call fcn.14029806c
test rax, rax
je 0x14012ae29
lea rcx, vtable.DelegateCall_Member_class_HitmanPro35::UI::KickstartPanel__void____ptr64__class_Core::AsyncCompletedEventArgs____ptr64_.0
mov qword [rax], rcx
mov qword [rax + 8], r13
lea rcx, [0x14012b5a0]
mov qword [rax + 0x10], rcx
jmp 0x14012ae2c
mov rax, rsi
mov qword [rsp + 0x190], rax
lea rcx, [rbx + 0x48]
mov rax, qword [rcx]
lea rdx, [rsp + 0x190]
call qword [rax]
mov dword [rsp + 0xa8], esi
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0x50], rsi
mov edx, 0x27
lea rcx, [rsp + 0x48]
call fcn.1401e9030
mov eax, dword [rsp + 0x50]
inc eax
movsxd rdx, eax
mov r9d, 0x27
lea r8, str.http:__files.surfright.nl_HitmanPro.exe
mov rcx, qword [rsp + 0x48]
call fcn.14029b4d8
mov edx, 0x27
lea rcx, [rsp + 0x48]
call fcn.1401ea290
nop
lea r9, [rsp + 0xa8]
lea r8, [rsp + 0xe8]
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.1401f2d90
nop
cmp dword [rsp + 0x50], 0
jle 0x14012aed9
mov rcx, qword [rsp + 0x48]
call fcn.140298600
or edx, 0xffffffff
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [rsp + 0xa8], 0
je 0x14012b343
mov rdi, qword [0x1403fd770]
test rdi, rdi
je 0x14012b0e0
cmp qword [rdi + 8], 0
je 0x14012b0e0
lea rcx, [rdi + 0x10]
call fcn.1401f2230
test al, al
je 0x14012b0e0
lea rdx, [rdi + 0x10]
lea rcx, [rsp + 0x48]
call fcn.1400d2fb0
nop
mov ecx, 0x18
call fcn.14029806c
test rax, rax
je 0x14012af5b
mov r9b, 1
mov r8, qword [rsp + 0x48]
mov rdx, qword [rdi + 0x10]
mov rcx, rax
call fcn.140128ac0
mov r14, rax
jmp 0x14012af5e
mov r14, rsi
lea rcx, [rsp + 0x30]
call fcn.1400bae00
mov rbx, qword [rsp + 0x38]
test rbx, rbx
je 0x14012af75
mov qword [rbx], r14
add rbx, 8
mov qword [rsp + 0x38], rbx
mov rax, qword [rdi + 8]
test rax, rax
je 0x14012b0c8
test byte [rax + 0x18], 8
je 0x14012b0c8
lea r14, [rdi + 0x20]
mov rcx, r14
call fcn.1401f2230
test al, al
je 0x14012b0c8
mov rdx, r14
lea rcx, [rsp + 0x120]
call fcn.1400d2fb0
mov rdi, rax
mov edx, dword [rax + 0xc]
lea rcx, [rsp + 0x48]
call fcn.1401e9030
movsxd r9, dword [rdi + 0xc]
mov eax, dword [rsp + 0x50]
inc eax
movsxd rdx, eax
mov r8, qword [rdi]
mov rcx, qword [rsp + 0x48]
call fcn.14029b4d8
mov edx, dword [rdi + 0xc]
lea rcx, [rsp + 0x48]
call fcn.1401ea290
nop
cmp dword [rsp + 0x128], 0
jle 0x14012b008
mov rcx, qword [rsp + 0x120]
call fcn.140298600
mov ecx, 0x18
call fcn.14029806c
test rax, rax
je 0x14012b02f
mov r9b, 1
mov r8, qword [rsp + 0x48]
mov rdx, qword [r14]
mov rcx, rax
call fcn.140128ac0
mov r14, rax
jmp 0x14012b032
mov r14, rsi
mov qword [rsp + 0x190], r14
lea rax, [rsp + 0x190]
mov rdi, qword [rsp + 0x30]
cmp rax, rbx
jae 0x14012b09a
lea rax, [rsp + 0x190]
cmp rdi, rax
ja 0x14012b09a
lea r14, [rsp + 0x190]
sub r14, rdi
sar r14, 3
cmp rbx, qword [rsp + 0x40]
jne 0x14012b083
lea rcx, [rsp + 0x30]
call fcn.1400bae00
mov rbx, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x30]
test rbx, rbx
je 0x14012b08f
mov rax, qword [rdi + r14*8]
mov qword [rbx], rax
add rbx, 8
mov qword [rsp + 0x38], rbx
jmp 0x14012b0cd
cmp rbx, qword [rsp + 0x40]
jne 0x14012b0b5
lea rcx, [rsp + 0x30]
call fcn.1400bae00
mov rbx, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x30]
test rbx, rbx
je 0x14012b0bd
mov qword [rbx], r14
add rbx, 8
mov qword [rsp + 0x38], rbx
jmp 0x14012b0cd
mov rdi, qword [rsp + 0x30]
cmp dword [rsp + 0x50], 0
jle 0x14012b0ea
mov rcx, qword [rsp + 0x48]
call fcn.140298600
jmp 0x14012b0ea
mov rbx, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x30]
mov ecx, 0x18
call fcn.14029806c
test rax, rax
je 0x14012b116
xor r9d, r9d
mov r8, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x68]
mov rcx, rax
call fcn.140128ac0
mov r14, rax
jmp 0x14012b119
mov r14, rsi
mov qword [rsp + 0x190], r14
lea rax, [rsp + 0x190]
cmp rax, rbx
jae 0x14012b173
lea rax, [rsp + 0x190]
cmp rdi, rax
ja 0x14012b173
lea r14, [rsp + 0x190]
sub r14, rdi
sar r14, 3
cmp rbx, qword [rsp + 0x40]
jne 0x14012b165
lea rcx, [rsp + 0x30]
call fcn.1400bae00
mov rbx, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x30]
test rbx, rbx
je 0x14012b196
mov rax, qword [rdi + r14*8]
mov qword [rbx], rax
jmp 0x14012b196
cmp rbx, qword [rsp + 0x40]
jne 0x14012b18e
lea rcx, [rsp + 0x30]
call fcn.1400bae00
mov rbx, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x30]
test rbx, rbx
je 0x14012b196
mov qword [rbx], r14
add rbx, 8
mov qword [rsp + 0x38], rbx
mov ecx, 0x18
call fcn.14029806c
test rax, rax
je 0x14012b1cb
xor r9d, r9d
mov r8, qword [rsp + 0x78]
mov rdx, qword [rsp + 0xe8]
mov rcx, rax
call fcn.140128ac0
mov r14, rax
jmp 0x14012b1ce
mov r14, rsi
mov qword [rsp + 0x190], r14
lea rax, [rsp + 0x190]
cmp rax, rbx
jae 0x14012b228
lea rax, [rsp + 0x190]
cmp rdi, rax
ja 0x14012b228
lea r14, [rsp + 0x190]
sub r14, rdi
sar r14, 3
cmp rbx, qword [rsp + 0x40]
jne 0x14012b21a
lea rcx, [rsp + 0x30]
call fcn.1400bae00
mov rbx, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x30]
test rbx, rbx
je 0x14012b24b
mov rax, qword [rdi + r14*8]
mov qword [rbx], rax
jmp 0x14012b24b
cmp rbx, qword [rsp + 0x40]
jne 0x14012b243
lea rcx, [rsp + 0x30]
call fcn.1400bae00
mov rbx, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x30]
test rbx, rbx
je 0x14012b24b
mov qword [rbx], r14
add rbx, 8
mov qword [rsp + 0x38], rbx
mov ecx, 0x18
call fcn.14029806c
mov r14, rax
test rax, rax
je 0x14012b28d
mov rcx, qword [rsp + 0xf8]
call fcn.14029ab7c
mov qword [r14], rax
lea rcx, [0x14032e878]
call fcn.14029ab7c
mov qword [r14 + 8], rax
mov byte [r14 + 0x10], 0
jmp 0x14012b290
mov r14, rsi
mov qword [rsp + 0x190], r14
lea rax, [rsp + 0x190]
cmp rax, rbx
jae 0x14012b2ea
lea rax, [rsp + 0x190]
cmp rdi, rax
ja 0x14012b2ea
lea r14, [rsp + 0x190]
sub r14, rdi
sar r14, 3
cmp rbx, qword [rsp + 0x40]
jne 0x14012b2dc
lea rcx, [rsp + 0x30]
call fcn.1400bae00
mov rbx, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x30]
test rbx, rbx
je 0x14012b308
mov rax, qword [rdi + r14*8]
mov qword [rbx], rax
jmp 0x14012b308
cmp rbx, qword [rsp + 0x40]
jne 0x14012b300
lea rcx, [rsp + 0x30]
call fcn.1400bae00
mov rbx, qword [rsp + 0x38]
test rbx, rbx
je 0x14012b308
mov qword [rbx], r14
add rbx, 8
mov qword [rsp + 0x38], rbx
mov rax, qword [r13]
mov rcx, r13
call qword [rax]
mov r9, rax
mov eax, dword [r13 + 0xb8]
mov dword [rsp + 0x20], eax
lea r8, [rsp + 0x30]
mov rcx, qword [rsp + 0x198]
call fcn.140127410
movzx r12d, al
mov rbx, qword [rsp + 0x58]
test r15, r15
je 0x14012b375
mov eax, dword [r15]
test eax, eax
jle 0x14012b354
dec eax
mov dword [r15], eax
cmp dword [r15], 0
jne 0x14012b375
test rbx, rbx
je 0x14012b36c
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
mov rcx, r15
call fcn.1402012c0
nop
cmp dword [rsp + 0xf0], 0
jle 0x14012b38d
mov rcx, qword [rsp + 0xe8]
call fcn.140298600
nop
cmp dword [rsp + 0x80], 0
jle 0x14012b3a2
mov rcx, qword [rsp + 0x78]
call fcn.140298600
nop
cmp dword [rsp + 0x90], 0
jle 0x14012b3ba
mov rcx, qword [rsp + 0x88]
call fcn.140298600
nop
mov rax, qword [rsp + 0xd8]
test rax, rax
je 0x14012b3db
mov r8, rax
xor edx, edx
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
cmp dword [rsp + 0x100], 0
jle 0x14012b3f3
mov rcx, qword [rsp + 0xf8]
call fcn.140298600
nop
cmp dword [rsp + 0xc0], 0
jle 0x14012b40b
mov rcx, qword [rsp + 0xb8]
call fcn.140298600
nop
cmp dword [rsp + 0x70], 0
jle 0x14012b41d
mov rcx, qword [rsp + 0x68]
call fcn.140298600
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14012b42d
call fcn.1402012c0
nop
mov rbx, qword [rsp + 0x198]
mov rdi, qword [rsp + 0x188]
jmp 0x14012b480
cmp eax, 2
jne 0x14012b47b
mov rax, qword [r13]
mov rcx, r13
call qword [rax]
mov rcx, rbx
call fcn.140127c60
movzx r12d, al
jmp 0x14012b47e
xor r12b, r12b
xor esi, esi
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
jmp 0x14012b491
xor esi, esi
mov ecx, 0x10
call fcn.14029806c
mov qword [rsp + 0x188], rax
test rax, rax
je 0x14012b4b9
movzx edx, r12b
mov rcx, rax
call fcn.140127310
mov rbx, rax
jmp 0x14012b4bc
mov rbx, rsi
mov rax, qword [r13]
mov rcx, r13
call qword [rax]
mov rcx, rax
mov r9, rbx
xor r8d, r8d
mov edx, dword [r13 + 0xb8]
call qword [sym.imp.USER32.dll_PostMessageW]
movsxd rbx, dword [rdi + 0x10]
test r12b, r12b
setne sil
mov rax, qword [r13]
mov rcx, r13
call qword [rax]
mov rcx, rax
mov r9, rbx
mov r8, rsi
mov edx, dword [r13 + 0xbc]
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, qword [r13 + 0xb0]
add rsp, 0x140
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
jmp qword [sym.imp.KERNEL32.dll_SetEvent]