Function at 0x1400286f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx], 0
mov rax, rdx
mov rbx, rcx
jne 0x140028a0c
mov rdx, r8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
je 0x140028a0c
mov eax, 0x4d42
cmp word [rdi], ax
jne 0x140028a0c
mov r8d, dword [rdi + 0x12]
shl r8d, 2
mov dword [rbx + 0x24], r8d
movzx eax, word [rdi + 0x1c]
mov r9d, dword [rdi + 0x12]
imul eax, r9d
cdq
and edx, 7
add eax, edx
sar eax, 3
mov edx, eax
mov esi, eax
and edx, 0x80000003
jge 0x140028772
dec edx
or edx, 0xfffffffc
inc edx
test edx, edx
je 0x14002877f
mov ecx, 4
sub ecx, edx
add esi, ecx
mov dword [rbx + 0x18], r9d
mov eax, dword [rdi + 0x16]
mov dword [rbx + 0x1c], eax
movsxd rcx, r8d
mov dword [rbx + 0x20], 0x20
mov dword [rbx + 0x28], 0
movsxd rax, dword [rdi + 0x16]
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rbx], rax
test rax, rax
je 0x140028a0c
movzx eax, word [rdi + 0x1c]
cmp ax, 4
je 0x14002894a
cmp ax, 8
je 0x140028943
cmp ax, 0x10
je 0x1400287ef
cmp ax, 0x18
je 0x140028802
cmp ax, 0x20
jne 0x1400289ef
cmp dword [rdi + 0x1e], 3
jne 0x140028893
add rdi, 0x42
jmp 0x140028897
add rdi, 0x36
mov eax, dword [rbx + 0x1c]
xor r9d, r9d
test eax, eax
jle 0x1400289ef
nop dword [rax]
nop dword [rax + rax]
sub eax, r9d
xor r8d, r8d
dec eax
imul eax, esi
movsxd rdx, eax
mov eax, r9d
imul eax, dword [rbx + 0x24]
add rdx, rdi
cdqe
add rax, qword [rbx]
cmp dword [rbx + 0x18], r8d
jle 0x14002886b
movzx ecx, byte [rdx]
lea rdx, [rdx + 3]
mov byte [rax], cl
lea rax, [rax + 4]
movzx ecx, byte [rdx - 2]
inc r8d
mov byte [rax - 3], cl
movzx ecx, byte [rdx - 1]
mov byte [rax - 2], cl
mov byte [rax - 1], 0
cmp r8d, dword [rbx + 0x18]
jl 0x140028843
mov eax, dword [rbx + 0x1c]
inc r9d
cmp r9d, eax
jl 0x140028820
mov qword [rbx + 0x10], 0
mov eax, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
add rdi, 0x36
cmp ax, 0x18
je 0x140028806
cmp ax, 0x20
jne 0x1400289ef
mov eax, dword [rbx + 0x1c]
xor r9d, r9d
test eax, eax
jle 0x1400289ef
nop dword [rax]
sub eax, r9d
xor r8d, r8d
dec eax
imul eax, esi
movsxd rcx, eax
mov eax, r9d
imul eax, dword [rbx + 0x24]
add rcx, rdi
movsxd rdx, eax
add rdx, qword [rbx]
cmp dword [rbx + 0x18], r8d
jle 0x14002891b
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rcx]
inc r8d
mov byte [rdx], al
lea rdx, [rdx + 4]
movzx eax, byte [rcx + 1]
lea rcx, [rcx + 4]
mov byte [rdx - 3], al
movzx eax, byte [rcx - 2]
mov byte [rdx - 2], al
movzx eax, byte [rcx - 1]
mov byte [rdx - 1], al
cmp r8d, dword [rbx + 0x18]
jl 0x1400288f0
mov eax, dword [rbx + 0x1c]
inc r9d
cmp r9d, eax
jl 0x1400288c0
mov qword [rbx + 0x10], 0
mov eax, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov ecx, pe_nt_image_headers64
jmp 0x14002894f
mov ecx, InitCommonControls
mov eax, dword [rdi + 0x2e]
test eax, eax
cmovne ecx, eax
mov eax, dword [rbx + 0x1c]
xor r10d, r10d
lea r11d, [rcx*4]
add r11, 0x36
add r11, rdi
test eax, eax
jle 0x1400289ef
sub eax, r10d
xor r9d, r9d
dec eax
imul eax, esi
movsxd r8, eax
mov eax, r10d
imul eax, dword [rbx + 0x24]
add r8, r11
movsxd rdx, eax
add rdx, qword [rbx]
cmp dword [rbx + 0x18], r9d
jle 0x1400289e4
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r8]
lea rdx, [rdx + 4]
inc r9d
lea r8, [r8 + 1]
movzx ecx, byte [rdi + rax*4 + 0x38]
mov byte [rdx - 4], cl
movzx eax, byte [r8 - 1]
movzx ecx, byte [rdi + rax*4 + 0x37]
mov byte [rdx - 3], cl
movzx eax, byte [r8 - 1]
movzx ecx, byte [rdi + rax*4 + 0x36]
mov byte [rdx - 2], cl
movzx eax, byte [r8 - 1]
movzx ecx, byte [rdi + rax*4 + 0x39]
mov byte [rdx - 1], cl
cmp r9d, dword [rbx + 0x18]
jl 0x1400289a0
mov eax, dword [rbx + 0x1c]
inc r10d
cmp r10d, eax
jl 0x140028970
mov qword [rbx + 0x10], 0
mov eax, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret