Function at 0x140002354
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4a0
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x30], 0xfffffffffffffffe
mov qword [rbp + 0x4a0], rbx
mov rax, qword [0x140026008]
xor rax, rbp
mov qword [rbp + 0x450], rax
mov r13, r9
mov r12, r8
mov r15, rdx
xor esi, esi
mov ebx, esi
mov qword [rbp + 8], rbx
mov qword [rbp + 0x28], rcx
mov qword [rbp + 0x20], rsi
mov qword [rbp + 0x40], rsi
test rdx, rdx
je 0x1400025f4
or rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], si
jne 0x1400023b6
inc eax
movsxd rdi, eax
add rdi, rdi
mov eax, 0x80000000
add rax, rdi
mov ecx, 0xffffffff
cmp rax, rcx
ja 0x140002480
cmp edi, 0x400
jg 0x14000241a
movsxd r14, edi
mov rcx, r14
call fcn.1400015b4
test al, al
je 0x14000241a
lea rax, [r14 + 0xf]
cmp rax, r14
ja 0x140002407
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.1400189e0
sub rsp, rax
lea r14, [rsp + 0x40]
jmp 0x140002449
movsxd rcx, edi
mov rax, rcx
not rax
cmp rax, 0x10
jb 0x1400025e9
add rcx, 0x10
call fcn.14000d8dc
test rax, rax
je 0x140002480
mov qword [rax], rsi
mov rbx, rax
mov qword [rbp + 8], rax
lea r14, [rax + 0x10]
test r14, r14
je 0x140002480
mov byte [r14], sil
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], r14
or r9d, 0xffffffff
mov r8, r15
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
neg eax
sbb rdi, rdi
and rdi, r14
jmp 0x140002483
mov rdi, rsi
test rdi, rdi
je 0x1400025f4
xor edx, edx
lea r8d, [rdx + 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov r14, rax
mov qword [rbp + 0x10], rax
test rax, rax
jne 0x1400024ce
xor edx, edx
lea r8d, [rax + 2]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov r14, rax
mov qword [rbp + 0x10], rax
test rax, rax
jne 0x1400024ce
call fcn.140001794
mov edi, eax
jmp 0x1400025bf
mov r8, r13
mov rdx, r12
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdi, rax
test rax, rax
jne 0x1400024ef
call fcn.140001794
jmp 0x1400025ae
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r15, rax
mov qword [rbp + 0x18], rax
test rax, rax
je 0x1400024e5
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [rbp], edi
lea eax, [rdi + 1]
cmp eax, edi
jae 0x140002529
mov edi, 0x8007000e
jmp 0x1400025b0
mov ecx, eax
test eax, eax
je 0x14000255f
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 1
jae 0x140002548
mov ecx, 0x80070216
call fcn.1400016ec
cmp rcx, 0x400
jbe 0x14000255f
mov rdx, rcx
lea rcx, [rbp + 0x40]
call fcn.14000683c
jmp 0x140002567
lea rax, [rbp + 0x48]
mov qword [rbp + 0x40], rax
jmp 0x14000257a
cmp qword [rbp + 0x40], rsi
je 0x14000251f
mov r9, rdi
mov r8, r15
mov rdx, rdi
mov rcx, qword [rbp + 0x40]
call fcn.140001708
mov rax, qword [rbp + 0x40]
mov byte [rdi + rax], sil
mov r8d, dword [rbp + 0x4c0]
mov rdx, qword [rbp + 0x40]
lea rcx, [rbp + 0x20]
call fcn.1400039b4
mov edi, eax
test r14, r14
je 0x1400025bf
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rbp + 0x48]
cmp qword [rbp + 0x40], rax
je 0x1400025d3
lea rcx, [rbp + 0x40]
call fcn.140006834
nop
jmp 0x1400025e0
mov rcx, rbx
mov rbx, qword [rbx]
call fcn.14000d7bc
test rbx, rbx
jne 0x1400025d5
mov eax, edi
jmp 0x14000261f
mov ecx, 0x80070216
call fcn.1400016ec
nop
lea rax, [rbp + 0x48]
cmp qword [rbp + 0x40], rax
je 0x140002608
lea rcx, [rbp + 0x40]
call fcn.140006834
nop
jmp 0x140002615
mov rcx, rbx
mov rbx, qword [rbx]
call fcn.14000d7bc
test rbx, rbx
jne 0x14000260a
mov eax, 0x8007000e
mov rcx, qword [rbp + 0x450]
xor rcx, rbp
call fcn.140007b00
mov rbx, qword [rbp + 0x4a0]
lea rsp, [rbp + 0x460]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret