Function at 0x10000ac00
Capabilities:
Extract resource via kernel32 functions
Get file size
Read file on windows

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1f0
mov qword [rsp + 0xa0], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
movaps xmmword [rax - 0x48], xmm6
mov rax, qword [0x10009e100]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov rbp, r8
mov r15, rdx
mov rbx, rcx
xor r14d, r14d
cmp dword [rcx + 0x2820], r14d
jbe 0x100036e7c
cmp byte [rcx + 0x2808], r14b
jne 0x100036ea4
mov r12, r14
cmp dword [rbx + 0x2820], r14d
jbe 0x100036f5b
mov rdx, r15
lea rcx, [rsp + 0x48]
call fcn.10000a0d8
nop
mov rdx, qword [rsp + 0x58]
cmp word [rdx], r14w
je 0x10000aca3
cmp word [rdx], 0x2f
je 0x100013a73
add rdx, 2
cmp word [rdx], r14w
jne 0x10000ac8a
mov rdx, qword [rsp + 0x58]
mov edi, r14d
cmp dword [rbx + 0x2820], r14d
jbe 0x1000145f6
mov rsi, r14
mov rax, qword [rbx + 0x2830]
mov r13, qword [rsi + rax]
lea r8, [0x10007b2c0]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r14, rax
test rax, rax
je 0x10000ad41
mov rdx, rax
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test eax, eax
je 0x10000ad53
test rbp, rbp
je 0x10000acf3
mov dword [rbp], edi
mov rdx, r14
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x10000ad53
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r12, rax
test rax, rax
je 0x10000ad53
cmp edi, 1
jl 0x10000ad53
mov rcx, rax
test edi, edi
jle 0x10000ad53
mov rdx, rdi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov al, byte [rcx]
mov byte [rsp + 0x40], al
inc rcx
sub rdx, 1
jne 0x10000ad30
jmp 0x10000ad53
inc edi
add rsi, 8
cmp edi, dword [rbx + 0x2820]
jb 0x100036f17
test r14, r14
je 0x1000145f6
xor r14d, r14d
mov rcx, qword [rsp + 0x58]
call sub.msvcrt.dll_free
jmp 0x10000ad6b
cmp r12, r14
je 0x10001cbde
mov rax, r12
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1000024e0
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x58]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov eax, 0x5c
mov word [rdx], ax
jmp 0x10000ac94
lea rdx, str..cab
lea rcx, [rsp + 0xa8]
call fcn.100002c10
nop
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.100013aa8
nop
mov rcx, qword [rsp + 0xb8]
call sub.msvcrt.dll_free
mov esi, r14d
cmp dword [rbx + 0x2820], r14d
jbe 0x10000ad5f
mov rdi, r14
mov rax, qword [rbx + 0x2830]
lea r8, [0x10007b2c0]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rax + rdi]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
cmp rax, r14
je 0x10001cbc7
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x104
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
or r9d, 0xffffffff
mov r8, qword [rsp + 0x58]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov byte [rsp + 0x1c3], r14b
lea rdx, [0x10007ced0]
lea rcx, [rsp + 0x70]
call fcn.100002c10
nop
mov rax, qword [0x10009e260]
cmp rax, r14
je 0x100036f49
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], r14
lea rcx, [0x1000145b4]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
lea r8, [0x10007fffa]
lea rdx, [rsp + 0xc0]
mov rcx, qword [0x10009e200]
call rax
cmp eax, r14d
je 0x100036f49
mov ebx, r14d
mov eax, dword [0x10009e3d0]
cmp eax, r14d
jbe 0x100036f2c
mov rdi, r14
mov rcx, qword [0x10009e3e0]
cmp qword [rdi + rcx], r14
jne 0x10001472c
inc ebx
add rdi, 8
cmp ebx, eax
jae 0x100036f2c
jmp 0x10001470f
mov rax, qword [rdi + rcx]
mov rdx, qword [rax + 0x10]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, r14d
jne 0x100036f21
mov ecx, ebx
mov rax, qword [0x10009e3e0]
mov rbx, qword [rax + rcx*8]
jmp 0x10001475a
cmp rbx, r14
je 0x100036f34
mov rcx, qword [rsp + 0x80]
call sub.msvcrt.dll_free
jmp 0x100014772
cmp rbx, r14
je 0x10000ad5f
mov r12, qword [rbx + 0x18]
cmp rbp, r14
je 0x10000ad5f
mov eax, dword [rbx + 0x20]
mov dword [rbp], eax
jmp 0x10000ad5f
inc esi
add rdi, 8
cmp esi, dword [rbx + 0x2820]
jb 0x100014639
jmp 0x10000ad5f
call sub.KERNEL32.dll_GetLastError
mov r9d, eax
mov r8, qword [r15 + 0x10]
lea rdx, str.DllFileMgr:_Failed_to_load__s__0x_08X__
mov ecx, 1
call fcn.100002470
nop
jmp 0x10000ad74
cmp qword [rcx + 0x2838], r14
jne 0x10000ac54
mov r8, qword [rdx + 0x10]
lea rdx, str.DllFileMgr:_Uninitialized_yet_tried_to_load__s_
lea ecx, [r14 + 1]
call fcn.100002470
xor eax, eax
jmp 0x10000ad77
mov esi, r14d
lea rdi, [rcx + 0x10]
cmp qword [rdi + 8], r14
je 0x10000ac61
mov rdx, qword [r15 + 0x10]
cmp rdx, r14
je 0x100036ed4
mov rcx, qword [rdi]
cmp rcx, r14
je 0x100036ed4
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, r14d
sete al
jmp 0x100036ed7
mov al, r14b
cmp al, r14b
jne 0x100036eef
inc esi
add rdi, 0x28
cmp esi, 0x100
jb 0x100036eab
mov rax, r14
jmp 0x100036efa
movsxd rax, esi
lea rcx, [rax + rax*4]
lea rax, [rbx + rcx*8]
cmp rax, r14
je 0x10000ac61
cmp rbp, r14
je 0x100036f0e
mov ecx, dword [rax + 0x20]
mov dword [rbp], ecx
mov rax, qword [rax + 0x18]
jmp 0x10000ad77
mov rdx, qword [rsp + 0x58]
jmp 0x10000acb6
mov eax, dword [0x10009e3d0]
jmp 0x10001471c
mov rbx, r14
jmp 0x10001475a
mov rcx, qword [rsp + 0x80]
call sub.msvcrt.dll_free
mov rbx, r14
jmp 0x100014772
mov rcx, qword [rsp + 0x80]
call sub.msvcrt.dll_free
jmp 0x10000ad5f
lea rdx, [rbx + 0x2838]
lea rcx, [rsp + 0x88]
call fcn.10000a0d8
nop
mov rdx, r15
lea rcx, [rsp + 0x88]
call fcn.100013aa8
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x100037099
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x10003708f
cmp rbp, r14
je 0x100036fd8
mov dword [rbp], edi
mov rcx, rdi
call fcn.100002580
mov rsi, rax
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], edi
mov dword [rsp + 0x44], r14d
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x44]
mov r8d, edi
mov rdx, rax
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, r14d
je 0x100037087
cmp dword [rsp + 0x44], edi
jne 0x100037087
inc dword [rbx + 0x2850]
mov ecx, dword [rbx + 0x2854]
movaps xmm6, xmmword [rsp + 0x60]
cmp dword [rbx + 0x2850], ecx
jbe 0x100037062
add ecx, dword [rbx + 0x2858]
mov dword [rbx + 0x2854], ecx
mov edx, ecx
shl rdx, 4
mov rcx, qword [rbx + 0x2860]
call qword [sym.imp.msvcrt.dll_realloc]
cmp rax, r14
jne 0x10003705b
xor ecx, ecx
call fcn.10000a0c0
jmp 0x100037079
mov qword [rbx + 0x2860], rax
mov ecx, dword [rbx + 0x2850]
dec ecx
add rcx, rcx
mov rax, qword [rbx + 0x2860]
movdqu xmmword [rax + rcx*8], xmm6
movdqa xmmword [rsp + 0x60], xmm6
mov rsi, r14
mov r12, qword [rsp + 0x60]
mov rcx, rsi
call sub.msvcrt.dll_free
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rsp + 0x98]
call sub.msvcrt.dll_free
nop
jmp 0x10000ad6b