Function at 0x1400f4db8
Capabilities:
Extract resource via kernel32 functions
Get file size
Read file on windows

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x3d8]
sub rsp, 0x4a0
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rax, qword [0x14031f2d0]
xor rax, rsp
mov qword [rbp + 0x390], rax
mov rdi, r9
mov dword [rsp + 0x64], r8d
mov rsi, rdx
mov rbx, rcx
mov r15d, 1
or r12, 0xffffffffffffffff
xor r13d, r13d
test rdx, rdx
jne 0x1400f5059
call fcn.1400d1b14
mov rdx, rax
lea rcx, [rbp - 0x50]
call fcn.1400ce5b8
nop
call fcn.1400d1b1c
mov rcx, rax
call fcn.1400cf128
test al, al
je 0x1400f4ee7
mov rdx, rbx
lea rcx, [rbp - 0x50]
call fcn.1400ce980
lea rcx, [rbp - 0x50]
call fcn.1400ce874
mov rcx, rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, r15d
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, r12
jne 0x1400f4e91
lea rcx, [rbp - 0x50]
call fcn.1400ce724
jmp 0x1400f50a4
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test eax, eax
je 0x1400f4e83
mov dword [rsp + 0x50], r13d
mov ecx, esi
call fcn.1400cd718
mov r14, rax
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x50]
mov r8d, esi
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x50], esi
je 0x1400f504b
mov rcx, r14
call fcn.14013aa70
jmp 0x1400f4e83
call fcn.1400d1b1c
mov rdx, rax
lea rcx, [rbp - 0x50]
call fcn.1400ce958
call fcn.1400d1b2c
mov rdx, rax
lea rcx, [rbp + 0xd0]
call fcn.1400ce5b8
nop
call fcn.1400d1eb0
test al, al
je 0x1400f4f20
call fcn.1400d1b24
mov rdi, rax
jmp 0x1400f4f5d
lea rcx, [rbp + 0xd0]
call fcn.1400ce874
mov rcx, rax
xor edx, edx
call fcn.1400d7298
mov rsi, rax
lea rcx, [rbp - 0x50]
call fcn.1400ce874
mov rcx, rax
mov rdx, rsi
call fcn.140103350
mov rdi, rax
test rsi, rsi
je 0x1400f4f5d
mov rcx, rsi
call fcn.14013aa70
test rdi, rdi
jne 0x1400f4f73
lea rcx, [rbp + 0xd0]
call fcn.1400ce724
jmp 0x1400f4e83
mov dword [rsp + 0x54], r13d
mov r8d, r12d
mov rdx, rbx
lea rcx, [rbp + 0x40]
call fcn.1400ce5e8
nop
lea r8, [0x140264c24]
lea rdx, [0x1402c65bc]
lea rcx, [rbp + 0x40]
call fcn.1400cf354
lea rcx, [rbp + 0x40]
call fcn.1400ce874
mov rdx, rax
lea rax, [rbp + 0x160]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x54]
mov r8b, r15b
mov rcx, rdi
call fcn.140102d44
test eax, eax
je 0x1400f4fd6
lea rcx, [rbp + 0x40]
call fcn.1400ce724
jmp 0x1400f4f62
mov esi, dword [rbp + 0x38c]
test esi, esi
je 0x1400f4fcb
mov ecx, esi
call fcn.1400cd718
mov r14, rax
mov r9d, esi
mov r8, rax
mov edx, dword [rsp + 0x54]
mov rcx, rdi
call fcn.14010384c
test eax, eax
je 0x1400f5022
cmp eax, 0x600
je 0x1400f5022
mov rcx, r14
call fcn.14013aa70
call fcn.1400d1eb0
test al, al
jne 0x1400f4fcb
mov rcx, rdi
call fcn.140102a84
jmp 0x1400f4fcb
call fcn.1400d1eb0
test al, al
jne 0x1400f5034
mov rcx, rdi
call fcn.140102a84
nop
lea rcx, [rbp + 0x40]
call fcn.1400ce724
nop
lea rcx, [rbp + 0xd0]
call fcn.1400ce724
nop
lea rcx, [rbp - 0x50]
call fcn.1400ce724
jmp 0x1400f52f9
test r9, r9
jne 0x1400f5066
call fcn.1400d1b00
mov rdi, rax
mov r8, rsi
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x1400f50a4
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r15, rax
test rax, rax
jne 0x1400f52b3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov r15d, 1
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, r15d
mov edx, 0x80000000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, r12
je 0x1400f53d1
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test eax, eax
je 0x1400f53d1
mov dword [rsp + 0x58], r13d
mov ecx, esi
call fcn.1400cd718
mov r14, rax
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x58]
mov r8d, esi
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x58], esi
je 0x1400f5130
mov rcx, r14
call fcn.14013aa70
mov r14, r13
test r14, r14
je 0x1400f53d1
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x5c]
mov edx, esi
mov rcx, r14
call fcn.1401021e8
mov rbx, rax
mov rcx, r14
call fcn.14013aa70
test rbx, rbx
je 0x1400f53d1
xor edx, edx
lea r8d, [rdx + 0x2c]
lea rcx, [rsp + 0x78]
call fcn.14021ee30
mov dword [rsp + 0x78], 0x28
mov r14d, dword [rsp + 0x5c]
mov dword [rsp + 0x7c], r14d
mov r15d, dword [rsp + 0x60]
mov eax, r15d
neg eax
mov dword [rbp - 0x80], eax
mov qword [rbp - 0x7c], 0x200001
mov edi, r14d
imul edi, r15d
mov eax, edi
shl eax, 2
mov dword [rbp - 0x74], eax
mov byte [rsp + 0x40], r13b
xor eax, eax
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
xor r8d, r8d
lea rdx, [rsp + 0x78]
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateDIBSection]
mov rsi, rax
mov qword [rsp + 0x68], rax
test rax, rax
je 0x1400f53d1
movsxd r10, edi
test edi, edi
jle 0x1400f5387
lea r8, [rbx + 3]
mov rdi, 0xfffffffffffffffe
sub rdi, rbx
sub r12, rbx
mov rsi, 0xfffffffffffffffd
sub rsi, rbx
mov r15d, dword [rsp + 0x64]
mov r14d, 1
mov r9, r8
sub r9, rbx
mov cl, byte [r8]
mov rax, qword [rsp + 0x48]
mov byte [rax + r9], cl
lea r11, [r8 + rsi]
lea r13, [rdi + r8]
cmp cl, 0xff
jae 0x1400f5307
movzx ecx, byte [r8 - 1]
movzx eax, byte [r8]
imul ecx, eax
mov eax, 0x80808081
mul ecx
shr edx, 7
mov rax, qword [rsp + 0x48]
mov byte [rax + r11], dl
movzx ecx, byte [r8 - 2]
movzx eax, byte [r8]
imul ecx, eax
mov eax, 0x80808081
mul ecx
shr edx, 7
mov rax, qword [rsp + 0x48]
mov byte [rax + r13], dl
movzx ecx, byte [r8 - 3]
movzx eax, byte [r8]
imul ecx, eax
mov eax, 0x80808081
mul ecx
shr edx, 7
mov rax, qword [rsp + 0x48]
lea rcx, [r12 + r8]
mov byte [rax + rcx], dl
mov byte [rsp + 0x40], r14b
lea rdx, [r12 + r8]
jmp 0x1400f5331
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test eax, eax
je 0x1400f509e
mov ecx, esi
call fcn.1400cd718
mov r14, rax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, rax
mov r8d, esi
mov rcx, r14
call fcn.14021eff0
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov r15d, 1
test r14, r14
jne 0x1400f5139
jmp 0x1400f50a4
mov cl, byte [r8 - 1]
mov rax, qword [rsp + 0x48]
mov byte [rax + r11], cl
mov cl, byte [r8 - 2]
mov rax, qword [rsp + 0x48]
mov byte [rax + r13], cl
lea rdx, [r12 + r8]
mov cl, byte [r8 - 3]
mov rax, qword [rsp + 0x48]
mov byte [rax + rdx], cl
mov rax, qword [rsp + 0x48]
cmp dword [rax + r11], r15d
jne 0x1400f5366
xor ecx, ecx
mov byte [rax + r11], cl
mov rax, qword [rsp + 0x48]
mov byte [rax + r13], cl
mov rax, qword [rsp + 0x48]
mov byte [rax + rdx], cl
mov rax, qword [rsp + 0x48]
mov byte [rax + r9], cl
mov r13b, r14b
mov byte [rsp + 0x40], r14b
jmp 0x1400f536b
mov r13b, byte [rsp + 0x40]
add r8, 4
sub r10, r14
jne 0x1400f5225
mov r14d, dword [rsp + 0x5c]
mov r15d, dword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rcx, rbx
call fcn.1401021e0
mov ecx, 0xb8
call fcn.1400cd6e8
mov rbx, rax
mov qword [rsp + 0x68], rax
test rax, rax
je 0x1400f53b1
lea rcx, [rax + 0x28]
call fcn.1400ce610
jmp 0x1400f53b3
xor ebx, ebx
and qword [rbx + 8], 0
and qword [rbx + 0x10], 0
mov qword [rbx], rsi
mov dword [rbx + 0x18], r14d
mov dword [rbx + 0x1c], r15d
mov byte [rbx + 0x20], r13b
mov rax, rbx
jmp 0x1400f53d3
xor eax, eax
mov rcx, qword [rbp + 0x390]
xor rcx, rsp
call fcn.14013a450
mov rbx, qword [rsp + 0x4e0]
add rsp, 0x4a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret