Function at 0x171b27e64
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x50
mov rsi, qword [rsp + 0x80]
mov ebp, r9d
mov rdi, rcx
test rsi, rsi
je 0x171b35238
call fcn.171b161b0
test eax, eax
js 0x171b27f33
movsxd rbx, eax
add rbx, qword [rdi + 0x18]
mov ecx, dword [rbx - 4]
cmp ebp, 0xd5
jne 0x171b3540e
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x171b27f2c
mov edx, dword [rbx]
add rdx, rcx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadResource]
nop dword [rax + rax]
mov rbp, rax
test rax, rax
je 0x171b27f33
call fcn.171b098a0
test eax, eax
jne 0x171b35242
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LockResource]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x88]
mov qword [rsi], rax
test rcx, rcx
je 0x171b27f0e
mov eax, dword [rbx + 4]
mov dword [rcx], eax
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret
mov eax, 0x80070057
jmp 0x171b27f10
mov eax, 0x80070490
jmp 0x171b27f10
mov eax, 0x80004003
jmp 0x171b27f10
mov rcx, rdi
call fcn.171b4b0b0
test al, al
je 0x171b27eea
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LockResource]
nop dword [rax + rax]
mov ebx, dword [rbx + 4]
mov rbp, rax
mov rax, qword [rdi + 0x70]
test rax, rax
jne 0x171b352c9
mov rcx, qword [0x171b92ce0]
lea r8d, [rax + 0x60]
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
test rax, rax
je 0x171b352b4
and qword [rax + 0x28], 0
lea rcx, [0x171b689e0]
and dword [rax + 0x30], 0
and qword [rax + 8], 0
and qword [rax + 0x10], 0
and qword [rax + 0x18], 0
mov qword [rax + 0x20], rcx
mov byte [rax], 0
mov qword [rdi + 0x70], rax
test rax, rax
jne 0x171b352c9
mov ebx, 0x8007000e
mov eax, ebx
jmp 0x171b27f10
mov r8d, ebx
mov rdx, rbp
mov rcx, rax
call fcn.171b39f70
mov ebx, eax
test eax, eax
js 0x171b352c2
mov rcx, qword [rdi + 0x70]
mov rdx, qword [rdi + 0x20]
and dword [rsp + 0x40], 0
and dword [rsp + 0x44], 0
mov eax, dword [rcx + 0x38]
mov rbp, qword [rcx + 0x28]
mov r14d, dword [rcx + 0x34]
mov r9, rbp
mov dword [rsp + 0x48], eax
mov eax, dword [rcx + 0x3c]
mov rcx, qword [rdi + 0x18]
mov dword [rsp + 0x4c], eax
mov eax, dword [rcx + 0x14]
lea r8, [rcx - 8]
dec eax
mov rcx, rdi
add r8, rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r14d
call fcn.171b4ad8c
mov ebx, eax
test eax, eax
js 0x171b352c2
mov rcx, qword [rdi + 0x78]
test rcx, rcx
jne 0x171b35379
lea r8d, [rcx + 0x68]
xor edx, edx
mov rcx, qword [0x171b92ce0]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
test rax, rax
je 0x171b35369
mov rcx, rax
call fcn.171b3a338
mov rcx, rax
jmp 0x171b3536b
xor ecx, ecx
mov qword [rdi + 0x78], rcx
test rcx, rcx
jne 0x171b35379
mov ebx, 0x8007000e
test ebx, ebx
js 0x171b352c2
mov rax, qword [rdi + 0x70]
xorps xmm3, xmm3
movups xmm0, xmmword [0x171b68a30]
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x30], rbp
cvttsd2si r9, qword [rax + 0x48]
mov r8d, dword [rax + 0x3c]
mov edx, dword [rax + 0x38]
cvttsd2si r10, qword [rax + 0x40]
mov eax, r9d
movdqu xmmword [rsp + 0x40], xmm0
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
mov eax, r10d
cvtsi2sd xmm3, rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
movsd qword [rsp + 0x20], xmm0
call fcn.171b3a408
mov ebx, eax
test eax, eax
js 0x171b352c2
mov rax, qword [rdi + 0x78]
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rax + 0x10]
mov qword [rsi], rcx
test rdx, rdx
je 0x171b27f0e
mov rax, qword [rdi + 0x78]
mov ecx, dword [rax + 0x44]
mov dword [rdx], ecx
jmp 0x171b27f0e
mov rax, qword [rsp + 0x88]
mov qword [rsi], rbx
test rax, rax
je 0x171b27f0e
mov dword [rax], ecx
jmp 0x171b27f0e