Function at 0x1400177e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x1404953c0]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov r14, r9
mov rbx, r8
mov rdi, rdx
mov r15, rcx
lea rcx, [0x1404ac8d0]
mov qword [rsp + 0x50], rcx
call fcn.14002d900
nop
mov rsi, qword [0x1404ac918]
lea rcx, [rsp + 0x50]
call fcn.14001d6c0
test rsi, rsi
jne 0x140017840
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rsi, rax
mov r8, rbx
cmp qword [rbx + 0x18], 7
jbe 0x14001784d
mov r8, qword [rbx]
mov rdx, rdi
cmp qword [rdi + 0x18], 7
jbe 0x14001785a
mov rdx, qword [rdi]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbp, rax
test rax, rax
je 0x1400179bf
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r12d, eax
test eax, eax
je 0x1400179bf
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400179bf
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rsi, rax
test rax, rax
je 0x1400179bf
mov rcx, r15
call fcn.1400175b0
test al, al
jne 0x140017904
call fcn.14001d6f0
mov r10, qword [rax]
lea rcx, str.Could_not_create_extract_directory
mov qword [rsp + 0x30], rcx
lea rcx, str.Sledgehammer
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 1
mov r9d, 0x78
lea r8, str.D:JenkinsworkspaceA_MBAM3_UPDATEREXE_srcPackagesSledgehammer.5.1.0.88_build_nativeincludeTemporaryResourceFile.inl
lea rdx, [0x140412418]
mov rcx, rax
call qword [r10 + 0x18]
jmp 0x140017a32
mov r8, r14
mov rdx, r15
lea rcx, [rsp + 0x58]
call fcn.14009b580
nop
call fcn.14001d6f0
mov rdi, rax
xor ebx, ebx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 1
lea r9d, [rbx + 3]
lea r8d, [rbx + 1]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x58]
call fcn.1400cb260
test al, al
je 0x1400179ae
mov qword [rsp + 0x20], rbx
mov r9, rdi
mov r8d, r12d
mov rdx, rsi
mov rcx, qword [rsp + 0x50]
call fcn.1400cb6f0
movzx ebx, al
xor r9d, r9d
mov r8, rdi
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.1400cb5e0
test al, al
je 0x1400179ae
test bl, bl
je 0x1400179ae
lea rcx, [r15 + 0x20]
lea rax, [rsp + 0x58]
cmp rcx, rax
je 0x1400179aa
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 7
cmova rdx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x68]
call fcn.140030940
mov bl, 1
jmp 0x1400179b0
xor bl, bl
lea rcx, [rsp + 0x58]
call fcn.1400166f0
movzx eax, bl
jmp 0x140017a34
call fcn.14001d6f0
mov rcx, qword [rax]
mov r10, qword [rcx + 0x20]
cmp qword [r14 + 0x18], 7
jbe 0x1400179d5
mov r14, qword [r14]
cmp qword [rbx + 0x18], 7
jbe 0x1400179df
mov rbx, qword [rbx]
cmp qword [rdi + 0x18], 7
jbe 0x1400179e9
mov rdi, qword [rdi]
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rdi
lea rcx, str.Could_not_unpack__s__s__s
mov qword [rsp + 0x30], rcx
lea rcx, str.Sledgehammer
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 1
mov r9d, WSACleanup
lea r8, str.D:JenkinsworkspaceA_MBAM3_UPDATEREXE_srcPackagesSledgehammer.5.1.0.88_build_nativeincludeTemporaryResourceFile.inl
lea rdx, [0x140412418]
mov rcx, rax
call r10
xor al, al
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1402b5c00
add rsp, 0x80
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret