Function at 0x7ff7c15b3b18
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov ebp, ecx
mov r12, r9
mov rdi, r8
mov r15, rdx
test ecx, ecx
je 0x7ff7c15b3dbe
test ebp, 0xffff0000
jne 0x7ff7c15b3dbe
test r8, r8
je 0x7ff7c15b3dbe
test rdx, rdx
je 0x7ff7c15b3dbe
test r9, r9
je 0x7ff7c15b3dbe
mov r14, qword [rsp + 0x90]
test r14, r14
je 0x7ff7c15b3dbe
and qword [rax - 0x38], 0
lea rcx, [rax - 0x38]
mov rdx, r8
call fcn.7ff7c15b5c30
mov esi, eax
test eax, eax
js 0x7ff7c15b3db0
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [rsp + 0x38], rax
mov rbx, rax
test rax, rax
jne 0x7ff7c15b3bfc
call fcn.7ff7c15bfd78
mov esi, eax
mov rcx, qword [0x7ff7c161b240]
lea rax, [0x7ff7c161b240]
cmp rcx, rax
je 0x7ff7c15b3da2
test byte [rcx + 0x1c], 1
je 0x7ff7c15b3da2
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 0xb]
mov r9, rdi
mov dword [rsp + 0x20], esi
lea r8, [0x7ff7c15f9138]
call fcn.7ff7c15a595c
jmp 0x7ff7c15b3da2
movzx edx, bp
mov r8, r15
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
jne 0x7ff7c15b3c51
call fcn.7ff7c15bfd78
mov esi, eax
mov rcx, qword [0x7ff7c161b240]
lea rax, [0x7ff7c161b240]
cmp rcx, rax
je 0x7ff7c15b3da2
test byte [rcx + 0x1c], 1
je 0x7ff7c15b3da2
mov rcx, qword [rcx + 0x10]
mov r9d, ebp
mov qword [rsp + 0x20], rdi
call fcn.7ff7c15b2b60
jmp 0x7ff7c15b3da2
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x7ff7c15b3c91
call fcn.7ff7c15bfd78
mov esi, eax
mov rcx, qword [0x7ff7c161b240]
lea rax, [0x7ff7c161b240]
cmp rcx, rax
je 0x7ff7c15b3da2
test byte [rcx + 0x1c], 1
je 0x7ff7c15b3da2
mov edx, 0xd
jmp 0x7ff7c15b3d0d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r15, rax
test rax, rax
jne 0x7ff7c15b3cd0
call fcn.7ff7c15bfd78
mov esi, eax
mov rcx, qword [0x7ff7c161b240]
lea rax, [0x7ff7c161b240]
cmp rcx, rax
je 0x7ff7c15b3da2
test byte [rcx + 0x1c], 1
je 0x7ff7c15b3da2
lea edx, [r15 + 0xe]
jmp 0x7ff7c15b3d0d
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
jne 0x7ff7c15b3d26
call fcn.7ff7c15bfd78
mov esi, eax
mov rcx, qword [0x7ff7c161b240]
lea rax, [0x7ff7c161b240]
cmp rcx, rax
je 0x7ff7c15b3da2
test byte [rcx + 0x1c], 1
je 0x7ff7c15b3da2
mov edx, 0xf
mov rcx, qword [rcx + 0x10]
lea r8, [0x7ff7c15f9138]
mov r9, rdi
mov dword [rsp + 0x20], ebp
call fcn.7ff7c15a595c
jmp 0x7ff7c15b3da2
mov r13, qword [r14]
mov ebp, eax
add r13, rbp
mov rcx, r13
call qword [sym.imp.msvcrt.dll_malloc]
mov rdi, rax
neg rax
sbb esi, esi
not esi
and esi, 0x8007000e
test rdi, rdi
jne 0x7ff7c15b3d7d
mov rcx, qword [0x7ff7c161b240]
lea rax, [0x7ff7c161b240]
cmp rcx, rax
je 0x7ff7c15b3da2
test byte [rcx + 0x1c], 1
je 0x7ff7c15b3da2
mov rcx, qword [rcx + 0x10]
lea edx, [rdi + 0x10]
mov r9d, esi
lea r8, [0x7ff7c15f9138]
call fcn.7ff7c15a1eb4
jmp 0x7ff7c15b3da2
mov r8, rbp
mov rdx, r15
mov rcx, rdi
call sub.msvcrt.dll_memcpy
mov r8, qword [r14]
lea rcx, [rdi + rbp]
xor edx, edx
call sub.msvcrt.dll_memset
mov qword [r14], r13
xor esi, esi
mov qword [r12], rdi
test rbx, rbx
je 0x7ff7c15b3db0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, [rsp + 0x30]
call fcn.7ff7c15b5be0
mov eax, esi
jmp 0x7ff7c15b3dc3
mov eax, 0x80070057
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret