Function at 0x140082970
Capabilities:
Extract resource via kernel32 functions
Read file on windows

Disassembly:
mov dword [rsp + 0x18], r8d
push rbx
push rbp
push rsi
push rdi
push r13
sub rsp, 0x60
mov ebp, r8d
mov r13, rdx
mov rsi, rcx
lea r8, [0x14019c6a0]
lea rdx, str.OLEAUT32.DLL
lea rcx, str.OleLoadPicture
xor r9d, r9d
call fcn.14005c580
xor ebx, ebx
test r13, r13
jne 0x1400829b2
lea r13d, [rbx + 0x64]
jmp 0x1400829bb
cmp r13, 0x10000
jge 0x140082a10
mov rbx, qword [0x14019c040]
lea r8, str.IMAGE
movzx edx, r13w
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x140082d01
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsi], eax
cmp eax, 8
jb 0x140082d01
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
xor ebx, ebx
mov qword [rsi + 8], rax
jmp 0x140082ae4
test ebp, ebp
je 0x140082a23
mov rax, qword [r13]
mov dword [rsi], ebp
mov qword [rsi + 8], rax
jmp 0x140082ae4
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, r13
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140082d01
test rax, rax
je 0x140082d01
xor eax, eax
lea r9, [rsp + 0x98]
lea rdx, [rsp + 0x40]
lea r8d, [rax + 6]
mov rcx, rbx
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x98], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
lea rcx, [rsp + 0x40]
call fcn.140062cf0
test eax, eax
jne 0x140082abd
cmp rbx, 0xffffffffffffffff
je 0x140082aad
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xfffffffe
add rsp, 0x60
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
cmp rbx, 0xffffffffffffffff
je 0x140082acc
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
mov rdx, rsi
mov rcx, r13
call fcn.14006dd30
xor ebx, ebx
mov qword [rsi + 8], rax
mov qword [rsi + 0x40], rax
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x140082d01
call fcn.140062cf0
test eax, eax
je 0x140082aad
cmp dword [rsi], 0
mov qword [rsp + 0x50], r15
mov dword [rsi + 0x28], ebx
mov r15w, bx
mov dword [rsi + 0x20], ebx
mov dword [rsi + 0x2c], 0xffffff9c
mov dword [rsi + 0x24], ebx
mov qword [rsi + 0x30], rbx
mov edi, ebx
mov dword [rsp + 0x98], ebx
jbe 0x140082cbe
mov qword [rsp + 0x90], r12
mov qword [rsp + 0x58], r14
nop word [rax + rax]
mov r9, qword [rsi + 8]
mov r12d, edi
movzx eax, byte [r12 + r9]
cmp al, 0x2c
jne 0x140082c18
lea eax, [rdi - 1]
cmp byte [rax + r9], 0
jne 0x140082c99
cmp dword [rsi + 0x20], 0
jne 0x140082b6b
mov dword [rsi + 0x24], edi
lea eax, [rdi + 1]
mov edx, 1
movzx r8d, byte [rax + r9 + 8]
mov ecx, r8d
shr r8d, 7
and ecx, 7
inc ecx
shl edx, cl
mov rcx, r9
imul edx, r8d
lea r8d, [rdx + rdx*2 + 0xb]
lea rdx, [rsp + 0x98]
call fcn.140062cb0
mov ecx, 0x10
mov r14d, eax
call fcn.1400cf938
mov rbp, rax
test rax, rax
je 0x140082bc0
mov qword [rax], rbx
mov dword [rax + 8], ebx
mov dword [rax + 0xc], ebx
jmp 0x140082bc3
mov rbp, rbx
mov ecx, dword [rsi + 0x20]
lea rdx, [rsi + 0x10]
mov r9d, 8
lea r8, [rdx + 8]
call fcn.1400638f0
mov rcx, r14
mov qword [rax], rbp
call fcn.1400cf938
mov r8, r14
mov qword [rbp], rax
mov rcx, qword [rsi + 8]
lea rdx, [r12 + rcx]
mov rcx, rax
call fcn.14010cd30
movzx eax, r15w
xor ebx, ebx
mov dword [rbp + 8], r14d
mov dword [rbp + 0xc], eax
inc dword [rsi + 0x20]
mov r15d, ebx
lea edi, [rdi + r14 - 1]
jmp 0x140082c99
cmp al, 0x21
jne 0x140082c99
lea eax, [rdi + 1]
movzx eax, byte [rax + r9]
cmp al, 0xf9
jne 0x140082c41
mov cx, word [r12 + r9 + 4]
movzx eax, cx
shl ax, 2
add cx, ax
add edi, 7
lea r15d, [rcx + rcx]
jmp 0x140082c99
cmp al, 0xff
jne 0x140082c5f
lea rdx, [rsp + 0x98]
mov r8d, 0xe
mov rcx, r9
call fcn.140062cb0
add edi, eax
jmp 0x140082c99
cmp al, 0xfe
jne 0x140082c7d
lea rdx, [rsp + 0x98]
mov r8d, 2
mov rcx, r9
call fcn.140062cb0
add edi, eax
jmp 0x140082c99
cmp al, 1
jne 0x140082c99
lea rdx, [rsp + 0x98]
mov r8d, 0x10
mov rcx, r9
call fcn.140062cb0
add edi, eax
inc edi
mov dword [rsp + 0x98], edi
cmp edi, dword [rsi]
jb 0x140082b40
mov ebp, dword [rsp + 0xa0]
mov r14, qword [rsp + 0x58]
mov r12, qword [rsp + 0x90]
cmp dword [rsi + 0x20], 1
mov r15, qword [rsp + 0x50]
jle 0x140082d01
test ebp, ebp
je 0x140082cd9
mov rax, qword [rsi + 8]
mov qword [rsi + 0x40], rax
mov qword [r13], rbx
mov edx, dword [rsi]
mov rcx, qword [rsi + 8]
lea r9, [rsp + 0xa8]
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [rsi + 0x20]
add rsp, 0x60
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
or eax, 0xffffffff
add rsp, 0x60
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret