Function at 0x180009b80
Capabilities:
Extract resource via kernel32 functions
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x130]
sub rsp, 0x230
cmp edx, 1
jne 0x180009f11
lea rax, [0x1800090b0]
add rax, 0x24d
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], 0x24d
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.18000fdb0
lea rax, [0x180009770]
add rax, 0x122
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], 0x122
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.1800122e0
xor ecx, ecx
call fcn.18007f98c
mov ecx, eax
call fcn.18007c584
lea rbx, [0x1800094e0]
lea rax, [rbx + 0x177]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], 0x177
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rbp + 0x50]
lea rcx, [rsp + 0x40]
call fcn.180012460
add rbx, 0x122
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x58], 0x122
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x40]
call fcn.180012460
lea rax, [0x1800095d0]
add rax, 0x248
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], 0x248
xor eax, eax
mov word [rsp + 0x60], ax
mov byte [rsp + 0x62], al
xor ebx, ebx
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbx
mov qword [rbp - 0x80], rbx
mov qword [rbp - 0x78], rbx
mov ecx, 0x10
call fcn.180076768
mov qword [rax + 8], rbx
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x68]
mov qword [rax], rcx
mov word [rbp - 0x68], bx
mov qword [rbp - 0x62], rbx
mov qword [rbp - 0x5a], rbx
xor eax, eax
mov word [rbp - 0x65], ax
mov byte [rbp - 0x63], al
mov word [rbp - 0x62], ax
mov byte [rbp - 0x60], al
mov word [rbp - 0x5f], ax
mov byte [rbp - 0x5d], al
mov word [rbp - 0x5c], ax
mov byte [rbp - 0x5a], al
mov word [rbp - 0x59], ax
mov byte [rbp - 0x57], al
mov word [rbp - 0x56], ax
mov byte [rbp - 0x54], al
mov dword [rbp - 0x6c], ebx
mov dword [rsp + 0x64], ebx
lea rcx, [rsp + 0x60]
call fcn.180029560
test al, al
je 0x180009d53
lea rdx, [rbp + 0x158]
lea rcx, [rsp + 0x60]
call fcn.1800296f0
mov byte [rbp - 0x68], bl
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x50], rcx
and al, 1
mov byte [rsp + 0x58], al
mov dl, 1
lea rcx, [rsp + 0x50]
call fcn.180015220
lea rcx, [rsp + 0x60]
call fcn.1800297f0
lea rax, [rsp + 0x60]
mov qword [rbp + 0x168], rax
lea rdx, [rbp + 0x168]
call fcn.180015ce0
mov byte [rbp + 0x158], 0
mov r8b, 1
lea rdx, [rbp + 0x158]
lea rcx, [rsp + 0x60]
call fcn.18001b010
mov byte [rbp + 0x158], 0
mov r8b, 1
lea rdx, [rbp + 0x158]
lea rcx, [rsp + 0x60]
call fcn.18001b0e0
mov byte [rbp + 0x158], 0
mov r8b, 1
lea rdx, [rbp + 0x158]
lea rcx, [rsp + 0x60]
call fcn.18001b280
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rbp - 0x50], xmm0
lea rax, [rbp + 0xc0]
mov qword [rbp - 0x40], rax
lea rax, [rbp - 0x20]
mov qword [rbp - 0x38], rax
lea rax, [rbp + 0x50]
mov qword [rbp - 0x30], rax
mov r8b, 1
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x60]
call fcn.18001b350
nop
lea rcx, [rsp + 0x68]
call fcn.180013f70
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x68], rbx
mov edx, 0x10
call fcn.18007667c
lea rax, [0x180004040]
add rax, 0x240
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], 0x240
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.18000fdb0
cmp dword [0x180100cd8], 0x95891539
jne 0x180009ef4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCalendarInfoW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AddSecureMemoryCacheCallback]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapUnlock]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsW]
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryInformationJobObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryMemoryResourceNotification]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemPowerState]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_UnregisterWait]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteProfileSectionW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnterSynchronizationBarrier]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
mov eax, 1
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
cmp edx, 2
je 0x180009ef4
cmp edx, 3
jne 0x18000a061
cmp dword [0x180100cd8], 0x929b49e7
jne 0x180009ef4
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetGuiResources]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrefetchVirtualMemory]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetWindowRect]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetTimeZoneInformation]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapDestroy]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetRawInputDeviceInfoW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThreadpoolIo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueueUserWorkItem]
xor ebx, ebx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_UnlockFile]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCriticalSectionSpinCount]
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetDisplayAutoRotationPreferences]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DeleteMenu]
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryInformationJobObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SwitchToThisWindow]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileTransactedW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
jmp 0x180009ef4
test edx, edx
jne 0x180009ef4
mov ecx, 0x852d
nop
inc ecx
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea edx, [rdx + rdx*2]
cmp ecx, edx
jne 0x18000a070
mov r9d, 0xffffe487
sub r9d, ecx
lea r11d, [rcx + 0x3bec]
lea r8d, [r11 - 0x2818]
mov eax, 0x55555556
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea edx, [rdx + rdx*2]
cmp r8d, edx
je 0x18000a0da
nop word [rax + rax]
inc r8d
mov eax, 0x55555556
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea edx, [rdx + rdx*2]
cmp r8d, edx
jne 0x18000a0c0
lea edx, [r8 - 0x18d1]
lea eax, [r9 + 0x149b]
add r8d, 0x83bb
add r8d, eax
lea r10d, [rax - 0x1678]
sub edx, r10d
lea esi, [r10 + r10]
lea edi, [r11 + r8]
add r8d, 0x1975
lea r9d, [rcx + 0x10d51]
add r10d, 0x541
mov ebx, 0x13a7
sub ebx, edi
lea r11d, [rdx + 0x1d6f]
add r11d, edi
lea r14d, [rsi + r10]
sub r8d, r10d
add r8d, r9d
sub r9d, 0x1dfe
add r8d, edi
mov eax, 0x55555556
imul r11d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea edx, [rdx + rdx*2]
cmp r11d, edx
je 0x18000a163
test r11d, r11d
jle 0x18000a163
add r11d, 0xffffc7a7
jmp 0x18000a16a
add r11d, 0xf9
cmp r14d, 0xfffe1db2
jne 0x18000a1be
cmp r11d, 0x25999
jne 0x18000a1be
cmp esi, 0xfffebaf6
jne 0x18000a1be
sub r9d, ebx
cmp r9d, 0x2b2a7
jne 0x18000a1be
cmp r8d, 0x42bb6
jne 0x18000a1be
cmp ebx, 0xfffec1db
jne 0x18000a1be
cmp r10d, 0xffff62bc
jne 0x18000a1be
cmp edi, 0x151cc
jne 0x18000a1be
cmp ecx, 0x852f
je 0x180009ef4
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]