Function at 0x412450
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4a0
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x30], 0xfffffffffffffffe
mov qword [rbp + 0x4a0], rbx
mov rax, qword [0x0043e2a8]
xor rax, rbp
mov qword [rbp + 0x450], rax
mov r15, r9
mov r14, r8
mov r13, rdx
mov rdi, rcx
call qword [0x0043f790]
mov dword [rbp], eax
xor esi, esi
mov rbx, rsi
mov qword [rbp + 8], rbx
mov qword [rbp + 0x28], rdi
mov qword [rbp + 0x20], rsi
mov qword [rbp + 0x40], rsi
test r13, r13
je 0x41272f
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
movsxd rdi, eax
add rdi, rdi
mov eax, 0x80000000
add rax, rdi
mov ecx, 0xffffffff
cmp rax, rcx
ja 0x412589
cmp edi, 0x400
jg 0x412521
movsxd r12, edi
mov rcx, r12
call fcn.00401170
test al, al
je 0x412521
lea rax, [r12 + 0xf]
cmp rax, r12
ja 0x41250e
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.0042a710
sub rsp, rax
lea r12, [rsp + 0x40]
jmp 0x412551
movsxd rcx, edi
or rax, 0xffffffffffffffff
sub rax, rcx
cmp rax, 0x10
jb 0x412724
add rcx, 0x10
call fcn.0041a9d0
test rax, rax
je 0x412589
mov qword [rax], rsi
mov rbx, rax
mov qword [rbp + 8], rax
lea r12, [rax + 0x10]
test r12, r12
je 0x412589
mov byte [r12], 0
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], r12
or r9d, 0xffffffff
mov r8, r13
xor edx, edx
mov ecx, dword [rbp]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
cmove r12, rsi
mov rsi, r12
test rsi, rsi
jne 0x412597
mov rsi, qword [rbp + 0x40]
jmp 0x41272f
xor edx, edx
lea r8d, [rdx + 2]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
mov qword [rbp + 0x18], rax
test rax, rax
jne 0x4125be
call fcn.0040f4c0
mov edi, eax
jmp 0x4126f4
mov r8, r15
mov rdx, r14
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdi, rax
test rax, rax
jne 0x4125e1
call fcn.0040f4c0
mov edi, eax
jmp 0x4126ea
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r12, rax
mov qword [rbp + 0x10], rax
test rax, rax
jne 0x412605
call fcn.0040f4c0
mov edi, eax
jmp 0x4126ea
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [rbp], edi
lea eax, [rdi + 1]
cmp eax, edi
jae 0x41265a
lea rax, [rbp + 0x48]
cmp qword [rbp + 0x40], rax
je 0x412631
lea rcx, [rbp + 0x40]
call fcn.0040fa20
nop
test rbx, rbx
je 0x412650
nop
nop
nop
mov rcx, rbx
mov rbx, qword [rbx]
call fcn.0041aaa0
test rbx, rbx
jne 0x412640
mov eax, 0x8007000e
jmp 0x412765
mov ecx, eax
test eax, eax
je 0x412694
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 1
jae 0x412679
mov ecx, 0x80070057
call fcn.00401050
cmp rcx, 0x400
jbe 0x412694
mov rdx, rcx
lea rcx, [rbp + 0x40]
call fcn.0040fa30
mov rcx, qword [rbp + 0x40]
jmp 0x41269c
lea rcx, [rbp + 0x48]
mov qword [rbp + 0x40], rcx
jmp 0x4126b1
test rcx, rcx
jne 0x4126bd
mov edi, 0x8007000e
jmp 0x4126ea
mov r9, rdi
mov r8, r12
mov rdx, rdi
call fcn.004027b0
mov r11, qword [rbp + 0x40]
mov byte [rdi + r11], 0
mov r8d, dword [rbp + 0x4c0]
mov rdx, qword [rbp + 0x40]
lea rcx, [rbp + 0x20]
call fcn.00411de0
mov edi, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rbp + 0x48]
cmp qword [rbp + 0x40], rax
je 0x412708
lea rcx, [rbp + 0x40]
call fcn.0040fa20
nop
test rbx, rbx
je 0x412720
nop
mov rcx, rbx
mov rbx, qword [rbx]
call fcn.0041aaa0
test rbx, rbx
jne 0x412710
mov eax, edi
jmp 0x412765
mov ecx, 0x80070057
call fcn.00401050
nop
lea rax, [rbp + 0x48]
cmp rsi, rax
je 0x412742
lea rcx, [rbp + 0x40]
call fcn.0040fa20
nop
test rbx, rbx
je 0x412760
nop
nop
nop
mov rcx, rbx
mov rbx, qword [rbx]
call fcn.0041aaa0
test rbx, rbx
jne 0x412750
mov eax, 0x8007000e
mov rcx, qword [rbp + 0x450]
xor rcx, rbp
call fcn.0041b280
mov rbx, qword [rbp + 0x4a0]
lea rsp, [rbp + 0x460]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret