Function at 0x1000249a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rcx
mov rax, rsp
sub rsp, 0x98
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov qword [rax - 8], rsi
mov qword [rax - 0x10], rdi
mov qword [rax - 0x18], r12
mov qword [rax - 0x20], r13
mov qword [rax - 0x28], r14
mov qword [rax - 0x30], r15
mov rbx, rdx
mov rdi, rcx
mov dword [rax - 0x74], 0
lea rcx, [0x1000a9318]
mov rax, qword [0x1000a9318]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rdi], rax
mov r14d, 1
mov dword [rsp + 0x24], r14d
lea rcx, [0x1000a9318]
mov rax, qword [0x1000a9318]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0xa8], rax
lea rcx, [0x1000a9318]
mov rax, qword [0x1000a9318]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
xor ebp, ebp
mov dword [rsp + 0x20], ebp
xor r12d, r12d
mov r13, qword [rbx]
mov dword [rsp + 0xa8], ebp
lea eax, [rbp - 1]
test r13, r13
je 0x10002528d
mov r9, qword [rsp + 0x40]
jmp 0x100024a75
mov eax, 0xffffffff
mov r15, r13
mov r13, qword [r13]
mov qword [rsp + 0x28], r13
mov rsi, qword [r15 + 0x10]
lea rdi, [rsi - 0x18]
lea rbx, [r9 - 0x18]
cmp rdi, rbx
je 0x100024c2b
cmp dword [rbx + 0x10], 0
jl 0x100024b27
mov rcx, qword [rdi]
cmp rcx, qword [rbx]
jne 0x100024b27
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rdi + 0x10], 0
jl 0x100024ac5
cmp rax, qword [rdi]
jne 0x100024ac5
mov rsi, rdi
lock inc dword [rdi + 0x10]
jmp 0x100024afd
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rdi + 8]
call qword [rax]
mov rsi, rax
test rax, rax
je 0x100024d42
mov ecx, dword [rdi + 8]
mov dword [rax + 8], ecx
mov ecx, dword [rdi + 8]
inc ecx
movsxd r8, ecx
add r8, r8
lea rdx, [rdi + 0x18]
lea rcx, [rax + 0x18]
call sub.msvcrt.dll_memcpy
mov eax, 0xffffffff
lock xadd dword [rbx + 0x10], eax
dec eax
test eax, eax
jg 0x100024b19
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea r9, [rsi + 0x18]
mov qword [rsp + 0x40], r9
jmp 0x100024c2b
movsxd rdi, dword [rsi - 0x10]
test edi, edi
jne 0x100024b97
mov rdi, qword [rbx]
cmp dword [rbx + 8], 0
je 0x100024c2b
cmp dword [rbx + 0x10], 0
jge 0x100024b69
cmp dword [r9 - 0xc], 0
jl 0x100024d48
mov dword [r9 - 0x10], 0
mov rax, qword [rsp + 0x40]
mov word [rax], 0
mov r9, qword [rsp + 0x40]
jmp 0x100024c2b
lock xadd dword [rbx + 0x10], eax
dec eax
test eax, eax
jg 0x100024b80
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea r9, [rax + 0x18]
mov qword [rsp + 0x40], r9
jmp 0x100024c2b
test rsi, rsi
je 0x100024d53
mov r13d, dword [r9 - 0x10]
mov rbp, rsi
sub rbp, r9
sar rbp, 1
mov ecx, r14d
sub ecx, dword [rbx + 0x10]
mov eax, dword [rbx + 0xc]
sub eax, edi
or eax, ecx
jge 0x100024bcd
mov edx, edi
lea rcx, [rsp + 0x40]
call fcn.1000140c0
mov r9, qword [rsp + 0x40]
cmp rbp, r13
ja 0x100024be7
lea rbx, [rdi + rdi]
lea rdx, [r9 + rbp*2]
mov r8, rbx
mov rcx, r9
call sub.msvcrt.dll_memmove
jmp 0x100024bf9
lea rbx, [rdi + rdi]
mov r8, rbx
mov rdx, rsi
mov rcx, r9
call sub.msvcrt.dll_memcpy
test edi, edi
js 0x100024d5e
mov rax, qword [rsp + 0x40]
cmp edi, dword [rax - 0xc]
jg 0x100024d5e
mov dword [rax - 0x10], edi
mov rax, qword [rsp + 0x40]
mov word [rbx + rax], 0
mov r9, qword [rsp + 0x40]
mov ebp, dword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov rdx, qword [r15 + 0x18]
lea rbx, [rdx - 0x18]
mov rdi, qword [rsp + 0x48]
add rdi, 0xffffffffffffffe8
cmp rbx, rdi
je 0x100024cef
cmp dword [rdi + 0x10], 0
jl 0x100024cdc
mov rcx, qword [rbx]
cmp rcx, qword [rdi]
jne 0x100024cdc
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rbx + 0x10], 0
jl 0x100024c78
cmp rax, qword [rbx]
jne 0x100024c78
mov rsi, rbx
lock inc dword [rbx + 0x10]
jmp 0x100024cb0
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rbx + 8]
call qword [rax]
mov rsi, rax
test rax, rax
je 0x100024d69
mov ecx, dword [rbx + 8]
mov dword [rax + 8], ecx
mov ecx, dword [rbx + 8]
inc ecx
movsxd r8, ecx
add r8, r8
lea rdx, [rbx + 0x18]
lea rcx, [rax + 0x18]
call sub.msvcrt.dll_memcpy
mov eax, 0xffffffff
lock xadd dword [rdi + 0x10], eax
dec eax
test eax, eax
jg 0x100024ccc
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rsi + 0x18]
mov qword [rsp + 0x48], rax
mov r9, qword [rsp + 0x40]
jmp 0x100024cef
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x48]
call fcn.100014b20
mov r9, qword [rsp + 0x40]
mov eax, dword [r15 + 0x20]
mov dword [rsp + 0x50], eax
test eax, eax
jle 0x100024d27
cmp eax, 4
jg 0x100024d30
mov ecx, dword [rsp + 0xa8]
inc ecx
mov dword [rsp + 0xa8], ecx
test r12d, r12d
jne 0x100024d1a
mov r12d, eax
jmp 0x100024d37
cmp eax, r12d
cmovne ebp, r14d
mov dword [rsp + 0x20], ebp
jmp 0x100024d37
mov ecx, dword [rsp + 0xa8]
jmp 0x100024d37
mov ecx, dword [rsp + 0xa8]
test r13, r13
jne 0x100024a70
jmp 0x100024d6f
call fcn.100013cb0
int3
mov ecx, 0x80070057
call fcn.100013860
int3
mov ecx, 0x80070057
call fcn.100013860
int3
mov ecx, 0x80070057
call fcn.100013860
int3
call fcn.100013cb0
int3
test ecx, ecx
je 0x100025285
test ebp, ebp
je 0x100024e8a
xor ebp, ebp
mov rbx, rbp
xor edx, edx
lea rcx, [0x1000a92a0]
call fcn.100047064
mov rdi, rax
test rax, rax
je 0x10002527b
nop
test rbx, rbx
jne 0x100025271
xor r9d, r9d
lea edx, [rbx + 6]
mov r8d, 0x13c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
mov rsi, rax
test rax, rax
jne 0x100024dcb
mov rbx, rbp
jmp 0x100024e38
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x100024de1
mov rbx, rbp
jmp 0x100024e33
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
jne 0x100024df7
mov rbx, rbp
jmp 0x100024e33
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, eax
add rdx, rbx
mov ecx, 4
nop
cmp rbx, rdx
jae 0x100024e27
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
add ecx, 0xffffffff
jne 0x100024e10
cmp rbx, rdx
jb 0x100024e2c
mov rbx, rbp
jmp 0x100024e33
cmp word [rbx], bp
cmove rbx, rbp
test rbx, rbx
jne 0x100024e63
mov edx, r14d
lea rcx, [0x1000a92a0]
call fcn.100047064
mov rdi, rax
inc r14d
test rax, rax
jne 0x100024da0
mov rdi, qword [rsp + 0xa0]
jmp 0x10002528d
test rdi, rdi
je 0x100025267
mov r8d, 0x13b4
mov rdx, rdi
mov rdi, qword [rsp + 0xa0]
mov rcx, rdi
call fcn.1000149f0
jmp 0x10002528d
dec r12d
je 0x1000251b6
dec r12d
je 0x1000250b0
dec r12d
je 0x100024fba
dec r12d
jne 0x100025200
xor ebp, ebp
mov rbx, rbp
xor edx, edx
lea rcx, [0x1000a92a0]
call fcn.100047064
mov rdi, rax
test rax, rax
je 0x10002525d
nop
test rbx, rbx
jne 0x100025253
xor r9d, r9d
lea edx, [rbx + 6]
mov r8d, 0x13e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
mov rsi, rax
test rax, rax
jne 0x100024efb
mov rbx, rbp
jmp 0x100024f68
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x100024f11
mov rbx, rbp
jmp 0x100024f63
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
jne 0x100024f27
mov rbx, rbp
jmp 0x100024f63
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, eax
add rdx, rbx
mov ecx, 3
nop
cmp rbx, rdx
jae 0x100024f57
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
add ecx, 0xffffffff
jne 0x100024f40
cmp rbx, rdx
jb 0x100024f5c
mov rbx, rbp
jmp 0x100024f63
cmp word [rbx], bp
cmove rbx, rbp
test rbx, rbx
jne 0x100024f93
mov edx, r14d
lea rcx, [0x1000a92a0]
call fcn.100047064
mov rdi, rax
inc r14d
test rax, rax
jne 0x100024ed0
mov rdi, qword [rsp + 0xa0]
jmp 0x10002528d
test rdi, rdi
je 0x100025249
mov r8d, 0x13d3
mov rdx, rdi
mov rdi, qword [rsp + 0xa0]
mov rcx, rdi
call fcn.1000149f0
jmp 0x10002528d
xor ebp, ebp
mov rbx, rbp
xor edx, edx
lea rcx, [0x1000a92a0]
call fcn.100047064
mov rdi, rax
test rax, rax
je 0x10002523f
nop
nop
test rbx, rbx
jne 0x100025235
xor r9d, r9d
lea edx, [rbx + 6]
mov r8d, 0x13b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
mov rsi, rax
test rax, rax
jne 0x10002500b
mov rbx, rbp
jmp 0x10002505e
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x100025021
mov rbx, rbp
jmp 0x100025059
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
jne 0x100025037
mov rbx, rbp
jmp 0x100025059
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
cmp rbx, rcx
jb 0x100025052
mov rbx, rbp
jmp 0x100025059
cmp word [rbx], bp
cmove rbx, rbp
test rbx, rbx
jne 0x100025089
mov edx, r14d
lea rcx, [0x1000a92a0]
call fcn.100047064
mov rdi, rax
inc r14d
test rax, rax
jne 0x100024fe0
mov rdi, qword [rsp + 0xa0]
jmp 0x10002528d
test rdi, rdi
je 0x10002522b
mov r8d, 0x13a0
mov rdx, rdi
mov rdi, qword [rsp + 0xa0]
mov rcx, rdi
call fcn.1000149f0
jmp 0x10002528d
xor ebp, ebp
mov rbx, rbp
xor edx, edx
lea rcx, [0x1000a92a0]
call fcn.100047064
mov rdi, rax
test rax, rax
je 0x100025221
nop
test rbx, rbx
jne 0x100025217
xor r9d, r9d
lea edx, [rbx + 6]
mov r8d, 0x13a
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
mov rsi, rax
test rax, rax
jne 0x1000250fb
mov rbx, rbp
jmp 0x100025168
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x100025111
mov rbx, rbp
jmp 0x100025163
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
jne 0x100025127
mov rbx, rbp
jmp 0x100025163
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, eax
add rdx, rbx
mov ecx, 0xf
nop
cmp rbx, rdx
jae 0x100025157
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
add ecx, 0xffffffff
jne 0x100025140
cmp rbx, rdx
jb 0x10002515c
mov rbx, rbp
jmp 0x100025163
cmp word [rbx], bp
cmove rbx, rbp
test rbx, rbx
jne 0x100025193
mov edx, r14d
lea rcx, [0x1000a92a0]
call fcn.100047064
mov rdi, rax
inc r14d
test rax, rax
jne 0x1000250d0
mov rdi, qword [rsp + 0xa0]
jmp 0x10002528d
test rdi, rdi
je 0x10002520d
mov r8d, 0x139f
mov rdx, rdi
mov rdi, qword [rsp + 0xa0]
mov rcx, rdi
call fcn.1000149f0
jmp 0x10002528d
lea rcx, [rsp + 0x30]
call fcn.100020170
nop
mov rdx, rax
mov rdi, qword [rsp + 0xa0]
mov rcx, rdi
call fcn.100015fc0
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x10002528d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x10002528d
mov rdi, qword [rsp + 0xa0]
jmp 0x10002528d
mov rdi, qword [rsp + 0xa0]
jmp 0x10002528d
mov rdi, qword [rsp + 0xa0]
jmp 0x10002528d
mov rdi, qword [rsp + 0xa0]
jmp 0x10002528d
mov rdi, qword [rsp + 0xa0]
jmp 0x10002528d
mov rdi, qword [rsp + 0xa0]
jmp 0x10002528d
mov rdi, qword [rsp + 0xa0]
jmp 0x10002528d
mov rdi, qword [rsp + 0xa0]
jmp 0x10002528d
mov rdi, qword [rsp + 0xa0]
jmp 0x10002528d
mov rdi, qword [rsp + 0xa0]
jmp 0x10002528d
mov rdi, qword [rsp + 0xa0]
jmp 0x10002528d
mov rdi, qword [rsp + 0xa0]
jmp 0x10002528d
mov rdi, qword [rsp + 0xa0]
jmp 0x10002528d
mov rdi, qword [rsp + 0xa0]
lea rax, [rsp + 0x48]
mov qword [rsp + 0xa8], rax
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1000252bf
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
dec ebx
test ebx, ebx
jg 0x1000252dc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, rdi
mov rbx, qword [rsp + 0xb0]
mov rbp, qword [rsp + 0xb8]
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov r12, qword [rsp + 0x80]
mov r13, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r15, qword [rsp + 0x68]
add rsp, 0x98
ret