Function at 0x18000bacc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov rax, qword [rsp + 0x58]
mov r15, rdx
mov edx, 0x228
mov qword [rsp + 0x50], rax
xor ecx, ecx
mov byte [rsp + 0x40], 0
mov r13d, r9d
mov r12, r8
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rsi, rax
test rax, rax
je 0x18000bb5f
xor edx, edx
mov r8d, 0x124
mov rcx, rax
call fcn.180056d30
mov rdi, qword [rsp + 0xb0]
mov ebp, 1
test rdi, rdi
je 0x18000bb8c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, ebp
xor ecx, ecx
movsxd rdx, eax
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rsi + 0x50], rax
test rax, rax
jne 0x18000bb80
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov ebp, 2
mov eax, ebp
lea r11, [rsp + 0x60]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
or qword [rsi + 0x38], 0xffffffffffffffff
mov eax, r13d
mov ecx, 3
and eax, 0x3ffffff7
lea r14d, [rcx - 1]
sub eax, ebp
je 0x18000bc5d
sub eax, ebp
je 0x18000bbf5
cmp eax, r14d
jne 0x18000bcd0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x30], r14d
lea r9, [rsi + 8]
and dword [rsp + 0x28], 0
mov rcx, rax
and dword [rsp + 0x20], 0
mov r8, rdi
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x18000bc36
mov qword [rsi + 8], r15
mov rcx, r15
jmp 0x18000bc3d
and qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov r8d, ecx
mov dword [rsp + 0x20], ecx
mov rcx, r15
mov edx, 0x80000000
test r13d, r13d
jns 0x18000bc22
call qword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x18000bc28
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsi + 8], rax
cmp rax, 0xffffffffffffffff
je 0x18000c051
mov rcx, qword [rsi + 8]
mov dword [rsi], r14d
mov r9d, ebp
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsi + 0x14], eax
cmp eax, 0xffffffff
jne 0x18000bcd0
mov ebp, select
jmp 0x18000c051
mov qword [rsi + 8], r15
test r15, r15
jne 0x18000bcca
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movzx edx, r12w
mov r8d, 0xa
mov rcx, rax
mov r15, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x18000c04c
mov rdx, rax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x18000c04c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsi + 8], rax
test rax, rax
je 0x18000c047
mov rdx, rdi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r12d, eax
mov qword [rsi + 0x18], r12
mov dword [rsi], ebp
mov ecx, 8
test cl, r13b
je 0x18000bd18
xor eax, eax
xorps xmm0, xmm0
movups xmmword [rsi + 0x60], xmm0
movups xmmword [rsi + 0x70], xmm0
mov qword [rsi + 0x80], rax
mov word [rsi + 0x88], ax
and qword [rsi + 0x38], rax
mov r8d, dword [rsi + 0x14]
mov eax, dword [rsi]
or eax, ecx
mov word [rsi + 0x66], cx
mov dword [rsi + 0x86], r8d
mov qword [rsi + 0x9a], r8
jmp 0x18000bfe9
test byte [rsi], bpl
jne 0x18000bd44
mov rcx, qword [rsi + 8]
lea r8, [rsp + 0x48]
and qword [rsp + 0x48], 0
mov r9d, r14d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov eax, dword [rsi + 0x14]
mov r12, qword [rsp + 0x48]
sub r12, rax
jmp 0x18000bd4c
mov r12, qword [rsi + 0x18]
mov qword [rsi + 0x20], r12
mov r13d, 0xffff
mov edx, 0x404
cmp r12, r13
cmovl r13, r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
test rax, rax
je 0x18000c047
mov eax, 4
cmp r13, rax
jle 0x18000be2a
lea rcx, [rax + 0x400]
mov rdx, r13
cmp rcx, r13
mov eax, r12d
mov r14, r12
cmovle rdx, rcx
mov ecx, 0x404
sub r14, rdx
mov qword [rsp + 0x58], rdx
sub eax, r14d
cmp rdx, rcx
mov rdx, r14
cmova eax, ecx
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x48], eax
call fcn.18000c9c4
test eax, eax
jne 0x18000be2a
mov r8d, dword [rsp + 0x48]
mov rdx, rdi
mov rcx, rsi
call fcn.18000c69c
test eax, eax
je 0x18000be2a
mov edx, dword [rsp + 0x48]
add edx, 0xfffffffd
movsxd rax, edx
js 0x18000be1c
lea rcx, [rax + 3]
mov r8, 0xfffffffffffffffd
add rcx, rdi
sub r8, rdi
mov rax, rcx
sub edx, ebp
sub rcx, rbp
cmp byte [rcx - 3], 0x50
jne 0x18000be13
cmp byte [rax - 3], 0x4b
jne 0x18000be13
cmp byte [rcx - 1], 5
jne 0x18000be13
cmp byte [rcx], 6
je 0x18000be60
lea rax, [r8 + rcx]
test rax, rax
jns 0x18000bdf4
mov rax, qword [rsp + 0x58]
cmp rax, r13
jl 0x18000bd80
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call fcn.18000c9c4
mov rcx, rsi
call fcn.180009064
mov ecx, 0x8b1f
cmp ax, cx
je 0x18000bfdb
mov ebp, 6
jmp 0x18000c051
movsxd rax, edx
cmp byte [rax + rdi - 0x14], 0x50
jne 0x18000be89
cmp byte [rax + rdi - 0x13], 0x4b
jne 0x18000be89
cmp byte [rax + rdi - 0x12], 6
jne 0x18000be89
cmp byte [rax + rdi - 0x11], 7
jne 0x18000be89
mov r14, qword [rax + rdi - 0xc]
mov r13b, bpl
jmp 0x18000be91
mov r13b, byte [rsp + 0x40]
add r14, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
xor r8d, r8d
mov rdx, r14
mov rcx, rsi
call fcn.18000c9c4
mov rcx, rsi
call fcn.180008f80
mov rcx, rsi
test r13b, r13b
je 0x18000bef5
call fcn.180008fd4
mov rcx, rsi
mov qword [rsp + 0x50], rax
call fcn.180008f80
mov rcx, rsi
call fcn.180008f80
mov rcx, rsi
mov r12d, eax
call fcn.180008f80
mov rcx, rsi
mov edi, eax
call fcn.180008fd4
mov rcx, rsi
mov qword [rsi + 0x28], rax
call fcn.180008fd4
jmp 0x18000bf23
call fcn.180009064
mov rcx, rsi
movzx r12d, ax
call fcn.180009064
mov rcx, rsi
movzx edi, ax
call fcn.180009064
movzx eax, ax
mov rcx, rsi
mov qword [rsi + 0x28], rax
call fcn.180009064
movzx eax, ax
cmp dword [rsi + 0x10], 0
jne 0x18000be56
cmp rax, qword [rsi + 0x28]
jne 0x18000bfd4
test edi, edi
jne 0x18000bfd4
test r12d, r12d
jne 0x18000bfd4
mov rcx, rsi
test r13b, r13b
je 0x18000bf83
call fcn.180008fd4
mov rcx, rsi
mov rdi, rax
call fcn.180008fd4
mov qword [rsi + 0x48], rax
xor r8d, r8d
mov ecx, dword [rsi + 0x14]
add rcx, qword [rsp + 0x50]
add rcx, rdi
lea rdx, [rax + 0x34]
add rdx, rcx
mov rcx, rsi
call fcn.18000c9c4
jmp 0x18000bf98
call fcn.180008f80
mov rcx, rsi
mov edi, eax
call fcn.180008f80
mov eax, eax
mov qword [rsi + 0x48], rax
mov rcx, rsi
call fcn.180009064
cmp dword [rsi + 0x10], 0
movzx eax, ax
mov dword [rsi + 0x30], eax
jne 0x18000be56
mov r8d, dword [rsi + 0x14]
mov rcx, qword [rsi + 0x48]
add rcx, rdi
lea rdx, [r14 + r8]
cmp rdx, rcx
jb 0x18000be56
sub r8d, edi
sub r8d, dword [rsi + 0x48]
add r8d, r14d
jmp 0x18000bff6
mov ebp, 8
jmp 0x18000c051
mov r8d, dword [rsi + 0x14]
mov eax, dword [rsi]
mov qword [rsi + 0x48], 3
and dword [rsi + 0x10], 0
or eax, 4
mov qword [rsi + 0x28], rbp
mov dword [rsi], eax
movsxd rcx, dword [rsp + 0xb8]
mov dword [rsi + 0x34], r8d
test rcx, rcx
jle 0x18000c01f
xor edx, edx
mov al, byte [r15 + rdx*2]
mov byte [rsi + rdx + 0x120], al
add rdx, rbp
cmp rdx, rcx
jl 0x18000c009
test rcx, rcx
je 0x18000c02b
cmp byte [rcx + rsi + 0x11f], 0x5c
je 0x18000c035
mov word [rcx + rsi + 0x120], 0x5c
mov rax, qword [rsp + 0x90]
mov qword [rax], rsi
xor eax, eax
jmp 0x18000bb66
mov ebp, r14d
jmp 0x18000c051
mov ebp, 4
mov rcx, rsi
call fcn.1800076f8
jmp 0x18000bb64