Function at 0x7ff7c00c3d30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x7ff7c01ca008]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor esi, esi
mov rbx, rcx
cmp word [rcx], 0x40
jne 0x7ff7c00c40c9
call sym.ProcessHacker.exe_PhCountStringZ
add rax, rax
lea rbp, [rbx + 2]
lea edx, [rsi + 0x2c]
mov qword [rsp + 0x60], rbp
xor r8d, r8d
lea rcx, [rsp + 0x58]
lea rbx, [rax - 2]
mov qword [rsp + 0x58], rbx
call sym.ProcessHacker.exe_PhFindCharInStringRef
nop
cmp rax, 0xffffffffffffffff
je 0x7ff7c00c40f3
lea rdi, [rax + rax]
mov r8, rbx
lea r11, [rbp + 2]
sub r8, rdi
add r11, rdi
xor r15b, r15b
mov qword [rsp + 0x48], r11
add r8, 0xfffffffffffffffe
mov qword [rsp + 0x40], r8
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
je 0x7ff7c00c3ddc
movzx eax, word ds:[r11]
cmp ax, 0x2d
je 0x7ff7c00c3e19
cmp ax, 0x2b
je 0x7ff7c00c3e1c
mov r11, qword [rsp + 0x48]
shr r8, 1
mov r10b, 1
mov rcx, rsi
mov rdx, rsi
je 0x7ff7c00c3e36
lea r14, [0x7ff7c018a7b0]
nop word [rax + rax]
movzx eax, byte [r11 + rdx*2]
mov r9d, dword [r14 + rax*4]
cmp r9d, 0xa
jae 0x7ff7c00c3e2b
lea rcx, [rcx + rcx*4]
lea rcx, [r9 + rcx*2]
jmp 0x7ff7c00c3e2e
mov r15b, 1
mov r8, qword [rsp + 0x40]
add r11, 2
add r8, 0xfffffffffffffffe
jmp 0x7ff7c00c3de1
xor r10b, r10b
inc rdx
cmp rdx, r8
jb 0x7ff7c00c3e00
mov r14, rcx
neg r14
test r15b, r15b
cmove r14, rcx
test r10b, r10b
jne 0x7ff7c00c3ec5
mov edx, 0x3b
lea rcx, [rsp + 0x58]
xor r8d, r8d
call sym.ProcessHacker.exe_PhFindCharInStringRef
cmp rax, 0xffffffffffffffff
je 0x7ff7c00c40f3
add rax, rax
add rbp, 2
sub rbx, rax
add rbp, rax
lea rdi, [rbx - 2]
test rdi, rdi
jne 0x7ff7c00c3e87
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov rbx, rax
jmp 0x7ff7c00c40cc
mov rdx, qword [0x7ff7c01d3b58]
lea rcx, [rdi + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov rbx, rax
mov qword [rax], rdi
add rax, 0x10
mov qword [rbx + 8], rax
mov word [rax + rdi], si
test rbp, rbp
je 0x7ff7c00c3ebd
mov rcx, qword [rbx + 8]
mov r8, rdi
mov rdx, rbp
call fcn.7ff7c0125120
mov rax, rbx
jmp 0x7ff7c00c40cc
mov qword ss:[rsp + 0xd0], r13
test rdi, rdi
jne 0x7ff7c00c3edf
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov rbx, rax
jmp 0x7ff7c00c3f15
mov rdx, qword [0x7ff7c01d3b58]
lea rcx, [rdi + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov rbx, rax
mov qword [rax], rdi
add rax, 0x10
mov qword [rbx + 8], rax
mov word [rax + rdi], si
test rbp, rbp
je 0x7ff7c00c3f15
mov rcx, qword [rbx + 8]
mov r8, rdi
mov rdx, rbp
call fcn.7ff7c0125120
mov rax, qword [rbx + 8]
mov r13, rbx
mov ebp, 0xffffffff
cmp word [rax], 0x25
jne 0x7ff7c00c3f4d
mov rcx, rbx
call sym.ProcessHacker.exe_PhExpandEnvironmentStrings
nop
test rax, rax
je 0x7ff7c00c3f4d
mov r13, rax
lea rcx, [rbx - 0x10]
mov eax, ebp
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x7ff7c00c3f4d
call fcn.7ff7c00c6290
mov rcx, qword [r13 + 8]
xor edx, edx
lea r8d, [rdx + 0x22]
call qword [sym.imp.kernel32.dll_LoadLibraryExW]
mov r15, rax
test rax, rax
je 0x7ff7c00c40ae
neg r14d
mov qword [rsp + 0x68], 6
movzx ecx, r14w
mov qword [rsp + 0x78], rsi
shr cx, 4
lea r9, [rsp + 0x50]
inc cx
lea rdx, [rsp + 0x68]
movzx ecx, cx
mov r8d, 3
mov qword [rsp + 0x70], rcx
mov rcx, rax
call qword [sym.imp.ntdll.dll_LdrFindResource_U]
test eax, eax
js 0x7ff7c00c40a5
mov rdx, qword [rsp + 0x50]
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x40]
mov rcx, r15
call qword [sym.imp.ntdll.dll_LdrAccessResource]
test eax, eax
js 0x7ff7c00c40a5
mov rcx, qword [0x7ff7c01d3cd0]
mov edx, 4
mov rdi, qword [rsp + 0x40]
mov qword [rsp + 0xc8], r12
mov r12d, dword [rsp + 0x20]
mov r8d, r12d
mov dword [rsp + 0x30], r12d
call qword [sym.imp.kernel32.dll_HeapAlloc_1]
mov r8d, r12d
mov rdx, rdi
mov rcx, rax
mov qword [rsp + 0x28], rax
call fcn.7ff7c0125120
mov rcx, qword [rsp + 0x28]
and r14d, 0xf
jbe 0x7ff7c00c4036
mov edx, r14d
nop dword [rax + rax]
movzx eax, word ds:[rcx]
lea rcx, [rcx + rax*2]
add rcx, 2
sub rdx, 1
jne 0x7ff7c00c4020
movzx eax, word [rcx]
lea edx, [r12 - 1]
mov r12, qword [rsp + 0xc8]
cmp edx, eax
cmovae edx, eax
test edx, edx
je 0x7ff7c00c4091
mov edi, edx
lea r14, [rcx + 2]
mov rdx, qword [0x7ff7c01d3b58]
add rdi, rdi
lea rcx, [rdi + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov rbx, rax
mov qword [rax], rdi
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rcx + rdi], si
test r14, r14
je 0x7ff7c00c408e
mov rcx, qword [rax + 8]
mov r8, rdi
mov rdx, r14
call fcn.7ff7c0125120
mov rsi, rbx
mov r8, qword [rsp + 0x28]
xor edx, edx
mov rcx, qword [0x7ff7c01d3cd0]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, r15
call qword [sym.imp.kernel32.dll_FreeLibrary]
lea rcx, [r13 - 0x10]
lock xadd dword [rcx + 8], ebp
mov r13, qword [rsp + 0xd0]
cmp ebp, 1
jne 0x7ff7c00c40c9
call fcn.7ff7c00c6290
mov rax, rsi
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.7ff7c0121390
mov rbx, qword [rsp + 0xd8]
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
xor eax, eax
jmp 0x7ff7c00c40cc