Function at 0x18000b0f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x180050010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbp, r8
mov qword [rsp + 0x38], r8
mov rdi, rdx
mov r13, rcx
test rdx, rdx
je 0x18000b3aa
call fcn.1800020d0
mov r14, rax
mov qword [rsp + 0x40], rax
mov rcx, qword [rax]
or rcx, 6
mov qword [rsp + 0x28], rbp
xor eax, eax
mov qword [rsp + 0x20], rax
mov r9, rdi
xor r8d, r8d
xor edx, edx
call fcn.18001d77c
mov r15d, eax
mov r12, 0xffffffffffffffff
test eax, eax
cmovs r15d, r12d
test r15d, r15d
js 0x18000b39f
mov rcx, qword [r13]
mov rcx, qword [rcx - 0x18]
test rcx, rcx
je 0x18000b18b
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x18000b1a5
call fcn.1800042a0
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rax, rax
je 0x18000b39f
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x50], rbx
mov esi, 1
cmp rdi, 0x10000
jae 0x18000b36a
movzx edi, di
mov dword [rsp + 0x30], edi
xor edx, edx
lea rcx, [0x180594bf0]
call fcn.180012eec
mov rbp, rax
mov r14d, esi
test rax, rax
je 0x18000b2c7
mov eax, edi
shr rax, 4
inc rax
mov qword [rsp + 0x48], rax
nop dword [rax + rax]
xor r9d, r9d
mov r8, rax
lea edx, [r9 + 6]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
mov rsi, rax
test rax, rax
je 0x18000b284
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x18000b284
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
je 0x18000b284
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, eax
add rdx, rdi
mov eax, dword [rsp + 0x30]
mov ecx, eax
and ecx, 0xf
jbe 0x18000b279
nop dword [rax]
cmp rdi, rdx
jae 0x18000b284
movzx eax, word [rdi]
lea rdi, [rdi + rax*2]
add rdi, 2
add ecx, 0xffffffff
jne 0x18000b260
mov eax, dword [rsp + 0x30]
cmp rdi, rdx
jae 0x18000b284
cmp word [rdi], 0
jne 0x18000b2a8
mov edx, r14d
inc r14d
lea rcx, [0x180594bf0]
call fcn.180012eec
mov rbp, rax
test rax, rax
je 0x18000b2c2
mov rax, qword [rsp + 0x48]
jmp 0x18000b200
test rbp, rbp
je 0x18000b2c2
mov r8d, eax
mov rdx, rbp
lea rcx, [rsp + 0x50]
call fcn.18000b7c0
mov rbx, qword [rsp + 0x50]
mov esi, 1
mov r14, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rdx, qword [r13]
sub esi, dword [rdx - 8]
mov eax, dword [rdx - 0xc]
sub eax, r15d
or esi, eax
jge 0x18000b2f1
mov edx, r15d
mov rcx, r13
call fcn.180009630
mov rdx, qword [r13]
lea eax, [r15 + 1]
movsxd r8, eax
mov rcx, qword [r14]
or rcx, 4
mov qword [rsp + 0x28], rbp
xor edi, edi
mov qword [rsp + 0x20], rdi
mov r9, rbx
call fcn.18001d9d8
mov rax, qword [r13]
cmp r15d, dword [rax - 0xc]
jg 0x18000b394
mov dword [rax - 0x10], r15d
movsxd rcx, r15d
mov rax, qword [r13]
mov word [rax + rcx*2], di
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], r12d
sub r12d, 1
jg 0x18000b345
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18000e2d0
mov rbx, qword [rsp + 0xb8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rax, r12
nop dword [rax]
inc rax
cmp word [rdi + rax*2], 0
jne 0x18000b370
mov r8d, eax
mov rdx, rdi
lea rcx, [rsp + 0x50]
call fcn.180009890
mov rbx, qword [rsp + 0x50]
jmp 0x18000b2d1
mov ecx, 0x80070057
call fcn.180002100
nop
mov ecx, 0x80004005
call fcn.180002100
int3
mov ecx, 0x80070057
call fcn.180002100
int3