Function at 0x1400c82c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x90
xor esi, esi
cmp word [rcx], 0x40
jne 0x1400c85dc
lea rbp, [rcx + 2]
mov qword [rsp + 0x48], rbp
call sym.ProcessHacker.exe_PhCountStringZ
lea edx, [rsi + 0x2c]
xor r8d, r8d
lea rcx, [rsp + 0x40]
lea rbx, [rax*2 - 2]
mov qword [rsp + 0x40], rbx
call sym.ProcessHacker.exe_PhFindCharInStringRef
cmp rax, 0xffffffffffffffff
je 0x1400c85ed
lea rdi, [rax + rax]
sub rbx, rdi
lea r11, [rbp + 2]
add r11, rdi
mov qword [rsp + 0x38], r11
lea rax, [rbx - 2]
xor bl, bl
mov qword [rsp + 0x30], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
test rax, rax
je 0x1400c834d
movzx eax, word [r11]
cmp ax, 0x2d
je 0x1400c8389
cmp ax, 0x2b
je 0x1400c838b
mov r11, qword [rsp + 0x38]
mov r8, qword [rsp + 0x30]
shr r8, 1
mov r10b, 1
mov rcx, rsi
mov rdx, rsi
je 0x1400c83a5
lea r14, [0x14016ae00]
nop dword [rax]
movzx eax, byte [r11 + rdx*2]
mov r9d, dword [r14 + rax*4]
cmp r9d, 0xa
jae 0x1400c839a
lea rcx, [rcx + rcx*4]
lea rcx, [r9 + rcx*2]
jmp 0x1400c839d
mov bl, 1
mov r8, qword [rsp + 0x30]
add r11, 2
sub r8, 2
jmp 0x1400c8357
xor r10b, r10b
inc rdx
cmp rdx, r8
jb 0x1400c8370
mov rax, rcx
neg rax
test bl, bl
cmove rax, rcx
mov qword [rsp + 0xd8], rax
test r10b, r10b
je 0x1400c85ed
mov qword [rsp + 0x80], r13
mov qword [rsp + 0x78], r15
test rdi, rdi
jne 0x1400c83de
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov rbx, rax
jmp 0x1400c8414
mov rdx, qword [0x140196800]
lea rcx, [rdi + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov rbx, rax
mov qword [rax], rdi
add rax, 0x10
mov qword [rbx + 8], rax
mov word [rax + rdi], si
test rbp, rbp
je 0x1400c8414
mov rcx, qword [rbx + 8]
mov r8, rdi
mov rdx, rbp
call fcn.14010e700
mov rax, qword [rbx + 8]
or ebp, 0xffffffff
mov r13, rbx
cmp word [rax], 0x25
jne 0x1400c8449
mov rcx, rbx
call sym.ProcessHacker.exe_PhExpandEnvironmentStrings
test rax, rax
je 0x1400c8449
mov r13, rax
lea rcx, [rbx - 0x10]
mov eax, ebp
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400c8449
call fcn.1400c8bc0
mov rcx, qword [r13 + 8]
xor edx, edx
lea r8d, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov r15, rax
test rax, rax
je 0x1400c85bc
mov r14d, dword [rsp + 0xd8]
lea r9, [rsp + 0x20]
neg r14d
mov qword [rsp + 0x50], 6
movzx ecx, r14w
mov qword [rsp + 0x60], rsi
shr cx, 4
lea rdx, [rsp + 0x50]
inc cx
mov r8d, 3
movzx ecx, cx
mov qword [rsp + 0x58], rcx
mov rcx, rax
call qword [sym.imp.ntdll.dll_LdrFindResource_U]
test eax, eax
js 0x1400c85b3
mov rdx, qword [rsp + 0x20]
lea r9, [rsp + 0xc0]
lea r8, [rsp + 0x30]
mov rcx, r15
call qword [sym.imp.ntdll.dll_LdrAccessResource]
test eax, eax
js 0x1400c85b3
mov rcx, qword [0x140196670]
mov edx, 4
mov rdi, qword [rsp + 0x30]
mov qword [rsp + 0x88], r12
mov r12d, dword [rsp + 0xc0]
mov r8d, r12d
mov dword [rsp + 0xd0], r12d
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, r12d
mov rdx, rdi
mov rcx, rax
mov qword [rsp + 0xc8], rax
call fcn.14010e700
mov rcx, qword [rsp + 0xc8]
and r14d, 0xf
jbe 0x1400c8541
mov edx, r14d
nop
movzx eax, word [rcx]
lea rcx, [rcx + rax*2]
add rcx, 2
sub rdx, 1
jne 0x1400c8530
movzx eax, word [rcx]
lea edx, [r12 - 1]
mov r12, qword [rsp + 0x88]
cmp edx, eax
cmovae edx, eax
test edx, edx
je 0x1400c859c
mov edi, edx
lea r14, [rcx + 2]
mov rdx, qword [0x140196800]
add rdi, rdi
lea rcx, [rdi + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov rbx, rax
mov qword [rax], rdi
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rcx + rdi], si
test r14, r14
je 0x1400c8599
mov rcx, qword [rax + 8]
mov r8, rdi
mov rdx, r14
call fcn.14010e700
mov rsi, rbx
mov r8, qword [rsp + 0xc8]
xor edx, edx
mov rcx, qword [0x140196670]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, [r13 - 0x10]
lock xadd dword [rcx + 8], ebp
mov r15, qword [rsp + 0x78]
mov r13, qword [rsp + 0x80]
cmp ebp, 1
jne 0x1400c85dc
call fcn.1400c8bc0
mov rax, rsi
add rsp, 0x90
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
xor eax, eax
add rsp, 0x90
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret