Function at 0x1000b35c8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
xor r14d, r14d
mov r15, r9
mov rsi, r8
mov rdi, rcx
mov ebx, 0x80070057
test rdx, rdx
jne 0x1000b3634
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000b3a3a
test byte [rcx + 0x1c], 1
je 0x1000b3a3a
mov rcx, qword [rcx + 0x10]
lea edx, [r14 + 0x3f]
lea r8, [0x100002fe8]
call fcn.100020584
jmp 0x1000b3a3a
call fcn.1000b47bc
mov ebx, eax
test eax, eax
jns 0x1000b367d
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000b3a3a
test byte [rcx + 0x1c], 1
je 0x1000b3a3a
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002fe8]
mov edx, 0x40
mov r9d, ebx
call fcn.100020d8c
jmp 0x1000b3a3a
xor edx, edx
mov rcx, rsi
lea r8d, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov r12, rax
test rax, rax
jne 0x1000b36e6
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000b3a2c
test byte [rcx + 0x1c], 1
je 0x1000b3a2c
lea edx, [r12 + 0x41]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002fe8]
mov r9d, ebx
call fcn.100020d8c
jmp 0x1000b3a2c
lea r8, [0x10001ad10]
lea rdx, [0x10001ad38]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x1000b3741
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000b3a2c
test byte [rcx + 0x1c], 1
je 0x1000b3a2c
mov edx, 0x42
jmp 0x1000b36ce
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r13d, eax
lea ecx, [rax - 0x98]
cmp ecx, 0x7ff68
ja 0x1000b39eb
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r14, rax
test rax, rax
jne 0x1000b37b4
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000b3a1e
test byte [rcx + 0x1c], 1
je 0x1000b3a1e
lea edx, [r14 + 0x44]
jmp 0x1000b39c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rsi, rax
test rax, rax
jne 0x1000b3802
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000b3a1e
test byte [rcx + 0x1c], 1
je 0x1000b3a1e
lea edx, [rsi + 0x45]
jmp 0x1000b39c0
cmp dword [rax], 0x414d5153
je 0x1000b383a
mov ebx, 0x90070a0b
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000b3a1e
test byte [rcx + 0x1c], 1
je 0x1000b3a1e
mov edx, 0x46
jmp 0x1000b3a0e
lea rdx, [rdi + 0xc]
lea rcx, [rax + 0x18]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x1000b3880
mov ebx, 0x90070a0b
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000b3a1e
test byte [rcx + 0x1c], 1
je 0x1000b3a1e
mov edx, 0x47
lea r9, [rsi + 0x18]
jmp 0x1000b3979
mov eax, dword [rdi + 8]
cmp dword [rsi + 4], eax
je 0x1000b38b8
mov ebx, 0x90070a0b
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000b3a1e
test byte [rcx + 0x1c], 1
je 0x1000b3a1e
mov edx, 0x48
jmp 0x1000b3a0e
lea rbx, [rsi + 0x10]
test rbx, rbx
je 0x1000b38ee
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntdll.dll_NtQuerySystemTime]
test eax, eax
js 0x1000b38ee
mov eax, dword [rbx]
xor ecx, ecx
mov dword [rsp + 0x68], eax
mov eax, dword [rbx + 4]
mov dword [rsp + 0x6c], eax
mov rax, qword [rsp + 0x20]
cmp qword [rsp + 0x68], rax
setle cl
jmp 0x1000b38f3
mov ecx, 1
test ecx, ecx
je 0x1000b3927
mov ebx, 0x90070a0a
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000b3a1e
test byte [rcx + 0x1c], 1
je 0x1000b3a1e
mov edx, 0x49
jmp 0x1000b3a0e
lea r8, [0x10001a8f0]
mov r9d, 1
mov rdx, r15
mov rcx, rdi
call fcn.1000b2f7c
mov ebx, eax
test eax, eax
jns 0x1000b398e
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000b3a1e
test byte [rcx + 0x1c], 1
je 0x1000b3a1e
lea r9, [0x10000a3b0]
test r15, r15
mov edx, 0x4a
cmovne r9, r15
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002fe8]
call fcn.100020614
jmp 0x1000b3a1e
mov r8d, r13d
mov rdx, rsi
mov rcx, rdi
call fcn.1000b3f1c
mov ebx, eax
test eax, eax
jns 0x1000b39d5
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000b3a1e
test byte [rcx + 0x1c], 1
je 0x1000b3a1e
mov edx, 0x4b
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002fe8]
mov r9d, ebx
call fcn.100020d8c
jmp 0x1000b3a1e
mov eax, dword [rdi + 0xa0]
sub eax, dword [rdi + 0x90]
xor ebx, ebx
mov dword [rdi + 0x98], eax
jmp 0x1000b3a1e
mov ebx, 0x90070a0b
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000b3a2c
test byte [rcx + 0x1c], 1
je 0x1000b3a2c
mov edx, 0x43
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002fe8]
call fcn.100020584
test r14, r14
je 0x1000b3a2c
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeResource]
test r12, r12
je 0x1000b3a3a
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret