Function at 0x100008430
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov r11, rsp
sub rsp, 0x238
mov rax, qword [0x100011410]
mov qword [rsp + 0x200], rax
mov qword [r11 + 8], rbx
mov qword [r11 + 0x20], rdi
mov qword [r11 - 0x10], r13
mov qword [r11 - 0x18], r14
mov qword [r11 - 0x20], r15
xor r15d, r15d
cmp dword [0x1000130e8], r15d
mov dword [rsp + 0x38], r15d
mov r13d, r15d
mov r14d, r15d
mov dword [0x100012170], r15d
jne 0x10000852b
lea r8d, [r15 + 0xa]
lea rdx, [0x10000179c]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
cmp eax, 4
mov ebx, eax
ja 0x1000084f2
test eax, eax
je 0x1000084fb
lea r8d, [r15 + 0xa]
lea rdx, [0x10000179c]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rdi, rax
je 0x1000084fb
lea rcx, [0x100012b9c]
mov r8, rbx
mov rdx, rax
call sub.msvcrt.dll_memcpy
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeResource]
test ebx, ebx
je 0x1000084fb
cmp ebx, 4
jbe 0x10000852b
xor r9d, r9d
xor r8d, r8d
mov edx, 0x4b1
xor ecx, ecx
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 0x10
call fcn.100005260
mov dword [0x100012170], 0x80070714
xor eax, eax
jmp 0x100008a86
mov qword [rsp + 0x248], rbp
mov ebp, dword [rsp + 0x3c]
mov qword [rsp + 0x250], rsi
mov qword [rsp + 0x230], r12
mov r12, qword [rsp + 0x30]
mov esi, r15d
nop
xor edx, edx
lea rcx, [rsp + 0x80]
mov dword [rsp + 0x38], r15d
lea r8d, [rdx + 0x68]
call sub.msvcrt.dll_memset
cmp byte [0x100013302], r15b
mov dword [rsp + 0x80], 0x68
jne 0x1000087ef
lea rdx, [0x100001790]
mov r8d, 0xa
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
cmp eax, 4
mov ebx, eax
ja 0x100008601
test eax, eax
je 0x1000087bf
lea rdx, [0x100001790]
mov r8d, 0xa
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rdi, rax
je 0x1000087bf
lea rcx, [rsp + 0x3c]
mov r8, rbx
mov rdx, rax
call sub.msvcrt.dll_memcpy
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov ebp, dword [rsp + 0x3c]
test ebx, ebx
je 0x1000087bf
cmp ebx, 4
ja 0x1000087bf
cmp ebp, 1
jne 0x100008629
mov dword [rsp + 0xbc], ebp
mov word [rsp + 0xc0], r15w
jmp 0x10000865d
cmp ebp, 2
jne 0x100008645
mov dword [rsp + 0xbc], 1
mov word [rsp + 0xc0], 6
jmp 0x10000865d
cmp ebp, 3
jne 0x10000865d
mov dword [rsp + 0xbc], 1
mov word [rsp + 0xc0], bp
test esi, esi
jne 0x100008804
movzx eax, word [0x1000130f8]
test ax, ax
je 0x100008738
test al, 1
je 0x100008682
lea r12, [0x100001788]
jmp 0x100008692
test al, 2
lea rax, [0x100001780]
cmove rax, r12
mov r12, rax
mov r8d, 0xa
mov rdx, r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
cmp eax, 0x104
mov ebx, eax
ja 0x10000870c
test eax, eax
je 0x1000087bf
mov r8d, 0xa
mov rdx, r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rdi, rax
je 0x1000087bf
lea rcx, [rsp + 0xf0]
mov r8, rbx
mov rdx, rax
call sub.msvcrt.dll_memcpy
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeResource]
test ebx, ebx
je 0x1000087bf
lea rdx, [0x1000016d4]
lea rcx, [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x100008738
mov r13d, 1
jmp 0x1000088b9
test r13d, r13d
jne 0x1000088b9
lea r8d, [r13 + 0xa]
lea rdx, [0x100001770]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
cmp eax, 0x104
mov ebx, eax
ja 0x1000087b7
test eax, eax
je 0x1000087bf
lea r8d, [r13 + 0xa]
lea rdx, [0x100001770]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rdi, rax
je 0x1000087bf
lea rcx, [rsp + 0xf0]
mov r8, rbx
mov rdx, rax
call sub.msvcrt.dll_memcpy
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeResource]
test ebx, ebx
jne 0x1000088b9
xor r9d, r9d
xor r8d, r8d
mov edx, 0x4b1
xor ecx, ecx
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 0x10
call fcn.100005260
mov dword [0x100012170], 0x80070714
xor eax, eax
jmp 0x100008a6e
lea rdx, [0x100013302]
lea rcx, [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp esi, 1
jne 0x1000088b9
lea r8d, [rsi + 9]
lea rdx, [0x100001760]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
cmp eax, 0x104
mov ebx, eax
ja 0x100008887
test eax, eax
je 0x1000087bf
lea r8d, [rsi + 9]
lea rdx, [0x100001760]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rdi, rax
je 0x1000087bf
lea rcx, [rsp + 0xf0]
mov r8, rbx
mov rdx, rax
call sub.msvcrt.dll_memcpy
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeResource]
test ebx, ebx
je 0x1000087bf
cmp byte [0x100013302], r15b
jne 0x100008a5b
lea rdx, [0x1000016d4]
lea rcx, [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x100008a5b
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0xf0]
mov edx, 0x104
call fcn.100002ff0
test eax, eax
je 0x1000087e8
test r14d, r14d
jne 0x100008906
cmp word [0x100012178], 1
je 0x100008906
cmp dword [0x1000130e0], r15d
je 0x100008906
mov eax, dword [rsp + 0x38]
test eax, eax
jne 0x100008912
lea r14d, [rax + 1]
call fcn.100001f10
mov eax, dword [rsp + 0x38]
test eax, eax
je 0x100008a2b
cmp dword [0x100011404], r15d
je 0x100008ac3
test eax, eax
je 0x100008a2b
test byte [0x100012ba4], 4
je 0x100008a2b
lea rcx, [0x100001580]
call fcn.100004fc0
test rax, rax
mov rbx, rax
je 0x100008afe
lea rdx, str.DoInfInstall
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov r11, rax
je 0x100008b65
cmp dword [0x1000130f0], r15d
mov rcx, qword [rsp + 0x30]
lea rax, [0x1000122b8]
mov qword [rsp + 0x50], rcx
movzx ecx, word [0x100012178]
mov qword [rsp + 0x48], rax
lea rax, [0x100012350]
mov word [rsp + 0x68], cx
movzx ecx, word [0x1000130f8]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x6c], ecx
mov qword [rsp + 0x60], rax
je 0x1000089c4
bts ecx, 0x10
mov dword [rsp + 0x6c], ecx
mov eax, dword [0x100012ba4]
test al, 8
je 0x1000089d6
bts ecx, 0x11
mov dword [rsp + 0x6c], ecx
test al, 0x10
je 0x1000089e2
bts ecx, 0x12
mov dword [rsp + 0x6c], ecx
mov eax, dword [0x100013408]
test al, 0x40
je 0x1000089f4
bts ecx, 0x13
mov dword [rsp + 0x6c], ecx
test al, al
jns 0x100008a00
bts ecx, 0x14
mov dword [rsp + 0x6c], ecx
mov eax, dword [0x100012ba8]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x70], eax
call r11
test eax, eax
mov dword [0x100012170], eax
js 0x100008bb9
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x100008a45
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x80]
call fcn.100006ae0
test eax, eax
je 0x100008bc2
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LocalFree]
inc esi
cmp esi, 2
jb 0x100008550
cmp dword [0x100011490], r15d
je 0x100008a69
call fcn.1000021f0
mov eax, 1
mov rsi, qword [rsp + 0x250]
mov rbp, qword [rsp + 0x248]
mov r12, qword [rsp + 0x230]
mov r15, qword [rsp + 0x218]
mov r14, qword [rsp + 0x220]
mov r13, qword [rsp + 0x228]
mov rdi, qword [rsp + 0x258]
mov rbx, qword [rsp + 0x240]
mov rcx, qword [rsp + 0x200]
call fcn.10000ea20
add rsp, 0x238
ret
xor r9d, r9d
xor r8d, r8d
mov edx, 0x4c7
xor ecx, ecx
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 0x10
call fcn.100005260
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [0x100012170], 0x8007042b
xor eax, eax
jmp 0x100008a6e
lea r8, [0x100001580]
xor r9d, r9d
mov edx, 0x4c8
xor ecx, ecx
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 0x10
call fcn.100005260
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LocalFree]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x100008b49
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x100012170], eax
xor eax, eax
jmp 0x100008a6e
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
xor eax, eax
mov dword [0x100012170], ecx
jmp 0x100008a6e
lea r8, str.DoInfInstall
xor r9d, r9d
mov edx, 0x4c9
xor ecx, ecx
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 0x10
call fcn.100005260
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LocalFree]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x100008b49
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x100012170], eax
xor eax, eax
jmp 0x100008a6e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
jmp 0x100008a6e