Function at 0x140002470
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rdi
push r12
push r13
push r15
lea rbp, [rsp - 0x420]
sub rsp, 0x520
mov rax, qword [0x140031008]
xor rax, rsp
mov qword [rbp + 0x410], rax
mov rbx, qword [0x140033570]
xor r13d, r13d
mov r12, rcx
mov edi, r13d
mov rcx, rbx
lea edx, [r13 + 1]
lea r8d, [r13 + 0x10]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x140002521
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rcx, rax
test rax, rax
je 0x140002521
cmp dword [rax], 0xfeef04bd
je 0x1400024fc
nop dword [rax + rax]
add rcx, 4
cmp dword [rcx], 0xfeef04bd
jne 0x1400024f0
mov eax, dword [rcx + 0x10]
mov edi, eax
mov ecx, dword [rcx + 0x14]
shr edi, 0x10
shl edi, 8
movzx eax, ax
add edi, eax
mov eax, ecx
shr eax, 0x10
shl edi, 8
add edi, eax
movzx eax, cx
shl edi, 8
add edi, eax
lea rdx, [rsp + 0x28]
mov qword [rsp + 0x558], rsi
mov rcx, r12
call fcn.140001ab0
mov r15, qword [rsp + 0x28]
test r15, r15
je 0x140002fa1
xor edx, edx
mov dword [rsp + 0x30], 0x5b
mov r8d, 0xc4
lea rcx, [rsp + 0x34]
call fcn.140015400
lea rdx, str.General
lea rcx, [rsp + 0x32]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x14002a480]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
movzx r9d, word [rsp + 0x30]
test r9w, r9w
jne 0x140002593
mov rbx, r15
jmp 0x140002600
movzx ecx, word [r15]
mov rax, r15
mov rbx, r13
test cx, cx
je 0x140002600
movzx r10d, word [rsp + 0x32]
nop dword [rax + rax]
lea r8, [rax + 2]
cmp cx, r9w
je 0x1400025bf
mov rax, r8
jmp 0x1400025f8
lea rcx, [rsp + 0x32]
mov rbx, rax
mov rax, r8
test r10w, r10w
je 0x1400025f3
movzx edx, word [rax]
test dx, dx
je 0x14000267d
cmp dx, word [rcx]
jne 0x14000267d
add rcx, 2
add rax, 2
cmp word [rcx], r13w
jne 0x1400025d0
test rbx, rbx
jne 0x140002600
movzx ecx, word [rax]
test cx, cx
jne 0x1400025b0
mov qword [rsp + 0x20], rbx
mov rsi, rbx
test rbx, rbx
jne 0x1400026ff
lea rcx, [rsp + 0x28]
call fcn.1400023b0
test eax, eax
je 0x1400026fa
xor edx, edx
mov dword [rbp], 0x5b
mov r8d, 0xc4
lea rcx, [rbp + 4]
call fcn.140015400
lea rdx, str.General
lea rcx, [rbp + 2]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x14002a480]
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
movzx r9d, word [rbp]
mov r15, qword [rsp + 0x28]
test r9w, r9w
jne 0x140002688
mov rbx, r15
mov qword [rsp + 0x20], rbx
mov rsi, rbx
jmp 0x1400026ff
mov rax, r8
mov rbx, r13
jmp 0x1400025f8
movzx ecx, word [r15]
mov rax, r15
mov rbx, r13
test cx, cx
je 0x1400026e8
movzx r10d, word [rbp + 2]
nop dword [rax]
lea r8, [rax + 2]
cmp cx, r9w
je 0x1400026af
mov rax, r8
jmp 0x1400026e0
lea rcx, [rbp + 2]
mov rbx, rax
mov rax, r8
test r10w, r10w
je 0x1400026db
nop
movzx edx, word [rax]
test dx, dx
je 0x1400026f2
cmp dx, word [rcx]
jne 0x1400026f2
add rcx, 2
add rax, 2
cmp word [rcx], r13w
jne 0x1400026c0
test rbx, rbx
jne 0x1400026e8
movzx ecx, word [rax]
test cx, cx
jne 0x1400026a0
mov qword [rsp + 0x20], rbx
mov rsi, rbx
jmp 0x1400026ff
mov rax, r8
mov rbx, r13
jmp 0x1400026e0
mov r15, qword [rsp + 0x28]
test r15, r15
je 0x140002fa1
test rsi, rsi
je 0x140002fa1
lea rsi, str.Version
mov qword [rsp + 0x560], r14
mov r10, rsi
mov rdi, r13
mov rdx, r13
nop dword [rax]
mov ecx, dword [rdx + rsi + 0x10]
sub ecx, 1
je 0x1400027a2
sub ecx, 1
je 0x14000278a
sub ecx, 1
je 0x140002772
sub ecx, 1
je 0x14000275e
cmp ecx, 1
jne 0x1400027bb
mov r8, qword [rdx + rsi + 8]
lea r9d, [rcx + 4]
mov rdx, qword [r10]
mov qword [r8], r13
jmp 0x1400027b3
mov r8, qword [rdx + rsi + 8]
mov r9d, 4
mov rdx, qword [r10]
mov word [r8], r13w
jmp 0x1400027b3
mov r8, qword [rdx + rsi + 8]
mov r9d, 0xffffffff
mov rdx, qword [r10]
mov rcx, rbx
call fcn.140001fa0
jmp 0x1400027bb
mov r8, qword [rdx + rsi + 8]
mov r9d, 0xffffffff
mov rdx, qword [r10]
mov rcx, rbx
call fcn.140001e40
jmp 0x1400027bb
mov r8, qword [rdx + rsi + 8]
mov r9d, 1
mov rdx, qword [r10]
mov dword [r8], r13d
mov rcx, rbx
call fcn.140002100
inc rdi
lea rax, [rdi + rdi*2]
lea rdx, [rax*8]
cmp qword [rdx + rsi], r13
lea r10, [rdx + rsi]
jne 0x140002730
test dword [0x140031a40], 0x800000
jne 0x1400027eb
and dword [0x140033578], 0xfffffffb
lea rcx, [rsp + 0x20]
call fcn.140003000
xor edx, edx
mov dword [rbp + 0xd0], 0x5b
mov r8d, 0xc4
lea rcx, [rbp + 0xd4]
mov esi, eax
call fcn.140015400
lea rdx, str.Search
lea rcx, [rbp + 0xd2]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x14002a480]
lea rcx, [rbp + 0xd0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
movzx r9d, word [rbp + 0xd0]
mov rbx, qword [rsp + 0x20]
test r9w, r9w
jne 0x140002855
mov rdi, rbx
jmp 0x1400028c2
movzx ecx, word [rbx]
mov rax, rbx
mov rdi, r13
test cx, cx
je 0x1400028c2
movzx r10d, word [rbp + 0xd2]
nop dword [rax + rax]
lea r8, [rax + 2]
cmp cx, r9w
je 0x14000287f
mov rax, r8
jmp 0x1400028ba
lea rcx, [rbp + 0xd2]
mov rdi, rax
mov rax, r8
test r10w, r10w
je 0x1400028b5
movzx edx, word [rax]
test dx, dx
je 0x1400029ff
cmp dx, word [rcx]
jne 0x1400029ff
add rcx, 2
add rax, 2
cmp word [rcx], r13w
jne 0x140002892
test rdi, rdi
jne 0x1400028cb
movzx ecx, word [rax]
test cx, cx
jne 0x140002870
test rdi, rdi
je 0x140002983
mov r9d, 1
mov dword [0x140039b20], r13d
lea r8, [0x140039b20]
mov rcx, rdi
lea rdx, str.PosX
call fcn.140002100
mov r9d, 1
mov dword [0x140039b24], r13d
lea r8, [0x140039b24]
mov rcx, rdi
lea rdx, str.PosY
call fcn.140002100
mov r9d, 1
mov dword [0x140039b28], r13d
lea r8, [0x140039b28]
mov rcx, rdi
lea rdx, str.Width
call fcn.140002100
mov r9d, 1
mov dword [0x140036bd8], r13d
lea r8, [0x140036bd8]
mov rcx, rdi
lea rdx, [0x14002a598]
call fcn.140002100
mov r9d, 4
mov word [0x140039b30], r13w
lea r8, [0x140039b30]
mov rcx, rdi
lea rdx, str.LastWord
call fcn.140002100
mov rbx, rdi
mov qword [rsp + 0x20], rbx
xor edx, edx
mov dword [rbp + 0x1a0], 0x5b
mov r8d, 0xc4
lea rcx, [rbp + 0x1a4]
call fcn.140015400
lea rdx, str.Unhook
lea rcx, [rbp + 0x1a2]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x14002a480]
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
movzx r9d, word [rbp + 0x1a0]
test r9w, r9w
je 0x140002a53
movzx eax, word [rbx]
mov r8, r13
test ax, ax
je 0x140002a50
movzx r10d, word [rbp + 0x1a2]
nop word [rax + rax]
lea rdx, [rbx + 2]
cmp ax, r9w
je 0x140002a0a
mov rbx, rdx
jmp 0x140002a48
mov rax, r8
mov rdi, r13
jmp 0x1400028ba
lea rax, [rbp + 0x1a2]
mov r8, rbx
mov rbx, rdx
test r10w, r10w
je 0x140002a43
nop dword [rax]
movzx ecx, word [rbx]
test cx, cx
je 0x140002b1b
cmp cx, word [rax]
jne 0x140002b1b
add rax, 2
add rbx, 2
cmp word [rax], r13w
jne 0x140002a20
test r8, r8
jne 0x140002a50
movzx eax, word [rbx]
test ax, ax
jne 0x1400029f0
mov rbx, r8
test rbx, rbx
je 0x140002ab2
mov r9d, 3
mov dword [rsp + 0x28], r13d
lea r8, [rsp + 0x28]
mov rcx, rbx
lea rdx, str.Flag
call fcn.140002100
test eax, eax
je 0x140002a85
mov eax, dword [rsp + 0x28]
mov dword [0x140031a7c], eax
mov r9d, 1
mov dword [rsp + 0x28], r13d
lea r8, [rsp + 0x28]
mov rcx, rbx
lea rdx, str.DelayTime
call fcn.140002100
test eax, eax
je 0x140002ab2
mov eax, dword [rsp + 0x28]
mov dword [0x140031a34], eax
lea rcx, [rsp + 0x20]
call fcn.140003450
mov r14d, eax
mov dword [rbp + 0x270], 0x5b
xor edx, edx
lea rcx, [rbp + 0x274]
mov r8d, 0xc4
and r14d, esi
call fcn.140015400
lea rdx, str.SubMenu
lea rcx, [rbp + 0x272]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x14002a480]
lea rcx, [rbp + 0x270]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
movzx r9d, word [rbp + 0x270]
test r9w, r9w
jne 0x140002b26
mov rbx, r15
jmp 0x140002b96
mov rbx, rdx
mov r8, r13
jmp 0x140002a48
movzx ecx, word [r15]
mov rax, r15
mov rbx, r13
test cx, cx
je 0x140002b96
movzx r10d, word [rbp + 0x272]
nop dword [rax]
lea r8, [rax + 2]
cmp cx, r9w
je 0x140002b4f
mov rax, r8
jmp 0x140002b8e
lea rcx, [rbp + 0x272]
mov rbx, rax
mov rax, r8
test r10w, r10w
je 0x140002b85
movzx edx, word [rax]
test dx, dx
je 0x140002bf8
cmp dx, word [rcx]
jne 0x140002bf8
add rcx, 2
add rax, 2
cmp word [rcx], r13w
jne 0x140002b62
test rbx, rbx
jne 0x140002c73
movzx ecx, word [rax]
test cx, cx
jne 0x140002b40
test rbx, rbx
jne 0x140002c73
xor edx, edx
mov dword [rbp + 0x340], 0x5b
mov r8d, 0xc4
lea rcx, [rbp + 0x344]
call fcn.140015400
lea rdx, str.FolderMenu
lea rcx, [rbp + 0x342]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x14002a480]
lea rcx, [rbp + 0x340]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
movzx r9d, word [rbp + 0x340]
test r9w, r9w
jne 0x140002c00
mov rbx, r15
jmp 0x140002c6a
mov rax, r8
mov rbx, r13
jmp 0x140002b8e
movzx ecx, word [r15]
mov rax, r15
mov rbx, r13
test cx, cx
je 0x140002c6a
movzx r10d, word [rbp + 0x342]
nop word [rax + rax]
lea r8, [rax + 2]
cmp cx, r9w
je 0x140002c2f
mov rax, r8
jmp 0x140002c62
lea rcx, [rbp + 0x342]
mov rbx, rax
mov rax, r8
test r10w, r10w
je 0x140002c5d
movzx edx, word [rax]
test dx, dx
je 0x140002cb1
cmp dx, word [rcx]
jne 0x140002cb1
add rcx, 2
add rax, 2
cmp word [rcx], r13w
jne 0x140002c42
test rbx, rbx
jne 0x140002c73
movzx ecx, word [rax]
test cx, cx
jne 0x140002c20
test rbx, rbx
je 0x140002d33
lea rsi, str.CountLimit
mov rdi, r13
mov r10, rsi
mov rdx, r13
mov ecx, dword [rdx + rsi + 0x10]
sub ecx, 1
je 0x140002cfd
sub ecx, 1
je 0x140002ce5
sub ecx, 1
je 0x140002ccd
sub ecx, 1
je 0x140002cb9
cmp ecx, 1
jne 0x140002d16
mov r8, qword [rdx + rsi + 8]
lea r9d, [rcx + 4]
mov rdx, qword [r10]
mov qword [r8], r13
jmp 0x140002d0e
mov rax, r8
mov rbx, r13
jmp 0x140002c62
mov r8, qword [rdx + rsi + 8]
mov r9d, 4
mov rdx, qword [r10]
mov word [r8], r13w
jmp 0x140002d0e
mov r8, qword [rdx + rsi + 8]
mov r9d, 0xffffffff
mov rdx, qword [r10]
mov rcx, rbx
call fcn.140001fa0
jmp 0x140002d16
mov r8, qword [rdx + rsi + 8]
mov r9d, 0xffffffff
mov rdx, qword [r10]
mov rcx, rbx
call fcn.140001e40
jmp 0x140002d16
mov r8, qword [rdx + rsi + 8]
mov r9d, 1
mov rdx, qword [r10]
mov dword [r8], r13d
mov rcx, rbx
call fcn.140002100
inc rdi
lea rax, [rdi + rdi*2]
lea rdx, [rax*8]
cmp qword [rdx + rsi], r13
lea r10, [rdx + rsi]
jne 0x140002c83
mov qword [rsp + 0x20], r15
call fcn.140001900
lea rcx, [rsp + 0x20]
call fcn.140003800
lea rcx, [rsp + 0x20]
call fcn.140003e20
movdqa xmm1, xmmword [0x14002cc80]
lea rcx, [rsp + 0x20]
xorps xmm0, xmm0
movdqu xmmword [0x140033160], xmm1
movdqa xmm1, xmmword [0x14002cc60]
mov edi, eax
xor eax, eax
mov dword [0x1400334c8], 1
movups xmmword [0x140033198], xmm0
and edi, r14d
mov dword [0x1400334cc], 1
movdqa xmm0, xmmword [0x14002cc70]
movdqu xmmword [0x140033150], xmm0
xorps xmm0, xmm0
movups xmmword [0x1400331ac], xmm0
mov qword [0x140033178], rax
movups xmmword [0x1400331bc], xmm0
mov dword [0x1400331a8], eax
movups xmmword [0x1400331cc], xmm0
mov dword [0x140033170], 3
movups xmmword [0x1400331dc], xmm0
mov dword [0x140033174], 4
movups xmmword [0x1400331ec], xmm0
mov dword [0x140033188], 0x19
movdqa xmm0, xmmword [0x14002cc50]
movdqu xmmword [0x1400331b0], xmm0
xorps xmm0, xmm0
movups xmmword [0x140033264], xmm0
mov dword [0x140033180], 0x17
movups xmmword [0x140033284], xmm0
mov dword [0x14003318c], 0x20
movups xmmword [0x140033208], xmm0
mov dword [0x140033190], 0x16
movups xmmword [0x140033294], xmm0
mov dword [0x140033184], 0x1e
movups xmmword [0x1400332a4], xmm0
mov dword [0x140033194], 0x1d
movups xmmword [0x140033218], xmm0
mov qword [0x1400331fc], rax
movups xmmword [0x140033228], xmm0
mov dword [0x140033204], eax
movups xmmword [0x140033238], xmm0
mov dword [0x1400331ac], 0x26
movups xmmword [0x140033248], xmm0
mov dword [0x1400331d0], 4
movdqa xmm0, xmmword [0x14002cca0]
movdqu xmmword [0x140033274], xmm0
mov qword [0x140033258], rax
movdqa xmm0, xmmword [0x14002ccb0]
movdqu xmmword [0x140033290], xmm0
movdqu xmmword [0x1400331c0], xmm1
mov dword [0x140033260], eax
mov dword [0x140033208], 0x24
mov dword [0x14003320c], 0x28
mov qword [0x1400332b4], rax
mov dword [0x1400332bc], eax
mov dword [0x140033264], 0x44
mov dword [0x140033268], 0x3b
mov dword [0x14003326c], 0x38
mov dword [0x140033270], 0x39
mov dword [0x140033284], 0x30
mov dword [0x140033288], 0x31
mov dword [0x1400332a0], 0x4b
mov dword [0x1400332a8], 0x43
call fcn.1400041d0
lea rcx, [rsp + 0x20]
call fcn.140004470
lea rcx, [rsp + 0x20]
call fcn.140004e10
mov rcx, qword [rsp + 0x20]
mov ebx, eax
and ebx, edi
call fcn.1400050c0
mov edi, eax
and edi, ebx
mov rcx, qword [0x140036ed8]
and edi, 1
mov r14, qword [rsp + 0x560]
test rcx, rcx
je 0x140002f8e
call qword [sym.imp.KERNEL32.dll_HeapDestroy]
mov qword [0x140036ed8], r13
test edi, edi
je 0x140002fc9
mov rcx, r12
call fcn.140005ec0
mov eax, 1
jmp 0x140002fcb
xor edx, edx
mov dword [0x140033598], edi
xor ecx, ecx
call fcn.1400011d0
mov rcx, qword [0x140036ed8]
test rcx, rcx
je 0x140002fc9
call qword [sym.imp.KERNEL32.dll_HeapDestroy]
mov qword [0x140036ed8], r13
xor eax, eax
mov rsi, qword [rsp + 0x558]
mov rcx, qword [rbp + 0x410]
xor rcx, rsp
call fcn.140013ba0
mov rbx, qword [rsp + 0x568]
add rsp, 0x520
pop r15
pop r13
pop r12
pop rdi
pop rbp
ret