Function at 0x1401c0870
Capabilities:
Extract resource via kernel32 functions
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x4f8
mov qword [rsp + 0x488], 0xfffffffffffffffe
mov dword [rsp + 0x480], 0
mov rdx, qword [rsp + 0x520]
lea rcx, [rsp + 0x3e0]
call fcn.14000e700
mov qword [rsp + 0x490], rax
mov rax, qword [rsp + 0x490]
mov qword [rsp + 0x498], rax
mov rcx, qword [rsp + 0x498]
call fcn.1400118c0
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.140002100
nop
lea rcx, [rsp + 0x3e0]
call fcn.140002ea0
lea rcx, [rsp + 0x70]
call fcn.140006eb0
movzx eax, al
test eax, eax
je 0x1401c0926
mov dword [rsp + 0x3e8], 0
lea rcx, [rsp + 0x70]
call fcn.140001490
mov eax, dword [rsp + 0x3e8]
jmp 0x1401c10af
mov r8d, 1
lea rdx, [rsp + 0x3f0]
lea rcx, [rsp + 0x70]
call fcn.140006b20
mov qword [rsp + 0x4a0], rax
mov rax, qword [rsp + 0x4a0]
mov qword [rsp + 0x4a8], rax
mov eax, dword [rsp + 0x480]
or eax, 1
mov dword [rsp + 0x480], eax
lea rdx, [0x14021fb6c]
mov rcx, qword [rsp + 0x4a8]
call fcn.140006d50
movzx eax, al
test eax, eax
jne 0x1401c09db
mov r8d, 1
lea rdx, [rsp + 0x3f8]
lea rcx, [rsp + 0x70]
call fcn.140006b20
mov qword [rsp + 0x4b0], rax
mov eax, dword [rsp + 0x480]
or eax, 2
mov dword [rsp + 0x480], eax
lea rdx, [0x14021fbdc]
mov rcx, qword [rsp + 0x4b0]
call fcn.140006d50
movzx eax, al
test eax, eax
jne 0x1401c09db
mov dword [rsp + 0x4b8], 0
jmp 0x1401c09e6
mov dword [rsp + 0x4b8], 1
movzx eax, byte [rsp + 0x4b8]
mov byte [rsp + 0x3ec], al
mov eax, dword [rsp + 0x480]
and eax, 2
test eax, eax
je 0x1401c0a19
and dword [rsp + 0x480], 0xfffffffd
lea rcx, [rsp + 0x3f8]
call fcn.140001490
nop
mov eax, dword [rsp + 0x480]
and eax, 1
test eax, eax
je 0x1401c0a3c
and dword [rsp + 0x480], 0xfffffffe
lea rcx, [rsp + 0x3f0]
call fcn.140001490
movzx eax, byte [rsp + 0x3ec]
test eax, eax
je 0x1401c0a98
mov r8d, 1
lea rdx, [rsp + 0x400]
lea rcx, [rsp + 0x70]
call fcn.140006a00
mov qword [rsp + 0x4c0], rax
mov rax, qword [rsp + 0x4c0]
mov qword [rsp + 0x4c8], rax
mov rdx, qword [rsp + 0x4c8]
lea rcx, [rsp + 0x70]
call fcn.140002db0
nop
lea rcx, [rsp + 0x400]
call fcn.140001490
lea rcx, [rsp + 0x70]
call fcn.14000f8f0
lea r8, [rsp + 0x58]
mov rdx, rax
lea rcx, [0x1403b4dc8]
call fcn.140023dc0
test eax, eax
je 0x1401c0af9
mov rcx, qword [rsp + 0x510]
mov rax, qword [rsp + 0x60]
mov qword [rcx], rax
mov rcx, qword [rsp + 0x518]
mov eax, dword [rsp + 0x58]
mov dword [rcx], eax
mov dword [rsp + 0x408], 1
lea rcx, [rsp + 0x70]
call fcn.140001490
mov eax, dword [rsp + 0x408]
jmp 0x1401c10af
xor r8d, r8d
lea rdx, [0x14022021c]
lea rcx, [rsp + 0x70]
call fcn.140006780
test eax, eax
jl 0x1401c0b32
mov dword [rsp + 0x40c], 0
lea rcx, [rsp + 0x70]
call fcn.140001490
mov eax, dword [rsp + 0x40c]
jmp 0x1401c10af
lea rcx, [rsp + 0x20]
call fcn.1400767b0
nop
lea rdx, [0x1403b4b60]
add rdx, 0x228
lea r8, str._tftp_
lea rcx, [rsp + 0x410]
call fcn.1400010b0
mov qword [rsp + 0x4d0], rax
mov rax, qword [rsp + 0x4d0]
mov qword [rsp + 0x4d8], rax
lea r8, [rsp + 0x70]
mov rdx, qword [rsp + 0x4d8]
lea rcx, [rsp + 0x50]
call fcn.140006bd0
nop
lea rcx, [rsp + 0x410]
call fcn.140001490
lea rcx, [rsp + 0x50]
call fcn.14000f8f0
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.1400768b4
test eax, eax
je 0x1401c0d08
lea rcx, [rsp + 0x20]
call fcn.1400764bc
lea rcx, [rsp + 0x20]
call fcn.140076508
mov dword [rsp + 0x58], eax
lea rcx, [rsp + 0x20]
call fcn.1400763e8
lea rcx, [rsp + 0x50]
call fcn.14000f8f0
lea rdx, [0x140220238]
mov rcx, rax
call fcn.1400aa368
mov qword [rsp + 0x78], rax
cmp qword [rsp + 0x78], 0
jne 0x1401c0c3d
mov dword [rsp + 0x418], 0
lea rcx, [rsp + 0x50]
call fcn.140001490
nop
lea rcx, [rsp + 0x20]
call fcn.14007680c
nop
lea rcx, [rsp + 0x70]
call fcn.140001490
mov eax, dword [rsp + 0x418]
jmp 0x1401c10af
mov ecx, dword [rsp + 0x58]
call fcn.140072250
mov qword [rsp + 0x420], rax
mov rax, qword [rsp + 0x420]
mov qword [rsp + 0x60], rax
mov edx, dword [rsp + 0x58]
mov r9, qword [rsp + 0x78]
mov r8d, 1
mov rcx, qword [rsp + 0x60]
call fcn.1400acf58
mov rcx, qword [rsp + 0x78]
call fcn.1400aa608
mov rdx, qword [rsp + 0x510]
mov rax, qword [rsp + 0x60]
mov qword [rdx], rax
mov rcx, qword [rsp + 0x518]
mov eax, dword [rsp + 0x58]
mov dword [rcx], eax
lea rdi, [rsp + 0x460]
lea rsi, [rsp + 0x58]
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x70]
call fcn.14000f8f0
lea r8, [rsp + 0x460]
mov rdx, rax
lea rcx, [0x1403b4dc8]
call fcn.140023e40
mov dword [rsp + 0x428], 1
lea rcx, [rsp + 0x50]
call fcn.140001490
nop
lea rcx, [rsp + 0x20]
call fcn.14007680c
nop
lea rcx, [rsp + 0x70]
call fcn.140001490
mov eax, dword [rsp + 0x428]
jmp 0x1401c10af
lea rcx, [rsp + 0x20]
call fcn.1400763e8
lea rcx, [rsp + 0x70]
call fcn.14000f8f0
mov rdi, rax
call fcn.14000cf20
lea r8, [0x140220240]
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rsp + 0x68], rax
lea rdx, [0x140220258]
lea rcx, [rsp + 0x430]
call fcn.1400ef320
mov qword [rsp + 0x4e0], rax
lea rdx, [0x140220248]
mov rcx, qword [rsp + 0x4e0]
call fcn.140006d90
mov byte [rsp + 0x42c], al
lea rcx, [rsp + 0x430]
call fcn.140001490
movzx edx, byte [rsp + 0x42c]
test edx, edx
je 0x1401c0e32
lea rdx, [0x140220268]
lea rcx, [rsp + 0x70]
call fcn.140006180
test eax, eax
jne 0x1401c0dc6
call fcn.14000cf20
lea r8, [0x140220280]
lea rdx, str.oem_gpxe.pxe
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rsp + 0x68], rax
lea rdx, [0x1402202a8]
lea rcx, [rsp + 0x70]
call fcn.140006180
test eax, eax
jne 0x1401c0dfc
call fcn.14000cf20
lea r8, [0x1402202c0]
lea rdx, [0x1402202c8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rsp + 0x68], rax
lea rdx, [0x1402202e8]
lea rcx, [rsp + 0x70]
call fcn.140006180
test eax, eax
jne 0x1401c0e32
call fcn.14000cf20
lea r8, [0x140220300]
lea rdx, [0x140220308]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rsp + 0x68], rax
cmp qword [rsp + 0x68], 0
je 0x1401c0f38
call fcn.14000cf20
mov rdx, qword [rsp + 0x68]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x58], eax
call fcn.14000cf20
mov rdx, qword [rsp + 0x68]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x80], rax
mov ecx, dword [rsp + 0x58]
call fcn.140072250
mov qword [rsp + 0x438], rax
mov rax, qword [rsp + 0x438]
mov qword [rsp + 0x60], rax
mov r8d, dword [rsp + 0x58]
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
call fcn.1400a9470
mov rdx, qword [rsp + 0x510]
mov rax, qword [rsp + 0x60]
mov qword [rdx], rax
mov rcx, qword [rsp + 0x518]
mov eax, dword [rsp + 0x58]
mov dword [rcx], eax
lea rdi, [rsp + 0x470]
lea rsi, [rsp + 0x58]
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x70]
call fcn.14000f8f0
lea r8, [rsp + 0x470]
mov rdx, rax
lea rcx, [0x1403b4dc8]
call fcn.140023e40
mov dword [rsp + 0x440], 1
lea rcx, [rsp + 0x50]
call fcn.140001490
nop
lea rcx, [rsp + 0x20]
call fcn.14007680c
nop
lea rcx, [rsp + 0x70]
call fcn.140001490
mov eax, dword [rsp + 0x440]
jmp 0x1401c10af
lea rcx, [0x14021fc1c]
call fcn.1400a98c0
mov rdi, rax
lea rcx, [rsp + 0x70]
call fcn.14000f8f0
mov r8, rdi
lea rdx, [0x140220328]
mov rcx, rax
call fcn.1400ab814
test eax, eax
jne 0x1401c1076
lea rcx, [rsp + 0x90]
call fcn.1401d19d0
nop
lea rax, [rsp + 0x448]
mov qword [rsp + 0x450], rax
mov r8d, 3
mov rdx, qword [rsp + 0x450]
lea rcx, [rsp + 0x70]
call fcn.140006a00
mov qword [rsp + 0x4e8], rax
mov rdx, qword [rsp + 0x4e8]
lea rcx, [rsp + 0x90]
call fcn.1401d7720
mov dword [rsp + 0x3d4], 0
mov dword [rsp + 0x3d0], 0
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x90]
call fcn.1401d6430
nop
cmp dword [rsp + 0x3d4], 0xffffffff
je 0x1401c105b
lea r9, [rsp + 0x3d4]
lea r8, [0x14021fccc]
lea rdx, [rsp + 0x3d8]
lea rcx, [rsp + 0x88]
call fcn.1400065a0
lea rcx, [rsp + 0x3d8]
call fcn.140006eb0
movzx eax, al
test eax, eax
je 0x1401c103b
lea rcx, [rsp + 0x3d8]
call fcn.140001490
jmp 0x1401c105b
mov eax, dword [rsp + 0x3d0]
add eax, 1
mov dword [rsp + 0x3d0], eax
lea rcx, [rsp + 0x3d8]
call fcn.140001490
jmp 0x1401c0fea
lea rcx, [rsp + 0x88]
call fcn.140001490
nop
lea rcx, [rsp + 0x90]
call fcn.140014ec0
mov dword [rsp + 0x458], 0
lea rcx, [rsp + 0x50]
call fcn.140001490
nop
lea rcx, [rsp + 0x20]
call fcn.14007680c
nop
lea rcx, [rsp + 0x70]
call fcn.140001490
mov eax, dword [rsp + 0x458]
jmp 0x1401c10af
add rsp, 0x4f8
pop rdi
pop rsi
ret