Function at 0x140018d30
Capabilities:
Extract resource via kernel32 functions
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rbp, rdx
mov esi, r8d
mov edx, 0x1d8
xor ecx, ecx
mov r14d, r9d
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
test rax, rax
je 0x140018db4
xor edx, edx
mov r8d, 0xd4
mov rcx, rax
call fcn.1400c7510
mov rbx, qword [rsp + 0x90]
test rbx, rbx
je 0x140018de7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
xor ecx, ecx
movsxd rdx, eax
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rdi + 0x38], rax
test rax, rax
jne 0x140018ddb
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov r15d, 2
mov eax, r15d
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, r14d
mov dword [rdi + 0x2c], 0xffffffff
and eax, 0x3ffffff7
xor r12d, r12d
mov r15d, 1
sub eax, r15d
je 0x140018ed1
sub eax, r15d
je 0x140018e56
cmp eax, 2
jne 0x140018f45
lea rsi, [rdi + 8]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x30], 2
mov r9, rsi
mov rcx, rax
mov dword [rsp + 0x28], r12d
mov r8, rbx
mov dword [rsp + 0x20], r12d
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x140018e9b
mov qword [rsi], rbp
jmp 0x140018ea1
xor r9d, r9d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
lea rsi, [rdi + 8]
mov edx, 0x80000000
mov rcx, rbp
lea r8d, [r9 + 3]
mov dword [rsp + 0x20], r8d
test r14d, r14d
jns 0x140018e88
call qword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x140018e8e
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsi], rax
cmp rax, 0xffffffffffffffff
je 0x14001921c
mov dword [rdi], 2
mov rcx, qword [rsi]
mov r9d, r15d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rdi + 0x14], eax
cmp eax, 0xffffffff
jne 0x140018f45
mov rcx, rdi
mov r15d, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140018c60
jmp 0x140018dba
mov qword [rdi + 8], rbp
test rbp, rbp
je 0x140018edf
mov dword [rdi + 0x18], esi
jmp 0x140018f42
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movzx edx, si
mov r8d, 0xa
mov rcx, rax
mov rbx, rax
push rdi
call fcn.1402f1fb1
mov rsi, rax
test rax, rax
je 0x140019216
mov rdx, rax
mov rcx, rbx
push rcx
call fcn.1402a3f3d
test rax, rax
je 0x140019216
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rdi + 8], rax
test rax, rax
je 0x140019203
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rdi + 0x18], eax
mov dword [rdi], r15d
test r14b, 8
je 0x140018f80
xor eax, eax
mov qword [rdi + 0x48], rax
mov qword [rdi + 0x50], rax
mov qword [rdi + 0x58], rax
mov qword [rdi + 0x60], rax
mov qword [rdi + 0x68], rax
mov word [rdi + 0x70], ax
mov eax, 8
or dword [rdi], 8
mov word [rdi + 0x4e], ax
mov eax, dword [rdi + 0x14]
mov dword [rdi + 0x6e], eax
mov dword [rdi + 0x2c], r12d
jmp 0x1400191ac
test byte [rdi], r15b
jne 0x140018fa3
mov rcx, qword [rdi + 8]
mov r9d, 2
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov r13d, eax
sub r13d, dword [rdi + 0x14]
jmp 0x140018fab
mov r13d, dword [rdi + 0x18]
mov dword [rdi + 0x1c], r13d
mov r12d, 0xffff
mov edx, 0x404
cmp r13d, r12d
cmovb r12d, r13d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbx, rax
test rax, rax
je 0x140019203
mov ebp, 4
cmp r12d, ebp
jbe 0x140019021
nop dword [rax + rax]
lea ecx, [rbp + 0x400]
mov eax, 0x404
cmp ecx, r12d
mov ebp, ecx
mov r14d, r13d
cmova ebp, r12d
sub r14d, ebp
mov esi, ebp
cmp ebp, eax
cmova esi, eax
test byte [rdi], r15b
jne 0x14001904e
mov edx, dword [rdi + 0x14]
xor r9d, r9d
mov rcx, qword [rdi + 8]
add edx, r14d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x140019052
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
test byte [rdi], r15b
jne 0x140019179
mov edx, dword [rdi + 0x14]
xor r9d, r9d
mov rcx, qword [rdi + 8]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
xor r12d, r12d
jmp 0x140019180
mov dword [rdi + 0x1c], r14d
mov r8d, esi
mov rdx, rbx
mov rcx, rdi
call fcn.140017630
test eax, eax
je 0x140019021
add esi, 0xfffffffd
movsxd rax, esi
js 0x140019095
nop dword [rax]
dec rax
dec esi
cmp byte [rax + rbx], 0x50
jne 0x140019090
cmp byte [rax + rbx + 1], 0x4b
jne 0x140019090
cmp byte [rax + rbx + 2], 5
jne 0x140019090
cmp byte [rax + rbx + 3], 6
je 0x1400190a0
test rax, rax
jns 0x140019070
cmp ebp, r12d
jb 0x140018fe0
jmp 0x140019021
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
add r14d, esi
test byte [rdi], r15b
jne 0x1400190c9
mov edx, dword [rdi + 0x14]
xor r9d, r9d
mov rcx, qword [rdi + 8]
add edx, r14d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x1400190cd
mov dword [rdi + 0x1c], r14d
mov rcx, rdi
call fcn.140017790
mov rcx, rdi
call fcn.1400176d0
mov rcx, rdi
movzx ebx, ax
call fcn.1400176d0
mov rcx, rdi
movzx esi, ax
call fcn.1400176d0
movzx ecx, ax
mov dword [rdi + 0x20], ecx
mov rcx, rdi
call fcn.1400176d0
cmp dword [rdi + 0x10], 0
jne 0x140019192
movzx ecx, ax
cmp ecx, dword [rdi + 0x20]
jne 0x140019166
test si, si
jne 0x140019166
test bx, bx
jne 0x140019166
mov rcx, rdi
call fcn.140017790
mov rcx, rdi
mov ebx, eax
call fcn.140017790
mov rcx, rdi
mov dword [rdi + 0x34], eax
call fcn.1400176d0
cmp dword [rdi + 0x10], 0
movzx ecx, ax
mov dword [rdi + 0x24], ecx
jne 0x140019192
mov r8d, dword [rdi + 0x34]
mov edx, dword [rdi + 0x14]
lea ecx, [r8 + rbx]
lea eax, [rdx + r14]
cmp eax, ecx
jb 0x140019192
sub edx, r8d
sub edx, ebx
add edx, r14d
mov dword [rdi + 0x28], edx
jmp 0x1400191bd
mov rcx, rdi
mov r15d, 8
call fcn.140018c60
jmp 0x140018dba
xor r12d, r12d
mov dword [rdi + 0x1c], r12d
mov rcx, rdi
call fcn.1400176d0
mov ecx, 0x8b1f
cmp ax, cx
je 0x1400191a5
mov rcx, rdi
mov r15d, 6
call fcn.140018c60
jmp 0x140018dba
mov dword [rdi + 0x34], 3
mov eax, dword [rdi + 0x14]
or dword [rdi], 4
mov dword [rdi + 0x28], eax
mov dword [rdi + 0x10], r12d
mov dword [rdi + 0x20], r15d
lea rdx, [rdi + 0xd0]
mov ecx, 0x103
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x1400191e0
lea ecx, [rax - 1]
cmp byte [rcx + rdi + 0xd0], 0x5c
je 0x1400191f4
mov ecx, eax
inc eax
mov byte [rcx + rdi + 0xd0], 0x5c
mov byte [rax + rdi + 0xd0], 0
mov rax, qword [rsp + 0x70]
mov qword [rax], rdi
xor eax, eax
jmp 0x140018dbd
mov rcx, rdi
mov r15d, 2
call fcn.140018c60
jmp 0x140018dba
mov r15d, 4
mov rcx, rdi
call fcn.140018c60
jmp 0x140018dba