Function at 0x1401770e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x1402ba040]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rax, qword [rcx + 8]
xor r12d, r12d
cmp word [rax], 0x40
jne 0x1401774ff
mov rsi, qword [rcx]
lea r13, [rax + 2]
sub rsi, 2
mov rcx, r13
mov r11, rsi
mov r10, rsi
shr r11, 1
mov r9, r11
shr r10, 4
and r9d, 7
mov r8, r10
mov edx, r9d
test r10, r10
je 0x140177170
movdqa xmm1, xmmword [0x14028d510]
movdqu xmm0, xmmword [rcx]
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
bsf eax, eax
mov dword [rsp + 0x30], eax
jne 0x14017718d
add rcx, 0x10
sub r8, 1
jne 0x140177151
test rdx, rdx
je 0x140177186
cmp word [rcx], 0x2c
je 0x1401771a2
add rcx, 2
sub rdx, 1
jne 0x140177175
xor eax, eax
jmp 0x140177502
shl r8, 4
mov rcx, rsi
sub rcx, r8
shr rax, 1
shr rcx, 1
add rcx, rax
jmp 0x1401771a5
mov rcx, r11
sub rcx, rdx
cmp rcx, 0xffffffffffffffff
je 0x140177186
lea rdi, [rcx + rcx]
mov r8, rsi
lea rbx, [r13 + 2]
sub r8, rdi
add rbx, rdi
movzx r15d, r12b
sub r8, 2
je 0x1401771e5
movzx eax, word [rbx]
cmp ax, 0x2d
je 0x1401771da
cmp ax, 0x2b
jne 0x1401771e5
jmp 0x1401771dd
mov r15b, 1
add rbx, 2
add r8, 0xfffffffffffffffe
shr r8, 1
mov r14b, 1
mov rcx, r12
mov rdx, r12
je 0x140177225
lea rbp, [0x140287de0]
nop word [rax + rax]
movzx eax, byte [rbx + rdx*2]
mov eax, dword [rbp + rax*4]
cmp eax, 0xa
jae 0x140177217
lea rcx, [rcx + rcx*4]
lea rcx, [rax + rcx*2]
jmp 0x14017721a
xor r14b, r14b
inc rdx
cmp rdx, r8
jb 0x140177200
mov rbp, rcx
neg rbp
test r15b, r15b
cmove rbp, rcx
test r14b, r14b
jne 0x140177314
mov rcx, r13
test r10, r10
je 0x14017726c
movdqa xmm1, xmmword [0x14028d550]
nop dword [rax]
movdqu xmm0, xmmword ds:[rcx]
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
bsf edx, eax
jne 0x14017728d
add rcx, 0x10
sub r10, 1
jne 0x140177250
test r9, r9
je 0x140177186
cmp word [rcx], 0x3b
je 0x1401772a2
add rcx, 2
sub r9, 1
jne 0x140177275
xor eax, eax
jmp 0x140177502
shl r10, 4
mov r11, rsi
sub r11, r10
mov eax, edx
shr r11, 1
shr rax, 1
add r11, rax
sub r11, r9
cmp r11, 0xffffffffffffffff
je 0x140177186
lea rax, ds:[r11 + r11]
lea rdi, [r13 + 2]
sub rsi, rax
add rdi, rax
sub rsi, 2
jne 0x1401772d3
call sym.SystemInformer.exe_QiReferenceEmptyString
mov rbx, rax
jmp 0x140177502
mov rdx, qword [0x1402c4fb8]
lea rcx, ds:[rsi + 0x12]
call sym.SystemInformer.exe_QiCreateObject
mov rbx, rax
mov qword [rax], rsi
add rax, 0x10
mov qword [rbx + 8], rax
mov word [rax + rsi], r12w
test rdi, rdi
je 0x14017730c
mov rcx, qword [rbx + 8]
mov r8, rsi
mov rdx, rdi
call fcn.1402074d0
mov rax, rbx
jmp 0x140177502
test rdi, rdi
jne 0x140177323
call sym.SystemInformer.exe_QiReferenceEmptyString
mov rbx, rax
jmp 0x14017735a
mov rdx, qword [0x1402c4fb8]
lea rcx, [rdi + 0x12]
call sym.SystemInformer.exe_QiCreateObject
mov rbx, rax
mov qword [rax], rdi
add rax, 0x10
mov qword [rbx + 8], rax
mov word [rdi + rax], r12w
test r13, r13
je 0x14017735a
mov rcx, qword [rbx + 8]
mov r8, rdi
mov rdx, r13
call fcn.1402074d0
mov rax, qword [rbx + 8]
mov rsi, rbx
mov rdi, 0xffffffffffffffff
cmp word [rax], 0x25
jne 0x140177393
mov rcx, rbx
call sym.SystemInformer.exe_QiExpandEnvironmentStrings
test rax, rax
je 0x140177393
mov rsi, rax
lea rcx, [rbx - 0x10]
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140177393
call fcn.14013fb00
mov rcx, rsi
call sym.SystemInformer.exe_QiDetermineDosPathNameType
nop dword [rax + rax]
cmp eax, 5
jne 0x1401773da
mov rcx, qword [rsi + 8]
lea rdx, str..dll
call fcn.14013d5c0
test rax, rax
je 0x1401773da
mov rcx, rsi
mov rsi, rax
test rcx, rcx
je 0x1401773da
add rcx, 0xfffffffffffffff0
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1401773da
call fcn.14013fb00
lea r8, [rsp + 0x28]
xor edx, edx
mov rcx, rsi
call sym.SystemInformer.exe_QiLoadLibraryAsImageResource
test eax, eax
js 0x1401774ec
mov rbx, qword [rsp + 0x28]
lea r9, [rsp + 0x38]
neg ebp
mov qword [rsp + 0x48], 6
movzx eax, bp
mov qword [rsp + 0x58], r12
shr ax, 4
lea rdx, [rsp + 0x48]
inc ax
mov r8d, 3
movzx eax, ax
mov rcx, rbx
mov qword [rsp + 0x50], rax
call qword [sym.imp.ntdll.dll_LdrFindResource_U]
test eax, eax
js 0x1401774dc
lfence
mov rbx, qword [rsp + 0x28]
lea r9, [rsp + 0x24]
mov rdx, qword [rsp + 0x38]
lea r8, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_LdrAccessResource]
test eax, eax
js 0x1401774dc
mov rcx, qword [rsp + 0x40]
and ebp, 0xf
jbe 0x140177486
mov edx, ebp
nop dword [rax]
movzx eax, word ds:[rcx]
lea rcx, [rcx + rax*2]
add rcx, 2
sub rdx, 1
jne 0x140177470
movzx eax, word [rcx]
test ax, ax
je 0x1401774dc
mov edx, 0xfffe
cmp ax, dx
jae 0x1401774dc
mov rdx, qword [0x1402c4fb8]
lea rbp, [rcx + 2]
mov r15d, eax
add r15, r15
lea rcx, [r15 + 0x12]
call sym.SystemInformer.exe_QiCreateObject
mov r14, rax
mov qword [rax], r15
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [r15 + rcx], r12w
test rbp, rbp
je 0x1401774d9
mov rcx, qword [rax + 8]
mov r8, r15
mov rdx, rbp
call fcn.1402074d0
mov r12, r14
and rbx, 0xfffffffffffffffd
mov rcx, rdi
mov rdx, rbx
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
lea rcx, [rsi - 0x10]
lock xadd dword [rcx + 8], edi
cmp edi, 1
jne 0x1401774ff
call fcn.14013fb00
mov rax, r12
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1401e0100
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret