Function at 0x1400032fc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4a0
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x18], 0xfffffffffffffffe
mov qword [rbp + 0x4a0], rbx
mov rax, qword [0x1400991b0]
xor rax, rbp
mov qword [rbp + 0x450], rax
mov qword [rbp], r9
mov r13, r8
mov r12, rdx
xor edi, edi
mov ebx, edi
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x30], rcx
mov qword [rbp + 0x28], rdi
xor edx, edx
mov r8d, 0x408
lea rcx, [rbp + 0x40]
call fcn.14004d380
mov qword [rbp + 0x40], rdi
test r12, r12
je 0x1400035c6
or rax, 0xffffffffffffffff
inc rax
cmp word [r12 + rax*2], di
jne 0x140003370
inc eax
cdqe
lea r15, [rax + rax]
mov eax, 0x80000000
add rax, r15
mov ecx, 0xffffffff
cmp rax, rcx
ja 0x14000343a
movsxd rsi, r15d
cmp r15d, 0x400
jg 0x1400033d6
mov rcx, rsi
call fcn.140002404
test al, al
je 0x1400033d6
lea rax, [rsi + 0xf]
cmp rax, rsi
ja 0x1400033c3
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.14004bd60
sub rsp, rax
lea r14, [rsp + 0x40]
jmp 0x140003402
mov rax, rsi
not rax
cmp rax, 0x10
jb 0x14000361a
lea rcx, [rsi + 0x10]
call fcn.1400563ac
test rax, rax
je 0x14000343a
mov qword [rax], rdi
mov rbx, rax
mov qword [rbp + 0x20], rax
lea r14, [rax + 0x10]
test r14, r14
je 0x14000343a
mov byte [r14], dil
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r14
or r9d, 0xffffffff
mov r8, r12
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
neg eax
sbb rsi, rsi
and rsi, r14
jmp 0x14000343d
mov rsi, rdi
test rsi, rsi
je 0x1400035c6
xor edx, edx
lea r8d, [rdx + 0x60]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov r14, rax
mov qword [rbp + 8], rax
test rax, rax
jne 0x140003488
xor edx, edx
lea r8d, [rax + 2]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov r14, rax
mov qword [rbp + 8], rax
test rax, rax
jne 0x140003488
call fcn.140002634
mov esi, eax
jmp 0x14000359c
mov r8, qword [rbp]
mov rdx, r13
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rsi, rax
test rax, rax
jne 0x1400034aa
call fcn.140002634
jmp 0x14000358b
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r15, rax
mov qword [rbp + 0x10], rax
test rax, rax
je 0x1400034a0
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [rbp], esi
lea eax, [rsi + 1]
cmp eax, esi
jae 0x1400034e4
mov esi, 0x8007000e
jmp 0x14000358d
mov ecx, eax
test eax, eax
je 0x140003514
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 1
jb 0x140003625
cmp rcx, 0x400
jbe 0x140003514
mov rdx, rcx
lea rcx, [rbp + 0x40]
call fcn.1400192d4
jmp 0x14000351c
lea rax, [rbp + 0x48]
mov qword [rbp + 0x40], rax
jmp 0x14000352f
cmp qword [rbp + 0x40], rdi
je 0x1400034da
mov r9, rsi
mov r8, r15
mov rdx, rsi
mov rcx, qword [rbp + 0x40]
call fcn.140001610
test eax, eax
je 0x14000356f
cmp eax, 0xc
je 0x140003646
cmp eax, 0x16
je 0x14000363b
cmp eax, 0x22
je 0x14000363b
cmp eax, 0x50
jne 0x140003630
mov rax, qword [rbp + 0x40]
mov byte [rsi + rax], dil
mov r8d, dword [rbp + 0x4c0]
mov rdx, qword [rbp + 0x40]
lea rcx, [rbp + 0x28]
call fcn.140004954
mov esi, eax
test r14, r14
je 0x14000359c
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rbp + 0x48]
cmp qword [rbp + 0x40], rax
je 0x1400035b0
lea rcx, [rbp + 0x40]
call fcn.140018154
nop
jmp 0x1400035bd
mov rcx, rbx
mov rbx, qword [rbx]
call fcn.140056194
test rbx, rbx
jne 0x1400035b2
mov eax, esi
jmp 0x1400035f1
lea rax, [rbp + 0x48]
cmp qword [rbp + 0x40], rax
je 0x1400035da
lea rcx, [rbp + 0x40]
call fcn.140018154
nop
jmp 0x1400035e7
mov rcx, rbx
mov rbx, qword [rbx]
call fcn.140056194
test rbx, rbx
jne 0x1400035dc
mov eax, 0x8007000e
mov rcx, qword [rbp + 0x450]
xor rcx, rbp
call fcn.14004b000
mov rbx, qword [rbp + 0x4a0]
lea rsp, [rbp + 0x460]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80070216
call fcn.1400024a0
nop
mov ecx, 0x80070216
call fcn.1400024a0
nop
mov ecx, 0x80004005
call fcn.1400024a0
int3
mov ecx, 0x80070057
call fcn.1400024a0
int3
mov ecx, 0x8007000e
call fcn.1400024a0
int3