Function at 0x140042cd0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
mov qword [rsp + 0x80], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rdi, r8
mov r13, rdx
mov rbx, rcx
call fcn.14006061c
mov qword [rsp + 0x70], rax
xor r15d, r15d
mov dword [rsp + 0xd0], r15d
mov rcx, rdi
call fcn.14005b850
mov r12d, eax
xor ebp, ebp
xor esi, esi
xor edi, edi
nop
nop
mov rdx, qword [rbx + 0x368]
test rdx, rdx
jne 0x140042d40
xor ecx, ecx
jmp 0x140042d4e
mov rcx, qword [rbx + 0x370]
sub rcx, rdx
sar rcx, 4
mov eax, ebp
cmp rax, rcx
jae 0x140042ebe
test rdx, rdx
je 0x140042d71
mov rax, qword [rbx + 0x370]
sub rax, rdx
sar rax, 4
cmp rsi, rax
jb 0x140042d76
call fcn.14007e4b0
mov rax, qword [rbx + 0x368]
cmp r12d, dword [rdi + rax]
jne 0x140042db1
mov rcx, rax
test rax, rax
je 0x140042d9e
mov rax, qword [rbx + 0x370]
sub rax, rcx
sar rax, 4
cmp rsi, rax
jb 0x140042da3
call fcn.14007e4b0
mov rax, qword [rbx + 0x368]
cmp dword [rdi + rax + 4], r15d
jne 0x140042e20
mov rcx, qword [rbx + 0x368]
test rcx, rcx
je 0x140042dd0
mov rax, qword [rbx + 0x370]
sub rax, rcx
sar rax, 4
cmp rsi, rax
jb 0x140042dd5
call fcn.14007e4b0
mov rax, qword [rbx + 0x368]
cmp r12d, dword [rdi + rax]
jne 0x140042e10
mov rcx, rax
test rax, rax
je 0x140042dfd
mov rax, qword [rbx + 0x370]
sub rax, rcx
sar rax, 4
cmp rsi, rax
jb 0x140042e02
call fcn.14007e4b0
mov rax, qword [rbx + 0x368]
cmp qword [rax + rdi + 8], r15
jne 0x140042e6f
add ebp, 1
add rsi, 1
add rdi, 0x10
jmp 0x140042d30
mov edi, ebp
mov rcx, rax
test rax, rax
je 0x140042e3d
mov rax, qword [rbx + 0x370]
sub rax, rcx
sar rax, 4
cmp rdi, rax
jb 0x140042e42
call fcn.14007e4b0
add rdi, rdi
mov rax, qword [rbx + 0x368]
mov dword [rsp + 0x28], 0xffffff
xor ebp, ebp
mov dword [rsp + 0x20], ebp
xor r9d, r9d
mov r8d, dword [rax + rdi*8 + 4]
mov rdx, r13
mov rcx, rbx
call fcn.140043a00
jmp 0x140042ec0
mov edi, ebp
mov rcx, rax
test rax, rax
je 0x140042e8c
mov rax, qword [rbx + 0x370]
sub rax, rcx
sar rax, 4
cmp rdi, rax
jb 0x140042e91
call fcn.14007e4b0
add rdi, rdi
mov r8, qword [rbx + 0x368]
mov dword [rsp + 0x28], 0xffffff
xor ebp, ebp
mov dword [rsp + 0x20], ebp
xor r9d, r9d
mov r8, qword [r8 + rdi*8 + 8]
mov rdx, r13
mov rcx, rbx
call fcn.140043b90
jmp 0x140042ec0
xor ebp, ebp
mov esi, ebp
mov rdi, rbp
nop
nop
nop
mov rax, qword [rbx + 0x328]
test rax, rax
jne 0x140042ee1
mov rcx, rbp
jmp 0x140042eef
mov rcx, qword [rbx + 0x330]
sub rcx, rax
sar rcx, 2
mov eax, esi
mov r14d, 1
cmp rax, rcx
jae 0x140042f38
mov rcx, qword [rbx + 0x328]
test rcx, rcx
je 0x140042f1b
mov rax, qword [rbx + 0x330]
sub rax, rcx
sar rax, 2
cmp rdi, rax
jb 0x140042f20
call fcn.14007e4b0
mov rax, qword [rbx + 0x328]
cmp r12d, dword [rax + rdi*4]
je 0x140042f35
add esi, r14d
add rdi, r14
jmp 0x140042ed0
mov r15d, r14d
mov esi, ebp
mov rdi, rbp
nop
mov rax, qword [rbx + 0x348]
test rax, rax
jne 0x140042f51
mov rcx, rbp
jmp 0x140042f5f
mov rcx, qword [rbx + 0x350]
sub rcx, rax
sar rcx, 2
mov eax, esi
cmp rax, rcx
jae 0x140042fa4
mov rcx, qword [rbx + 0x348]
test rcx, rcx
je 0x140042f85
mov rax, qword [rbx + 0x350]
sub rax, rcx
sar rax, 2
cmp rdi, rax
jb 0x140042f8a
call fcn.14007e4b0
mov rax, qword [rbx + 0x348]
cmp r12d, dword [rax + rdi*4]
je 0x140042f9f
add esi, r14d
add rdi, r14
jmp 0x140042f40
mov edi, r14d
jmp 0x140042fab
mov edi, dword [rsp + 0xd0]
test r15d, r15d
je 0x140042fe9
mov dword [rsp + 0x88], r14d
mov dword [rsp + 0x8c], 0xffffff
mov qword [rsp + 0x90], rbp
lea rcx, [rsp + 0x88]
call qword [sym.imp.GDI32.dll_CreateBrushIndirect]
mov r15, rax
mov edx, r14d
mov rcx, r13
call fcn.1400643d8
jmp 0x140042fee
mov r15, qword [rsp + 0x70]
test edi, edi
je 0x140043078
mov qword [rsp + 0x78], rbp
lea rdi, [0x1400af3a0]
mov qword [rsp + 0x70], rdi
lea rax, str.Arial
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x60], ebp
mov dword [rsp + 0x58], ebp
mov dword [rsp + 0x50], ebp
mov dword [rsp + 0x48], ebp
mov dword [rsp + 0x40], ebp
mov dword [rsp + 0x38], ebp
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], 0x2bc
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0xe]
call qword [sym.imp.GDI32.dll_CreateFontW]
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.140065158
mov rax, qword [r13]
lea rdx, [rsp + 0x70]
mov rcx, r13
call qword [rax + 0x50]
nop
mov qword [rsp + 0x70], rdi
lea rcx, [rsp + 0x70]
call fcn.140041960
cmp r12d, dword [rbx + 0x314]
jne 0x14004340f
call fcn.1400588fc
mov rdx, rax
mov ecx, ebp
test rax, rax
setne cl
test ecx, ecx
jne 0x1400430a4
mov ecx, 0x80004005
call fcn.140011180
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea r10, [rax + 0x18]
mov qword [rsp + 0xd0], r10
lea r13, [0x1400b7504]
or rbp, 0xffffffffffffffff
test r13, 0xffffffffffff0000
jne 0x14004324e
movzx esi, r13w
mov ecx, esi
call fcn.140056050
mov r12, rax
test rax, rax
je 0x140043241
mov ecx, esi
shr ecx, 4
add cx, 1
movzx edx, cx
lea r8d, [rbp + 7]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r13, rax
test rax, rax
je 0x140043241
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140043241
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
je 0x140043241
mov rdx, r13
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rdi
and esi, 0xf
jbe 0x140043166
nop
cmp rdi, rcx
jae 0x140043241
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
add esi, 0xffffffff
jne 0x140043150
cmp rdi, rcx
jae 0x140043241
movzx eax, word [rdi]
test ax, ax
je 0x140043241
movzx esi, ax
mov r10, qword [rsp + 0xd0]
sub r14d, dword [r10 - 8]
mov eax, dword [r10 - 0xc]
sub eax, esi
or eax, r14d
jge 0x1400431ac
mov edx, esi
lea rcx, [rsp + 0xd0]
call fcn.1400111a0
mov r10, qword [rsp + 0xd0]
movzx ecx, word [rdi]
lea r8, [rdi + 2]
cmp ecx, 0xffffffff
jne 0x1400431c8
xor eax, eax
mov rcx, rbp
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
and ecx, ecx
lea rdi, [rsi + rsi]
movsxd r9, ecx
add r9, r9
mov rdx, rdi
mov rcx, r10
call fcn.14007d8e0
test eax, eax
je 0x140043207
cmp eax, 0xc
je 0x140043201
cmp eax, 0x16
je 0x1400431fb
cmp eax, 0x22
je 0x1400431fb
cmp eax, 0x50
je 0x140043207
call fcn.1400561a4
int3
call fcn.1400561a4
int3
call fcn.14005615c
int3
test esi, esi
js 0x140043236
mov rax, qword [rsp + 0xd0]
cmp esi, dword [rax - 0xc]
jg 0x140043236
mov dword [rax - 0x10], esi
mov rax, qword [rsp + 0xd0]
mov word [rdi + rax], 0
mov r10, qword [rsp + 0xd0]
jmp 0x140043379
mov ecx, 0x80070057
call fcn.140011180
int3
mov r10, qword [rsp + 0xd0]
jmp 0x140043379
xor eax, eax
mov rcx, rbp
mov rdi, r13
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
test ecx, ecx
jne 0x1400432dc
lea rdx, [r10 - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x140043379
cmp dword [rdx + 0x10], eax
jge 0x1400432ab
cmp dword [r10 - 0xc], eax
jge 0x14004328d
mov ecx, 0x80070057
call fcn.140011180
int3
mov dword [r10 - 0x10], eax
mov rax, qword [rsp + 0xd0]
mov word [rax], 0
mov r10, qword [rsp + 0xd0]
jmp 0x140043379
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400432c2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea r10, [rax + 0x18]
mov qword [rsp + 0xd0], r10
jmp 0x140043379
mov esi, dword [r10 - 0x10]
mov r12, r13
sub r12, r10
sar r12, 1
sub r14d, dword [r10 - 8]
mov eax, dword [r10 - 0xc]
sub eax, ecx
or eax, r14d
jge 0x14004330f
mov edx, ecx
lea rcx, [rsp + 0xd0]
call fcn.1400111a0
mov r10, qword [rsp + 0xd0]
cmp r12, rsi
ja 0x14004332f
movsxd rax, edi
lea rsi, [rax + rax]
lea r8, [r10 + r12*2]
mov r9, rsi
mov rdx, rsi
mov rcx, r10
call fcn.14007d9b0
jmp 0x140043347
movsxd rax, edi
lea rsi, [rax + rax]
mov r9, rsi
mov r8, r13
mov rdx, rsi
mov rcx, r10
call fcn.14007d8e0
test edi, edi
js 0x140043404
mov rax, qword [rsp + 0xd0]
cmp edi, dword [rax - 0xc]
jg 0x140043404
mov dword [rax - 0x10], edi
mov rax, qword [rsp + 0xd0]
mov word [rsi + rax], 0
mov r10, qword [rsp + 0xd0]
mov edx, dword [rbx + 0x318]
test edx, edx
je 0x1400433b1
lea r8, [rsp + 0xd0]
mov rcx, rbx
call fcn.140063978
mov r8, qword [rsp + 0xd0]
mov edx, dword [rbx + 0x318]
mov rcx, rbx
call fcn.14005b6a4
mov r10, qword [rsp + 0xd0]
mov edx, dword [rbx + 0x31c]
test edx, edx
je 0x1400433e9
lea r8, [rsp + 0xd0]
mov rcx, rbx
call fcn.140063978
mov r8, qword [rsp + 0xd0]
mov edx, dword [rbx + 0x31c]
mov rcx, rbx
call fcn.14005b6a4
mov r10, qword [rsp + 0xd0]
lea rdx, [r10 - 0x18]
lock xadd dword [rdx + 0x10], ebp
add ebp, 0xffffffff
test ebp, ebp
jg 0x14004340f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14004340f
mov ecx, 0x80070057
call fcn.140011180
nop
mov rax, r15
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret