Function at 0x180020dd0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rdi
push r12
push r13
push r14
lea rbp, [rsp - 0x340]
sub rsp, 0x440
mov rax, qword [0x180039000]
xor rax, rsp
mov qword [rbp + 0x330], rax
mov dword [rsp + 0x28], edx
xor r12d, r12d
xor edx, edx
mov edi, r8d
mov dword [rsp + 0x20], r8d
mov dword [rsp + 0x24], ecx
mov r14d, r12d
call sym.dcapi.dll_dc_disk_open
mov r13, rax
test rax, rax
jne 0x180020e2c
lea eax, [r12 + 1]
jmp 0x180020fd7
test dword [rax + 0xc], 0x1ff
mov qword [rsp + 0x480], r15
je 0x180020e47
mov ebx, 0x22
jmp 0x180020fae
mov qword [rsp + 0x478], rsi
call fcn.18000edc0
call fcn.18000edc0
mov rcx, qword [0x18003ccf8]
lea r8, str.EXEFILE
mov edx, 0x8b
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
je 0x180020fa1
mov rcx, qword [0x18003ccf8]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, qword [0x18003ccf8]
mov rdx, rbx
mov esi, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
je 0x180020fa1
lea rcx, [rbp + 0x130]
mov rdx, rax
mov r8d, 0x200
call fcn.18000f4b0
mov rbx, r12
call fcn.18000edc0
call fcn.18000edc0
mov rcx, qword [0x18003ccf8]
lea r8, str.EXEFILE
mov edx, 0x8d
test edi, edi
jne 0x180020ef0
mov edx, 0x8c
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x180020f2c
mov rcx, qword [0x18003ccf8]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, qword [0x18003ccf8]
mov rdx, rdi
mov esi, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rbx, rbx
je 0x180020fa1
lea r15d, [rsi + 0x1ff]
and r15d, 0xfffffe00
movsxd rdi, r15d
mov rcx, rdi
call fcn.18000f9a8
mov r14, rax
test rax, rax
jne 0x180020f57
lea ebx, [rax + 9]
jmp 0x180020fa6
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.180011ff0
movsxd r8, esi
mov rdx, rbx
mov rcx, r14
call fcn.18000f4b0
mov r11d, r15d
mov rdi, r14
cmp r15d, 0x35a
jbe 0x180020fa1
cmp dword [rdi], 0x1434a669
jne 0x180020f92
cmp dword [rdi + 4], 0x7269da46
je 0x180020ffe
dec r11d
inc rdi
cmp r11d, 0x35a
ja 0x180020f81
mov ebx, 1
mov rsi, qword [rsp + 0x478]
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r13
call fcn.18000f924
mov r15, qword [rsp + 0x480]
test r14, r14
je 0x180020fd5
mov rcx, r14
call fcn.18000f924
mov eax, ebx
mov rcx, qword [rbp + 0x330]
xor rcx, rsp
call fcn.18000eda0
mov rbx, qword [rsp + 0x488]
add rsp, 0x440
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret
test rdi, rdi
je 0x180020fa1
mov ecx, dword [rsp + 0x24]
mov edx, 1
call sym.dcapi.dll_dc_dsk_get_size
mov rsi, rax
test rax, rax
jne 0x18002101e
lea ebx, [rax + 0xf]
jmp 0x180020fa6
lea rdx, [rsp + 0x30]
xor r9d, r9d
mov r8d, 0x200
mov rcx, r13
call sym.dcapi.dll_dc_disk_read
mov ebx, eax
test eax, eax
jne 0x180020fa6
mov eax, 0xaa55
cmp word [rbp + 0x12e], ax
jne 0x18002122f
mov rcx, qword [rsp + 0x33]
cmp rcx, qword [str.NTFS]
je 0x18002122f
mov rax, qword [rsp + 0x66]
cmp rax, qword [str.FAT12]
je 0x18002122f
cmp rax, qword [str.FAT16]
je 0x18002122f
mov rax, qword [rbp - 0x7e]
cmp rax, qword [str.FAT32]
je 0x18002122f
cmp rcx, qword [str.EXFAT]
je 0x18002122f
mov eax, dword [rsp + 0x32]
cmp eax, 0x10eb9090
je 0x180021225
cmp eax, 0x20b60251
je 0x180021225
lea r9d, [rbx + 0x40]
lea rdx, [rbp + 0xf6]
lea r8d, [rbx + 4]
mov ecx, dword [rdx + 4]
test ecx, ecx
je 0x1800210e1
mov eax, dword [rdx]
cmp r9, rax
cmovae r9, rax
add ecx, eax
cmp r12, rcx
cmovbe r12, rcx
add rdx, 0x10
dec r8
jne 0x1800210c8
cmp dword [rsp + 0x28], r8d
je 0x1800211fd
mov edx, dword [r13 + 0xc]
lea eax, [r15 + 0x200]
movsxd rcx, eax
imul rdx, r9
cmp rdx, rcx
jae 0x180021115
lea ebx, [r8 + 0x14]
jmp 0x180020fa6
mov esi, 0x200
cmp dword [rsp + 0x20], 0
je 0x180021126
or word [rdi + 0x13], 0x20
lea rcx, [rdi + 0x116]
lea rdx, [rsp + 0x30]
mov r8d, 0x200
call fcn.18000f4b0
mov eax, dword [rbp + 0x128]
mov r9, rsi
movaps xmm0, xmmword [rbp + 0xe0]
movaps xmm1, xmmword [rbp + 0xf0]
mov dword [rbp + 0x328], eax
movzx eax, word [rbp + 0x12c]
mov r8d, r15d
movaps xmmword [rbp + 0x2e0], xmm0
movaps xmm0, xmmword [rbp + 0x100]
movaps xmmword [rbp + 0x2f0], xmm1
mov word [rbp + 0x32c], ax
mov rax, rsi
mov rcx, r13
movaps xmm1, xmmword [rbp + 0x110]
movaps xmmword [rbp + 0x300], xmm0
shr rax, 9
movsd xmm0, qword [rbp + 0x120]
mov qword [rbp + 0x13e], rax
mov eax, r15d
movsd qword [rbp + 0x320], xmm0
movaps xmmword [rbp + 0x310], xmm1
cdq
and edx, 0x1ff
add eax, edx
mov rdx, r14
sar eax, 9
mov word [rbp + 0x138], ax
call sym.dcapi.dll_dc_disk_write
mov ebx, eax
test eax, eax
jne 0x180020fa6
lea rdx, [rbp + 0x130]
xor r9d, r9d
mov r8d, 0x200
mov rcx, r13
call sym.dcapi.dll_dc_disk_write
mov ebx, eax
jmp 0x180020fa6
movsxd rax, r15d
sub rsi, rax
mov eax, dword [r13 + 0xc]
sub rsi, 0x1000
imul rax, r12
cmp rax, rsi
jbe 0x18002111a
mov ebx, 0x14
jmp 0x180020fa6
mov ebx, 0x13
jmp 0x180020fa6
mov ebx, 0x12
jmp 0x180020fa6