Function at 0x14001d440
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbp
push rbx
push rdi
push r14
lea rbp, [rsp - 0x48]
sub rsp, 0x148
mov rax, qword [0x140155040]
xor rax, rsp
mov qword [rbp + 0x38], rax
xor r9d, r9d
mov qword [rbp - 0x40], rcx
xor r8d, r8d
mov edx, 0x845c
mov rdi, rcx
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1009
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
mov edx, 0x109d
mov r8d, 1
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
xorps xmm0, xmm0
lea r14, [0x140113898]
movups xmmword [rsp + 0x20], xmm0
xor eax, eax
mov dword [rsp + 0x20], 0x98
movups xmmword [rsp + 0x40], xmm0
mov ebx, 0xffffffff
lea r9, [rsp + 0x20]
movups xmmword [rsp + 0x50], xmm0
mov r8d, ebx
mov dword [rsp + 0x24], 0x1d
mov edx, 0x1091
mov dword [rsp + 0x50], 1
mov rcx, rdi
mov dword [rsp + 0x4c], 8
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x28], r14
movups xmmword [rsp + 0x30], xmm0
mov qword [rbp - 0x50], rax
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
call qword [sym.imp.USER32.dll_SendMessageW]
xorps xmm0, xmm0
lea r9, [rsp + 0x20]
movups xmmword [rsp + 0x20], xmm0
xor eax, eax
mov dword [rsp + 0x20], 0x98
movups xmmword [rsp + 0x40], xmm0
mov qword [rbp - 0x50], rax
mov r8d, ebx
lea rax, str.Checksums
mov dword [rsp + 0x24], 0x1d
movups xmmword [rsp + 0x50], xmm0
mov edx, 0x1091
mov qword [rsp + 0x28], rax
mov rcx, rdi
mov dword [rsp + 0x50], 1
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x4c], 8
movups xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x44], 1
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
call qword [sym.imp.USER32.dll_SendMessageW]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x20], 0x98
movups xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x24], 0x1d
movups xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x50], 1
mov dword [rsp + 0x4c], 8
movups xmmword [rsp + 0x30], xmm0
mov qword [rbp - 0x50], rax
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
lea rax, str.MainNameTypes
mov dword [rsp + 0x44], 2
lea r9, [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov r8d, ebx
mov edx, 0x1091
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
xorps xmm0, xmm0
lea r9, [rsp + 0x20]
movups xmmword [rsp + 0x20], xmm0
xor eax, eax
mov dword [rsp + 0x20], 0x98
movups xmmword [rsp + 0x40], xmm0
mov qword [rbp - 0x50], rax
mov r8d, ebx
lea rax, str.MainTypeIDs
mov dword [rsp + 0x24], 0x1d
movups xmmword [rsp + 0x50], xmm0
mov edx, 0x1091
mov qword [rsp + 0x28], rax
mov rcx, rdi
mov dword [rsp + 0x50], 1
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x4c], 8
movups xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x44], 3
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
call qword [sym.imp.USER32.dll_SendMessageW]
xorps xmm0, xmm0
lea r9, [rsp + 0x20]
movups xmmword [rsp + 0x20], xmm0
xor eax, eax
mov dword [rsp + 0x20], 0x98
movups xmmword [rsp + 0x40], xmm0
mov qword [rbp - 0x50], rax
mov r8d, ebx
lea rax, str.TypeNames
mov dword [rsp + 0x24], 0x1d
movups xmmword [rsp + 0x50], xmm0
mov edx, 0x1091
mov qword [rsp + 0x28], rax
mov rcx, rdi
mov dword [rsp + 0x50], 1
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x4c], 8
movups xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x44], 4
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
call qword [sym.imp.USER32.dll_SendMessageW]
xorps xmm0, xmm0
lea r9, [rsp + 0x20]
movups xmmword [rsp + 0x20], xmm0
xor eax, eax
mov dword [rsp + 0x20], 0x98
movups xmmword [rsp + 0x40], xmm0
mov qword [rbp - 0x50], rax
mov r8d, ebx
lea rax, str.TypeIDs
mov dword [rsp + 0x24], 0x1d
movups xmmword [rsp + 0x50], xmm0
mov edx, 0x1091
mov qword [rsp + 0x28], rax
mov rcx, rdi
mov dword [rsp + 0x50], 1
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x4c], 8
movups xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x44], 5
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbx, qword [0x14015a508]
lea r9, [rbp - 0x30]
mov qword [rbp + 0x10], r14
mov r8d, 3
mov qword [rbp + 0x18], 1
lea rdx, [rbp + 0x10]
mov qword [rbp + 0x20], 0
mov rcx, rbx
call qword [sym.imp.ntdll.dll_LdrFindResource_U]
test eax, eax
js 0x14001d80a
lfence
mov rdx, qword [rbp - 0x30]
lea r9, [rbp - 0x38]
lea r8, [rbp - 0x28]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_LdrAccessResource]
test eax, eax
js 0x14001d80a
mov rdx, qword ds:[rbp - 0x28]
mov rcx, rdi
call fcn.14001c640
jmp 0x14001da06
lea rdx, [0x14015a500]
lea rcx, [rbp + 0x10]
call fcn.14005b180
nop word [rax + rax]
test eax, eax
js 0x14001da06
mov eax, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x30]
test eax, eax
je 0x14001d9ee
mov qword [rsp + 0x178], rsi
mov qword [rsp + 0x180], r12
mov r12, rcx
mov qword [rsp + 0x188], r13
mov r13d, eax
mov qword [rsp + 0x140], r15
nop dword [rax]
movups xmm2, xmmword ds:[r12 + 0x10]
mov rax, qword ds:[r12 + 8]
movups xmm3, xmmword [r12]
movups xmmword [rbp - 0x28], xmm2
test rax, 0xffffffffffff0000
jne 0x14001d9ad
cmp ax, 1
jne 0x14001d9ad
movq rax, xmm3
test rax, 0xffffffffffff0000
je 0x14001d9ad
movzx esi, word ds:[rax]
lea rbx, [rax + 2]
lea rax, [rsi + rsi]
cmp rax, 6
jne 0x14001d9ad
and esi, 7
je 0x14001d921
mov r15, r14
sub r15, rbx
nop word [rax + rax]
movzx ecx, word [rbx]
movzx r14d, word [r15 + rbx]
cmp cx, r14w
je 0x14001d90f
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx edi, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp di, ax
jne 0x14001d9a9
add rbx, 2
sub rsi, 1
jne 0x14001d8e0
movups xmm2, xmmword [rbp - 0x28]
mov rdi, qword [rbp - 0x40]
psrldq xmm2, 8
movd r9d, xmm2
test r9d, r9d
je 0x14001d975
mov r10d, dword [0x14015a520]
xor edx, edx
test r10d, r10d
je 0x14001d975
mov r11, qword [0x14015a528]
nop word [rax + rax]
lea rcx, ds:[rdx + rdx*4]
lea r8, [r11 + rcx*8]
mov ecx, dword [r11 + rcx*8 + 0xc]
cmp r9d, ecx
jb 0x14001d96e
add ecx, dword [r8 + 0x10]
cmp r9d, ecx
jb 0x14001d982
inc edx
cmp edx, r10d
jb 0x14001d950
xor edx, edx
mov rcx, rdi
call fcn.14001c640
nop
jmp 0x14001d9ad
test r8, r8
je 0x14001d975
mov ecx, dword [r8 + 0x14]
mov eax, dword [r8 + 0xc]
sub rcx, rax
mov edx, r9d
add rcx, qword [0x14015a508]
add rdx, rcx
mov rcx, rdi
call fcn.14001c640
jmp 0x14001d9ad
mov rdi, qword [rbp - 0x40]
add r12, 0x28
lea r14, [0x140113898]
sub r13, 1
jne 0x14001d860
mov r15, qword [rsp + 0x140]
mov r13, qword [rsp + 0x188]
mov r12, qword [rsp + 0x180]
mov rsi, qword [rsp + 0x178]
mov rcx, qword [rbp + 0x30]
mov r8, rcx
xor edx, edx
mov rcx, qword [0x140159238]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
xor r9d, r9d
mov edx, 0x845c
mov r8d, 1
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbp + 0x38]
xor rcx, rsp
call fcn.1400c6a20
add rsp, 0x148
pop r14
pop rdi
pop rbx
pop rbp
ret