Function at 0x1800044f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2e8
mov rax, qword [0x1800bd6d8]
xor rax, rsp
mov qword [rsp + 0x2d0], rax
mov dword [rsp + 0x64], r9d
mov r14d, r8d
mov eax, edx
mov dword [rsp + 0x68], eax
mov r12, rcx
mov ecx, dword [rsp + 0x350]
mov dword [rsp + 0x60], ecx
mov rdi, qword [0x1800becc0]
mov qword [rsp + 0x70], rdi
movzx ebx, dx
mov r8d, 0xf1
mov edx, ebx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceA]
test rax, rax
je 0x1800048c3
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1800048c3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r15, rax
test rax, rax
je 0x1800048c3
lea rdi, [rax + 8]
movzx r13d, word [rax + 6]
xor r10d, r10d
mov ebp, r10d
test r14d, r14d
setne bpl
mov qword [rsp + 0xc0], r10
add r13d, ebp
je 0x1800045e8
xor edx, edx
mov rax, 0xffffffffffffffff
div r13
cmp rax, 0x20
jb 0x1800048e9
mov edx, r13d
shl rdx, 5
cmp rdx, 0x200
jbe 0x1800045e8
lea rcx, [rsp + 0xc0]
call fcn.180003610
mov rsi, qword [rsp + 0xc0]
xor r10d, r10d
jmp 0x1800045f8
lea rsi, [rsp + 0xc8]
mov qword [rsp + 0xc0], rsi
test rsi, rsi
je 0x1800048a2
test r14d, r14d
je 0x18000461b
mov qword [rsi], 4
mov word [rsi + 8], 0x100
mov qword [rsi + 0x10], r10
mov qword [rsi + 0x18], r10
mov r14d, r10d
mov r9d, r10d
cmp r10w, word [r15 + 6]
jae 0x180004681
mov ecx, ebp
shl rcx, 5
nop
cmp word [rdi], 0
je 0x180004647
mov dword [rsi + rcx], r14d
inc r14d
xor al, al
mov dl, 4
movzx r8d, word [rdi]
jmp 0x180004655
mov dword [rsi + rcx], 8
mov al, 1
xor dl, dl
mov r8d, r10d
mov dword [rsi + rcx + 4], r8d
mov byte [rsi + rcx + 8], dl
mov byte [rsi + rcx + 9], al
mov qword [rsi + rcx + 0x10], r10
mov qword [rsi + rcx + 0x18], r10
inc r9d
add rdi, 2
add rcx, 0x20
movzx eax, word [r15 + 6]
cmp r9d, eax
jl 0x180004630
movsxd rcx, dword [rsp + 0x60]
mov qword [rsp + 0x58], r10
mov rax, qword [0x1800becb8]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], 0x64
mov dword [rsp + 0x30], 0x64
mov dword [rsp + 0x28], r10d
mov dword [rsp + 0x20], r10d
mov r9d, dword [rsp + 0x64]
xor r8d, r8d
lea rdx, str.ToolbarWindow32
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov rbp, rax
test rax, rax
je 0x18000489a
xor r9d, r9d
mov edx, 0x41e
lea r8d, [r9 + 0x20]
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageA]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x31]
mov rcx, rbp
call qword [sym.imp.USER32.dll_SendMessageA]
test rax, rax
jne 0x180004714
lea ecx, [rax + 0x11]
call qword [sym.imp.GDI32.dll_GetStockObject]
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xb0], rcx
mov dword [rsp + 0xb8], ecx
lea r8, [rsp + 0x80]
lea edx, [rcx + 0x3c]
mov rcx, rax
call qword [sym.imp.GDI32.dll_GetObjectA]
mov eax, dword [rsp + 0x80]
cdq
mov r12d, eax
xor r12d, edx
sub r12d, edx
mov rdi, qword [0x1800becc0]
mov r8d, 2
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
movzx ecx, word [rax + 0xe]
cmp cx, 4
jbe 0x1800047ea
mov eax, 0xffffffff
mov edx, 0xff000000
cmp cx, 0x20
cmovne eax, edx
movzx r8d, word [r15 + 2]
mov dword [rsp + 0x30], 0x2040
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], eax
mov r9d, 1
mov rdx, rbx
mov rcx, qword [0x1800becc0]
call qword [sym.imp.COMCTL32.dll_ImageList_LoadImageA]
mov r9, rax
xor r8d, r8d
mov edx, 0x430
jmp 0x18000480a
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x70], rax
mov eax, dword [rsp + 0x68]
mov qword [rsp + 0x78], rax
movsxd r8, r14d
lea r9, [rsp + 0x70]
mov edx, 0x413
mov rcx, rbp
call qword [sym.imp.USER32.dll_SendMessageA]
mov r9, rsi
mov r8, r13
mov edx, 0x414
mov rcx, rbp
call qword [sym.imp.USER32.dll_SendMessageA]
movzx eax, word [r15 + 4]
cmp ax, r12w
cmovbe ax, r12w
movzx ecx, ax
shl ecx, 0x10
movzx eax, word [r15 + 2]
or ecx, eax
movsxd r9, ecx
xor r8d, r8d
mov edx, 0x420
mov rcx, rbp
call qword [sym.imp.USER32.dll_SendMessageA]
movzx eax, word [r15 + 4]
cmp ax, r12w
cmovbe ax, r12w
add ax, 7
movzx edx, ax
shl edx, 0x10
movzx eax, word [r15 + 2]
add ax, 7
movzx ecx, ax
or edx, ecx
movsxd r9, edx
xor r8d, r8d
mov edx, 0x41f
mov rcx, rbp
call qword [sym.imp.USER32.dll_SendMessageA]
mov rsi, qword [rsp + 0xc0]
jmp 0x1800048a4
mov rsi, qword [rsp + 0xc0]
xor ebp, ebp
lea rax, [rsp + 0xc8]
cmp rsi, rax
je 0x1800048be
lea rcx, [rsp + 0xc0]
call fcn.180006d30
mov rax, rbp
jmp 0x1800048c5
xor eax, eax
mov rcx, qword [rsp + 0x2d0]
xor rcx, rsp
call fcn.180013da0
add rsp, 0x2e8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, 0x80070216
call fcn.180003880
int3