Function at 0x4e4430
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xd8
mov rbp, rsp
mov qword [rbp + 0x68], rcx
mov qword [rbp + 0x58], rdx
mov dword [rbp + 0x60], r8d
mov qword [rbp + 0x70], r9
mov qword [rbp + 0x78], 0
mov qword [rbp + 0xc8], 0
mov qword [rbp + 0x88], 0
nop
lea rcx, [rbp + 0x88]
mov rdx, qword [0x004220f0]
call fcn.00413ec0
mov rcx, qword [rbp + 0x120]
mov edx, 0xffffffeb
call fcn.004212b0
lea rcx, [rbp + 0x78]
lea rdx, [0x00b319c8]
mov rdx, qword [rdx + rax*8]
xor r8, r8
call fcn.00410cf0
lea rcx, [rbp + 0xc8]
lea rdx, [0x004e48e8]
mov r8, qword [rbp + 0x78]
call fcn.00410f60
xor rax, rax
mov byte [rbp + 0x67], al
mov rcx, qword [rbp + 0xc8]
call fcn.00411320
mov rcx, qword [rbp + 0x70]
mov rdx, rax
mov r8d, 2
call sub.kernel32.dll_FindResourceA
mov rbx, rax
test rbx, rbx
je 0x4e483b
mov rcx, qword [rbp + 0x70]
mov rdx, rbx
call sub.kernel32.dll_SizeofResource
mov ecx, dword [rbp + 0x130]
imul ecx, dword [rbp + 0x130]
add ecx, ecx
add ecx, ecx
add ecx, 0x28
cmp eax, ecx
jne 0x4e483b
mov rcx, qword [rbp + 0x70]
mov rdx, rbx
call sub.kernel32.dll_LoadResource
mov rbx, rax
test rbx, rbx
je 0x4e483b
lea rcx, [rbp + 0x88]
mov rdx, qword [0x004220f0]
mov r8d, 1
mov r9d, dword [rbp + 0x130]
imul r9d, dword [rbp + 0x130]
mov r9d, r9d
call fcn.00413ce0
mov rcx, rbx
call sub.kernel32.dll_LockResource
mov rbx, rax
mov rcx, rbx
lea rdx, [rbp + 0x94]
mov r8d, 0x28
call fcn.00408cc0
add rbx, 0x28
mov rcx, rbx
mov rdx, qword [rbp + 0x88]
mov r8d, dword [rbp + 0x130]
imul r8d, dword [rbp + 0x130]
add r8d, r8d
add r8d, r8d
mov r8d, r8d
call fcn.00408cc0
mov eax, dword [rbp + 0x128]
and eax, 0xff
shl eax, 0x10
mov ecx, dword [rbp + 0x128]
and ecx, 0xff00
add eax, ecx
mov ecx, dword [rbp + 0x128]
and ecx, 0xff0000
shr ecx, 0x10
add eax, ecx
mov dword [rbp + 0x128], eax
cmp qword [rbp + 0x138], 0
je 0x4e4607
mov eax, dword [rbp + 0x60]
mov rcx, qword [rbp + 0x68]
imul eax, dword [rcx + 0x48]
mov ecx, dword [rbp + 0x60]
add eax, ecx
movsxd rax, eax
add rax, rax
add rax, rax
add qword [rbp + 0x138], rax
xor rcx, rcx
mov r9d, dword [rbp + 0x130]
imul r9d, dword [rbp + 0x130]
sub r9d, 1
cmp ecx, r9d
jg 0x4e4735
add r9d, 1
mov rax, qword [rbp + 0x88]
movsxd rdx, ecx
mov r8d, dword [rax + rdx*4]
shr r8d, 0x18
add r8d, 1
cmp qword [rbp + 0x138], 0
je 0x4e4690
test ecx, ecx
jle 0x4e4679
mov eax, ecx
xor edx, edx
div dword [rbp + 0x130]
test edx, edx
jne 0x4e4679
mov rax, qword [rbp + 0x68]
mov eax, dword [rax + 0x48]
sub eax, dword [rbp + 0x130]
movsxd rax, eax
add rax, rax
add rax, rax
add qword [rbp + 0x138], rax
mov rax, qword [rbp + 0x138]
mov eax, dword [rax]
mov dword [rbp + 0x128], eax
add qword [rbp + 0x138], 4
mov rax, qword [rbp + 0x88]
movsxd rdx, ecx
mov r10, qword [rbp + 0x88]
movsxd r11, ecx
mov r10d, dword [r10 + r11*4]
and r10d, 0xff00ff
mov r11d, r8d
imul r11d, r10d
mov r10d, pe_nt_image_headers64
sub r10d, r8d
mov ebx, dword [rbp + 0x128]
and ebx, 0xff00ff
imul r10d, ebx
add r11d, r10d
shr r11d, 8
and r11d, 0xff00ff
mov r10, qword [rbp + 0x88]
movsxd rbx, ecx
mov r10d, dword [r10 + rbx*4]
and r10d, 0xff00
mov ebx, r8d
imul ebx, r10d
mov r10d, pe_nt_image_headers64
sub r10d, r8d
mov r8d, dword [rbp + 0x128]
and r8d, 0xff00
imul r10d, r8d
add ebx, r10d
shr ebx, 8
and ebx, 0xff00
add r11d, ebx
mov dword [rax + rdx*4], r11d
add ecx, 1
cmp ecx, r9d
jne 0x4e462a
nop
xor rcx, rcx
call sub.gdi32.dll_CreateCompatibleDC
mov rsi, rax
test rsi, rsi
je 0x4e483b
mov qword [rbp + 0xc0], 0
mov rcx, rsi
lea rdx, [rbp + 0x94]
xor r8, r8
lea r9, [rbp + 0xc0]
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
call sub.gdi32.dll_CreateDIBSection
mov rbx, rax
test rbx, rbx
je 0x4e4833
cmp qword [rbp + 0xc0], 0
je 0x4e4833
call sub.gdi32.dll_GdiFlush
mov rcx, qword [rbp + 0x88]
mov rdx, qword [rbp + 0xc0]
mov r8d, dword [rbp + 0x130]
imul r8d, dword [rbp + 0x130]
add r8d, r8d
add r8d, r8d
mov r8d, r8d
call fcn.00408cc0
call sub.gdi32.dll_GdiFlush
mov rcx, rsi
mov rdx, rbx
call sub.gdi32.dll_SelectObject
mov rdi, rax
mov rcx, qword [rbp + 0x58]
mov eax, dword [rbp + 0x60]
mov edx, eax
mov r8d, eax
mov r9d, dword [rbp + 0x130]
mov eax, dword [rbp + 0x130]
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x40], 0xcc0020
call sub.gdi32.dll_BitBlt
mov rcx, rsi
mov rdx, rdi
call sub.gdi32.dll_SelectObject
mov rcx, rbx
call sub.gdi32.dll_DeleteObject
mov al, 1
mov byte [rbp + 0x67], al
mov rcx, rsi
call sub.gdi32.dll_DeleteDC
nop
lea rcx, [rbp + 0x78]
call fcn.004100d0
lea rcx, [rbp + 0x88]
mov rdx, qword [0x004220f0]
call fcn.00413ec0
lea rcx, [rbp + 0xc8]
call fcn.004100d0
movzx rax, byte [rbp + 0x67]
lea rsp, [rbp + 0xd8]
pop rbx
pop rsi
pop rdi
pop rbp
ret