Function at 0x1400af060
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x50
xor ebx, ebx
mov esi, r9d
mov r15d, r8d
mov ebp, edx
mov r13, rcx
mov r12d, ebx
test rcx, rcx
je 0x1400af0a1
xor edx, edx
lea r8d, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
jmp 0x1400af0a8
mov rdi, qword [0x140102830]
test rdi, rdi
je 0x1400af283
mov qword [rsp + 0x88], r14
lea r14, [0x140107624]
test ebp, ebp
jns 0x1400af0cf
movzx eax, bp
neg ax
movzx edx, ax
jmp 0x1400af105
test ebp, ebp
mov dword [rsp + 0x44], ebx
mov eax, 1
mov qword [rsp + 0x48], r14
cmovne eax, ebp
lea r9, [rsp + 0x40]
lea r8, [0x1400af040]
mov dword [rsp + 0x40], eax
mov edx, SafeArrayDestroy
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
mov rdx, qword [rsp + 0x48]
cmp rdx, r14
je 0x1400af24c
mov r8d, SafeArrayDestroy
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x1400af24c
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400af24c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
test rax, rax
je 0x1400af24c
cmp r15d, 0xffffffff
cmovne esi, r15d
test esi, esi
jne 0x1400af167
lea ecx, [rsi + 0xb]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov esi, eax
movzx eax, word [r14 + 4]
lea r9, [r14 + 6]
mov r8, rbx
mov edx, ebx
cmp bx, ax
jae 0x1400af24c
mov r11, r9
movzx r10d, ax
mov r13d, 0x100
nop dword [rax + rax]
movzx ecx, byte [r9]
mov r15d, edx
test ecx, ecx
mov r14, r8
mov eax, ebx
cmove ecx, r13d
cmp ecx, edx
jle 0x1400af1ad
cmp edx, esi
setl al
jmp 0x1400af1b2
cmp ecx, esi
setge al
test eax, eax
mov r8, r11
mov edx, ecx
cmove r8, r14
add r11, 0xe
add r9, 0xe
test eax, eax
cmove edx, r15d
sub r10, 1
jne 0x1400af190
mov r13, qword [rsp + 0x80]
test r8, r8
je 0x1400af24c
movzx edx, word [r8 + 0xc]
mov rcx, rdi
lea r8d, [r10 + 3]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x1400af24c
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400af24c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
test rax, rax
je 0x1400af24c
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x30], ebx
mov r9d, 0x30000
mov edx, eax
mov dword [rsp + 0x28], ebx
mov r8d, 1
mov dword [rsp + 0x20], ebx
mov rcx, r14
call qword [sym.imp.USER32.dll_CreateIconFromResourceEx]
mov r12, rax
mov rcx, qword [rsp + 0xa0]
mov r14, qword [rsp + 0x88]
test rcx, rcx
je 0x1400af26b
test r12, r12
je 0x1400af26b
mov qword [rcx], rdi
jmp 0x1400af279
test r13, r13
je 0x1400af279
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test r12, r12
je 0x1400af283
mov rax, r12
jmp 0x1400af2a0
test ebp, ebp
jle 0x1400af28c
lea ebx, [rbp - 1]
jmp 0x1400af292
cmp ebp, 0xffffffff
cmovl ebx, ebp
mov r8d, ebx
mov rdx, r13
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ExtractIconW]
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret