Function at 0x14001b998
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
mov qword [rbp - 1], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x140048f50]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov r13, rcx
mov qword [rbp - 9], rcx
movzx ebx, dx
mov r8d, 0xf0
mov edx, ebx
mov rcx, qword [0x14004b0c0]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
xor r15d, r15d
mov qword [rbp - 0x11], r15
mov esi, r15d
test rax, rax
je 0x14001ba1b
mov rdx, rax
mov rcx, qword [0x14004b0c0]
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14001ba1b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rbp - 0x11], rax
mov r14d, 5
mov r8d, r14d
mov rdx, rbx
mov rcx, qword [0x14004b0c0]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x14001be88
mov rdx, rax
mov rcx, qword [0x14004b0c0]
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14001be81
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
je 0x14001be81
mov ecx, 0xffff
mov edi, r15d
cmp word [rax + 2], cx
sete dil
mov dword [rbp - 0x39], edi
cmp word [rax + 2], cx
lea rcx, [rax + 0x10]
je 0x14001ba89
lea rcx, [rax + 8]
movzx ebx, word [rcx]
mov word [rbp - 0x47], bx
mov rcx, rax
call fcn.140001500
mov r12, rax
mov edx, r14d
mov rcx, qword [r13 + 8]
call qword [sym.imp.USER32.dll_GetWindow]
mov qword [rbp - 0x31], rax
movzx ecx, r15w
mov word [rbp - 0x49], cx
movsxd r14, edi
cmp r15w, bx
jae 0x14001be88
mov r8d, 1
test r14, r14
je 0x14001bad3
mov edx, dword [r12 + 0x14]
jmp 0x14001bad9
movzx edx, word [r12 + 0x10]
lea rbx, [r12 + 0x18]
mov qword [rbp - 0x21], rbx
lea r13, [r12 + 0x12]
mov r15, r13
xor r11d, r11d
test edi, edi
cmovne r15, rbx
cmp word [r15], 0x7b
jne 0x14001bd8f
mov esi, r11d
mov rax, qword [rbp - 0x11]
mov rcx, rax
test rax, rax
je 0x14001bb40
movzx eax, word [rcx]
lea r10, [rcx + 2]
movzx r9d, word [rcx + 2]
mov r8d, dword [rcx + 4]
add rcx, 8
cmp eax, edx
je 0x14001bb2c
add rcx, r8
jne 0x14001bb0d
jmp 0x14001bb40
mov eax, 0x378
cmp r9w, ax
je 0x14001bb40
mov rsi, r10
lea eax, [r8 + 6]
jmp 0x14001bb43
mov eax, r11d
mov rcx, r11
mov qword [rbp - 0x41], rcx
test eax, eax
je 0x14001bbd9
mov edi, eax
mov edx, eax
mov ecx, 0x42
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbx, rax
test rax, rax
je 0x14001be5f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x14001be56
mov r9d, edi
mov r8, rsi
mov edx, edi
mov rcx, rax
call fcn.14001e254
test eax, eax
je 0x14001bbb7
cmp eax, 0xc
je 0x14001be4b
cmp eax, 0x16
je 0x14001be40
cmp eax, 0x22
je 0x14001be40
cmp eax, 0x50
jne 0x14001be35
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea r8, [rbp - 0x41]
mov edx, 1
mov rcx, rbx
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov rcx, qword [rbp - 0x41]
xor r11d, r11d
mov qword [rbp - 0x19], r11
lea rdx, [rbp - 0x19]
call fcn.140002138
mov esi, eax
mov rdi, qword [rbp - 0x19]
test eax, eax
js 0x14001bd74
xor esi, esi
mov qword [rbp - 0x29], rsi
call fcn.14000d490
test r14, r14
je 0x14001bc0c
movzx eax, word [r12 + 0xc]
jmp 0x14001bc12
movzx eax, word [r12 + 8]
movsx ecx, ax
mov dword [rbp + 7], ecx
test r14, r14
je 0x14001bc25
movzx eax, word [r12 + 0xe]
jmp 0x14001bc2b
movzx eax, word [r12 + 0xa]
movsx edx, ax
mov dword [rbp + 0xb], edx
test r14, r14
je 0x14001bc3e
movzx eax, word [r12 + 0x10]
jmp 0x14001bc44
movzx eax, word [r12 + 0xc]
cwde
add eax, ecx
mov dword [rbp + 0xf], eax
test r14, r14
je 0x14001bc56
movzx eax, word [r13]
jmp 0x14001bc5c
movzx eax, word [r12 + 0xe]
cwde
add eax, edx
mov dword [rbp + 0x13], eax
lea rdx, [rbp + 7]
mov rbx, qword [rbp - 9]
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_MapDialogRect]
test r14, r14
je 0x14001bc80
mov eax, dword [r12 + 0x14]
jmp 0x14001bc86
movzx eax, word [r12 + 0x10]
test r14, r14
je 0x14001bc92
mov edx, dword [r12 + 4]
jmp 0x14001bc94
mov edx, esi
test r14, r14
je 0x14001bca0
mov ecx, dword [r12 + 8]
jmp 0x14001bca4
mov ecx, dword [r12]
bts ecx, 0x10
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 7]
mov r8, qword [rbx + 8]
lea rdx, str.AtlAxWinLic100
lea rcx, [rbp - 0x29]
call fcn.140016274
mov rbx, qword [rbp - 0x29]
test rbx, rbx
je 0x14001bd6d
test r14, r14
je 0x14001bcfa
mov edx, dword [r12]
test edx, edx
je 0x14001bcfa
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetWindowContextHelpId]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rsi
lea rax, [0x14003b110]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov r8, qword [rbp - 0x41]
mov rdx, r15
lea rcx, [rbp - 0x29]
call fcn.1400166bc
mov esi, eax
xor r15d, r15d
test eax, eax
js 0x14001be66
movzx eax, word [rbp - 0x49]
neg ax
sbb rdx, rdx
and rdx, qword [rbp - 0x31]
mov dword [rsp + 0x30], 0x13
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rax, rbx
mov qword [rbp - 0x31], rbx
jmp 0x14001bd74
call fcn.140002c48
mov esi, eax
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, qword [rbp - 0x41]
test rcx, rcx
je 0x14001bda8
mov rax, qword [rcx]
call qword [rax + InitCommonControls]
jmp 0x14001bda8
test cx, cx
je 0x14001bdb9
mov edx, 2
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindow]
mov qword [rbp - 0x31], rax
jmp 0x14001bdaf
mov edi, dword [rbp - 0x39]
mov rbx, qword [rbp - 0x21]
movzx ecx, word [rbp - 0x49]
mov r8d, 1
test r14, r14
cmovne r13, rbx
mov edx, 0xffff
cmp word [r13], dx
jne 0x14001bdd2
add r13, 4
jmp 0x14001bde0
movzx eax, word [r13]
add r13, 2
test ax, ax
jne 0x14001bdd2
cmp word [r13], dx
jne 0x14001bded
add r13, 4
jmp 0x14001bdfb
movzx eax, word [r13]
add r13, 2
test ax, ax
jne 0x14001bded
movzx eax, word [r13]
test ax, ax
je 0x14001be12
test r14, r14
jne 0x14001be12
mov edx, 0xfffe
add ax, dx
movzx eax, ax
lea r12, [rax + r13 + 5]
and r12, 0xfffffffffffffffc
add cx, r8w
mov word [rbp - 0x49], cx
cmp cx, word [rbp - 0x47]
jae 0x14001be88
mov rax, qword [rbp - 0x31]
jmp 0x14001bac7
mov ecx, 0x80004005
call entry0
int3
mov ecx, 0x80070057
call entry0
int3
mov ecx, 0x8007000e
call entry0
int3
call fcn.140002c48
mov esi, eax
jmp 0x14001be70
mov esi, 0x8007000e
jmp 0x14001be70
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, qword [rbp - 0x41]
test rcx, rcx
je 0x14001be88
mov rax, qword [rcx]
call qword [rax + InitCommonControls]
jmp 0x14001be88
call fcn.140002c48
mov esi, eax
mov eax, esi
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.14001eba0
mov rbx, qword [rsp + 0x110]
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret