Function at 0x421d80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xc8
mov rbp, rsp
mov qword [rbp + 0x68], rdx
mov qword [rbp + 0x70], r8
mov qword [rbp + 0x60], r9
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x80], 0
nop
lea rcx, [rbp + 0x80]
mov rdx, qword [0x00421d40]
call fcn.004118d0
xor rax, rax
mov byte [rbp + 0x5f], al
call sub.kernel32.dll_GetVersion
test eax, 0x80000000
jne 0x421df5
mov rcx, qword [rbp + 0x70]
call fcn.0040fa90
mov rcx, qword [rbp + 0x68]
mov rdx, rax
mov r8d, 2
call sub.kernel32.dll_FindResourceW
mov rbx, rax
jmp 0x421e24
lea rcx, [rbp + 0x78]
mov rdx, qword [rbp + 0x70]
xor r8, r8
call fcn.0040f5c0
mov rcx, qword [rbp + 0x78]
call fcn.0040f280
mov rcx, qword [rbp + 0x68]
mov rdx, rax
mov r8d, 2
call sub.kernel32.dll_FindResourceA
mov rbx, rax
test rbx, rbx
je 0x4220f3
mov rcx, qword [rbp + 0x68]
mov rdx, rbx
call sub.kernel32.dll_SizeofResource
mov ecx, dword [rbp + 0x110]
imul ecx, dword [rbp + 0x110]
add ecx, ecx
add ecx, ecx
add ecx, 0x28
cmp eax, ecx
jne 0x4220f3
mov rcx, qword [rbp + 0x68]
mov rdx, rbx
call sub.kernel32.dll_LoadResource
mov rbx, rax
test rbx, rbx
je 0x4220f3
lea rcx, [rbp + 0x80]
mov rdx, qword [0x00421d40]
mov r8d, 1
mov r9d, dword [rbp + 0x110]
imul r9d, dword [rbp + 0x110]
mov r9d, r9d
call fcn.004116f0
mov rcx, rbx
call sub.kernel32.dll_LockResource
mov rsi, rax
mov rcx, rsi
lea rdx, [rbp + 0x8c]
mov r8d, 0x28
call fcn.00408750
add rsi, 0x28
mov rcx, rsi
mov rdx, qword [rbp + 0x80]
mov r8d, dword [rbp + 0x110]
imul r8d, dword [rbp + 0x110]
add r8d, r8d
add r8d, r8d
mov r8d, r8d
call fcn.00408750
mov rcx, rbx
call fcn.0041abd0
mov rcx, rbx
call sub.kernel32.dll_FreeResource
mov ecx, 0xf
call sub.user32.dll_GetSysColor
mov edx, eax
mov eax, edx
and eax, 0xff
shl eax, 0x10
mov ecx, edx
and ecx, 0xff00
add eax, ecx
and edx, 0xff0000
shr edx, 0x10
add eax, edx
mov edx, eax
xor rax, rax
mov r8d, dword [rbp + 0x110]
imul r8d, dword [rbp + 0x110]
sub r8d, 1
cmp eax, r8d
ja 0x421fef
add r8d, 1
mov rcx, qword [rbp + 0x80]
mov r9d, eax
mov ecx, dword [rcx + r9*4]
shr ecx, 0x18
add ecx, 1
mov r9, qword [rbp + 0x80]
mov r10d, eax
mov r11, qword [rbp + 0x80]
mov ebx, eax
mov r11d, dword [r11 + rbx*4]
and r11d, 0xff00ff
mov ebx, ecx
imul ebx, r11d
mov r11d, pe_nt_image_headers64
sub r11d, ecx
mov esi, edx
and esi, 0xff00ff
imul r11d, esi
add ebx, r11d
shr ebx, 8
and ebx, 0xff00ff
mov r11, qword [rbp + 0x80]
mov esi, eax
mov r11d, dword [r11 + rsi*4]
and r11d, 0xff00
mov esi, ecx
imul esi, r11d
mov r11d, pe_nt_image_headers64
sub r11d, ecx
mov ecx, edx
and ecx, 0xff00
imul r11d, ecx
add esi, r11d
shr esi, 8
and esi, 0xff00
add ebx, esi
mov dword [r9 + r10*4], ebx
add eax, 1
cmp eax, r8d
jne 0x421f47
nop
xor rcx, rcx
call sub.gdi32.dll_CreateCompatibleDC
mov rsi, rax
test rsi, rsi
je 0x4220f3
mov qword [rbp + 0xb8], 0
mov rcx, rsi
lea rdx, [rbp + 0x8c]
xor r8, r8
lea r9, [rbp + 0xb8]
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
call sub.gdi32.dll_CreateDIBSection
mov rbx, rax
test rbx, rbx
je 0x4220eb
cmp qword [rbp + 0xb8], 0
je 0x4220eb
call sub.gdi32.dll_GdiFlush
mov rcx, qword [rbp + 0x80]
mov rdx, qword [rbp + 0xb8]
mov r8d, dword [rbp + 0x110]
imul r8d, dword [rbp + 0x110]
add r8d, r8d
add r8d, r8d
mov r8d, r8d
call fcn.00408750
call sub.gdi32.dll_GdiFlush
mov rcx, rsi
mov rdx, rbx
call sub.gdi32.dll_SelectObject
mov rdi, rax
mov rcx, qword [rbp + 0x60]
xor rdx, rdx
xor r8, r8
mov r9d, dword [rbp + 0x110]
mov eax, dword [rbp + 0x110]
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x40], 0xcc0020
call sub.gdi32.dll_BitBlt
mov rcx, rsi
mov rdx, rdi
call sub.gdi32.dll_SelectObject
mov rcx, rbx
call sub.gdi32.dll_DeleteObject
mov al, 1
mov byte [rbp + 0x5f], al
mov rcx, rsi
call sub.gdi32.dll_DeleteDC
nop
lea rcx, [rbp + 0x78]
call fcn.0040e0b0
lea rcx, [rbp + 0x80]
mov rdx, qword [0x00421d40]
call fcn.004118d0
movzx rax, byte [rbp + 0x5f]
lea rsp, [rbp + 0xc8]
pop rbx
pop rsi
pop rdi
pop rbp
ret