Function at 0x40e3a0
Capabilities:
Extract resource via kernel32 functions
Inspect load icon resource

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xd8
mov rbp, rsp
mov qword [rbp + 0x50], rcx
mov qword [rbp + 0x58], rdx
mov qword [rbp + 0x40], r8
mov qword [rbp + 0x48], r9
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x80], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0xa0], 0
mov qword [rbp + 0x90], 0
mov qword [rbp + 0x98], 0
mov qword [rbp + 0xa8], 0
mov qword [rbp + 0xb0], 0
mov qword [rbp + 0xc8], 0
mov qword [rbp + 0xc0], 0
mov qword [rbp + 0xb8], 0
nop
mov rcx, qword [0x0041ce60]
lea rdx, [0x0040ed84]
call sub.user32.dll_LoadIconW
mov rcx, qword [0x0041ce60]
mov edx, 0x80
mov r8d, 1
mov r9, rax
call sub.user32.dll_SendMessageW
xor rax, rax
mov byte [rbp + 0x3f], al
xor rcx, rcx
mov rdx, qword [rbp + 0x50]
mov r8, qword [rbp + 0x58]
call sub.kernel32.dll_FindResourceW
mov rbx, rax
xor rcx, rcx
mov edx, ebx
call sub.kernel32.dll_SizeofResource
test eax, eax
jne 0x40e4c5
xor rcx, rcx
lea rdx, [0x0040ed96]
lea r8, [0x0040ede2]
mov r9d, 0x30
call sub.user32.dll_MessageBoxW
jmp 0x40ecd8
xor rcx, rcx
mov edx, ebx
call sub.kernel32.dll_LoadResource
mov rcx, rax
call sub.kernel32.dll_LockResource
mov rbx, rax
mov rcx, rbx
mov rdx, qword [rbp + 0x40]
mov r8d, 0x3d
call fcn.00403a80
add rbx, 0x3d
mov rax, qword [rbp + 0x40]
cmp dword [rax + 4], 0
jbe 0x40e531
mov rcx, qword [rbp + 0x48]
mov rax, qword [rbp + 0x40]
mov edx, dword [rax + 4]
xor r8, r8
call fcn.004065a0
mov rax, qword [rbp + 0x40]
mov eax, dword [rax + 4]
mov rcx, rbx
mov rdx, qword [rbp + 0x48]
mov rdx, qword [rdx]
mov r8, rax
call fcn.00403a80
mov rax, qword [rbp + 0x40]
mov eax, dword [rax + 4]
add rbx, rax
mov rax, qword [rbp + 0x40]
cmp dword [rax + 8], 0
jbe 0x40e57c
mov rax, qword [rbp + 0x48]
lea rcx, [rax + 8]
mov rax, qword [rbp + 0x40]
mov edx, dword [rax + 8]
xor r8, r8
call fcn.004065a0
mov rax, qword [rbp + 0x48]
lea rax, [rax + 8]
mov rcx, qword [rbp + 0x40]
mov ecx, dword [rcx + 8]
mov rdx, rbx
mov r8, rcx
mov rcx, rdx
mov rdx, rax
call fcn.00403a80
mov rax, qword [rbp + 0x40]
mov eax, dword [rax + 8]
add rbx, rax
mov rax, qword [rbp + 0x40]
cmp dword [rax], 0
jbe 0x40e66c
mov rax, qword [rbp + 0x48]
lea rcx, [rax + 0x10]
mov rdx, qword [0x0040aea8]
mov r8d, 1
mov rax, qword [rbp + 0x40]
mov r9d, dword [rax]
call fcn.00407e80
mov rax, qword [rbp + 0x48]
mov rax, qword [rax + 0x10]
mov rcx, rbx
mov rdx, rax
mov rax, qword [rbp + 0x40]
mov r8d, dword [rax]
add r8d, r8d
add r8d, r8d
add r8d, r8d
mov r8d, r8d
call fcn.00403a80
mov rax, qword [rbp + 0x40]
mov eax, dword [rax]
add eax, eax
add eax, eax
add eax, eax
mov eax, eax
add rbx, rax
mov rax, qword [rbp + 0x48]
lea rcx, [rax + 0x18]
mov rdx, qword [0x0040aef0]
mov r8d, 1
mov rax, qword [rbp + 0x40]
mov r9d, dword [rax]
call fcn.00407e80
mov rax, qword [rbp + 0x48]
mov rax, qword [rax + 0x18]
mov rcx, rbx
mov rdx, rax
mov rax, qword [rbp + 0x40]
mov r8d, dword [rax]
call fcn.00403a80
mov rax, qword [rbp + 0x40]
mov eax, dword [rax]
add rbx, rax
mov rax, qword [rbp + 0x48]
lea rcx, [rax + 0x20]
mov rdx, qword [0x0040af38]
mov r8d, 1
mov rax, qword [rbp + 0x40]
mov r9d, dword [rax]
call fcn.00407e80
mov rax, qword [rbp + 0x48]
mov rax, qword [rax + 0x20]
mov rcx, rbx
mov rdx, rax
mov rax, qword [rbp + 0x40]
mov r8d, dword [rax]
call fcn.00403a80
mov rax, qword [rbp + 0x40]
mov eax, dword [rax]
add rbx, rax
mov rax, qword [rbp + 0x40]
cmp dword [rax + 0x1c], 0
je 0x40e6b7
mov rax, qword [rbp + 0x48]
lea rcx, [rax + 0x28]
mov rax, qword [rbp + 0x40]
mov edx, dword [rax + 0x1c]
xor r8, r8
call fcn.004065a0
mov rax, qword [rbp + 0x48]
mov rax, qword [rax + 0x28]
mov rcx, qword [rbp + 0x40]
mov ecx, dword [rcx + 0x1c]
mov rdx, rbx
mov r8, rcx
mov rcx, rdx
mov rdx, rax
call fcn.00403a80
mov rax, qword [rbp + 0x40]
mov eax, dword [rax + 0x1c]
add rbx, rax
mov rax, qword [rbp + 0x40]
cmp dword [rax + 0x24], 0
je 0x40e7ba
mov rax, qword [rbp + 0x40]
cmp dword [rax + 0x28], 0
je 0x40e7ba
mov rax, qword [rbp + 0x48]
lea rcx, [rax + 0x30]
mov rax, qword [rbp + 0x40]
mov edx, dword [rax + 0x24]
xor r8, r8
call fcn.004065a0
mov rax, qword [rbp + 0x48]
mov rax, qword [rax + 0x30]
mov rcx, qword [rbp + 0x40]
mov ecx, dword [rcx + 0x24]
mov rdx, rbx
mov r8, rcx
mov rcx, rdx
mov rdx, rax
call fcn.00403a80
mov rax, qword [rbp + 0x40]
mov eax, dword [rax + 0x24]
add rbx, rax
mov rax, qword [rbp + 0x48]
lea rcx, [rax + 0x38]
mov rax, qword [rbp + 0x40]
mov edx, dword [rax + 0x28]
xor r8, r8
call fcn.004065a0
mov rax, qword [rbp + 0x48]
mov rax, qword [rax + 0x38]
mov rcx, qword [rbp + 0x40]
mov ecx, dword [rcx + 0x28]
mov rdx, rbx
mov r8, rcx
mov rcx, rdx
mov rdx, rax
call fcn.00403a80
mov rax, qword [rbp + 0x40]
mov eax, dword [rax + 0x28]
add rbx, rax
lea rcx, [rbp + 0xc0]
mov rax, qword [rbp + 0x48]
mov rdx, qword [rax + 0x30]
call fcn.00406a00
lea rcx, [rbp + 0xb8]
mov rax, qword [rbp + 0x48]
mov rdx, qword [rax + 0x38]
call fcn.00406a00
lea rcx, [rbp + 0xc8]
mov rax, qword [rbp + 0x40]
mov edx, dword [rax + 0x20]
mov r8, qword [rbp + 0xc0]
mov r9, qword [rbp + 0xb8]
mov qword [rsp + 0x20], 0
call fcn.0040c7d0
lea rcx, [0x0041d2d8]
mov rdx, qword [rbp + 0xc8]
call fcn.00405d90
mov rcx, qword [0x0041d2d8]
call fcn.0040bcb0
test al, al
jne 0x40e830
lea rcx, [rbp + 0xb0]
mov edx, 3
mov rax, qword [rbp + 0x48]
mov r8, qword [rax + 0x28]
lea r9, [0x0040ee04]
mov rax, qword [rbp + 0x48]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
call fcn.004064f0
lea rcx, [0x0041d2d8]
mov rdx, qword [rbp + 0xb0]
call fcn.00406a00
lea rcx, [rbp + 0xa8]
mov rdx, qword [0x0041d2d8]
call fcn.0040dea0
lea rcx, [0x0041d2d8]
mov rdx, qword [rbp + 0xa8]
call fcn.00405d90
mov rcx, qword [0x0041d2d8]
call fcn.0040bcb0
test al, al
jne 0x40e88f
lea rcx, [rbp + 0x98]
xor rdx, rdx
call fcn.00403d30
lea rcx, [rbp + 0xa0]
mov rdx, qword [rbp + 0x98]
call fcn.0040bbc0
lea rcx, [rbp + 0x90]
mov rax, qword [rbp + 0x48]
mov rdx, qword [rax]
call fcn.00406a00
lea rcx, [0x0041d2d8]
mov rdx, qword [rbp + 0xa0]
mov r8, qword [rbp + 0x90]
call fcn.00406c50
mov rcx, qword [0x0041d2d8]
call fcn.0040bcb0
test al, al
jne 0x40e8cf
mov rax, qword [rbp + 0x40]
cmp byte [rax + 0x12], 0
jne 0x40ecd8
xor rcx, rcx
lea rdx, [0x0040ee06]
lea r8, [0x0040ede2]
mov r9d, 0x30
call sub.user32.dll_MessageBoxW
jmp 0x40ecd8
mov rax, qword [rbp + 0x40]
cmp dword [rax + 0x2c], 0
je 0x40ea81
mov rax, qword [rbp + 0x48]
lea rcx, [rax + 0x40]
mov rdx, qword [0x0040af80]
mov r8d, 1
mov rax, qword [rbp + 0x40]
mov r9d, dword [rax + 0x2c]
call fcn.00407e80
mov rax, qword [rbp + 0x48]
lea rcx, [rax + 0x48]
mov rdx, qword [0x0040afc8]
mov r8d, 1
mov rax, qword [rbp + 0x40]
mov r9d, dword [rax + 0x2c]
call fcn.00407e80
mov rax, qword [rbp + 0x48]
lea rcx, [rax + 0x50]
mov rdx, qword [0x0040b010]
mov r8d, 1
mov rax, qword [rbp + 0x40]
mov r9d, dword [rax + 0x2c]
call fcn.00407e80
mov rax, qword [rbp + 0x48]
lea rcx, [rax + 0x58]
mov rdx, qword [0x0040b058]
mov r8d, 1
mov rax, qword [rbp + 0x40]
mov r9d, dword [rax + 0x2c]
call fcn.00407e80
xor rsi, rsi
mov rax, qword [rbp + 0x40]
mov edi, dword [rax + 0x2c]
sub edi, 1
cmp esi, edi
jg 0x40ea80
add edi, 1
mov rax, qword [rbp + 0x48]
mov rax, qword [rax + 0x40]
movsxd rcx, esi
movzx rdx, byte [rbx]
mov dword [rax + rcx*4], edx
add rbx, 4
mov rax, qword [rbp + 0x48]
mov rax, qword [rax + 0x48]
movsxd rcx, esi
movzx rdx, byte [rbx]
mov dword [rax + rcx*4], edx
add rbx, 4
mov rax, qword [rbp + 0x48]
mov rax, qword [rax + 0x50]
movsxd rcx, esi
lea rcx, [rax + rcx*8]
mov rax, qword [rbp + 0x48]
mov rax, qword [rax + 0x48]
movsxd rdx, esi
mov edx, dword [rax + rdx*4]
xor r8, r8
call fcn.004065a0
mov rax, qword [rbp + 0x48]
mov rax, qword [rax + 0x50]
movsxd rcx, esi
mov rax, qword [rax + rcx*8]
mov rcx, qword [rbp + 0x48]
mov rcx, qword [rcx + 0x48]
movsxd rdx, esi
mov ecx, dword [rcx + rdx*4]
mov rdx, rbx
mov r8, rcx
mov rcx, rdx
mov rdx, rax
call fcn.00403a80
mov rax, qword [rbp + 0x48]
mov rax, qword [rax + 0x48]
movsxd rcx, esi
mov eax, dword [rax + rcx*4]
add rbx, rax
mov rax, qword [rbp + 0x48]
mov rax, qword [rax + 0x58]
movsxd rcx, esi
lea rcx, [rax + rcx*8]
mov rax, qword [rbp + 0x48]
mov rax, qword [rax + 0x48]
movsxd rdx, esi
mov edx, dword [rax + rdx*4]
xor r8, r8
call fcn.004065a0
mov rax, qword [rbp + 0x48]
mov rax, qword [rax + 0x58]
movsxd rcx, esi
mov rax, qword [rax + rcx*8]
mov rcx, qword [rbp + 0x48]
mov rcx, qword [rcx + 0x48]
movsxd rdx, esi
mov ecx, dword [rcx + rdx*4]
mov rdx, rbx
mov r8, rcx
mov rcx, rdx
mov rdx, rax
call fcn.00403a80
mov rax, qword [rbp + 0x48]
mov rax, qword [rax + 0x48]
movsxd rcx, esi
mov eax, dword [rax + rcx*4]
add rbx, rax
add esi, 1
cmp esi, edi
jne 0x40e981
nop
mov rax, qword [rbp + 0x40]
cmp dword [rax + 0x38], 0
je 0x40eabf
mov rax, qword [rbp + 0x48]
lea rcx, [rax + 0x60]
mov rax, qword [rbp + 0x40]
mov edx, dword [rax + 0x38]
xor r8, r8
call fcn.004065a0
mov rax, qword [rbp + 0x48]
mov rax, qword [rax + 0x60]
mov rcx, qword [rbp + 0x40]
mov ecx, dword [rcx + 0x38]
mov rdx, rax
mov r8, rcx
mov rcx, rbx
call fcn.00403a80
mov rax, qword [rbp + 0x40]
cmp dword [rax + 0x30], 0
je 0x40eb23
lea rcx, [rbp + 0x88]
mov rax, qword [rbp + 0x48]
mov rdx, qword [rax]
call fcn.00406a00
mov rcx, qword [rbp + 0x88]
mov rax, qword [rbp + 0x40]
mov edx, dword [rax + 0x30]
call fcn.0040dd00
test al, al
jne 0x40eb23
mov rax, qword [rbp + 0x40]
cmp byte [rax + 0x12], 0
jne 0x40ecd8
xor rcx, rcx
lea rdx, [0x0040ee46]
lea r8, [0x0040ede2]
mov r9d, 0x30
call sub.user32.dll_MessageBoxW
jmp 0x40ecd8
mov rax, qword [rbp + 0x40]
cmp dword [rax + 0x34], 0
je 0x40eb87
lea rcx, [rbp + 0x80]
mov rax, qword [rbp + 0x48]
mov rdx, qword [rax]
call fcn.00406a00
mov rcx, qword [rbp + 0x80]
mov rax, qword [rbp + 0x40]
mov edx, dword [rax + 0x34]
call fcn.0040dc90
test al, al
jne 0x40eb87
mov rax, qword [rbp + 0x40]
cmp byte [rax + 0x12], 0
jne 0x40ecd8
xor rcx, rcx
lea rdx, [0x0040ee92]
lea r8, [0x0040ede2]
mov r9d, 0x30
call sub.user32.dll_MessageBoxW
jmp 0x40ecd8
mov rax, qword [rbp + 0x40]
cmp dword [rax + 0x38], 0
je 0x40ebf3
lea rcx, [rbp + 0x78]
mov rax, qword [rbp + 0x48]
mov rdx, qword [rax]
call fcn.00406a00
lea rcx, [rbp + 0x70]
mov rax, qword [rbp + 0x48]
mov rdx, qword [rax + 0x60]
call fcn.00406a00
mov rcx, qword [rbp + 0x78]
mov rdx, qword [rbp + 0x70]
call fcn.0040dd30
test al, al
jne 0x40ebf3
mov rax, qword [rbp + 0x40]
cmp byte [rax + 0x12], 0
jne 0x40ecd8
xor rcx, rcx
lea rdx, [0x0040eee6]
lea r8, [0x0040ede2]
mov r9d, 0x30
call sub.user32.dll_MessageBoxW
jmp 0x40ecd8
mov rcx, qword [0x0041ce60]
lea rdx, [0x0040ef38]
mov r8d, 0xa
call sub.kernel32.dll_FindResourceW
test rax, rax
je 0x40ec96
lea rcx, [rbp + 0x68]
call fcn.0040c540
lea rcx, [rbp + 0x68]
lea rdx, [0x0040ef54]
call fcn.00406b60
lea rcx, [0x0040ef38]
mov edx, 0xa
mov r8, qword [rbp + 0x68]
call fcn.0040cc20
test al, al
je 0x40ec6d
lea rcx, [rbp + 0x60]
call fcn.0040c540
lea rcx, [rbp + 0x60]
lea rdx, [0x0040ef54]
call fcn.00406b60
mov rcx, qword [rbp + 0x60]
call fcn.0040cae0
jmp 0x40ec96
mov rax, qword [rbp + 0x40]
cmp byte [rax + 0x12], 0
jne 0x40ec96
xor rcx, rcx
lea rdx, [0x0040ef76]
lea r8, [0x0040ede2]
mov r9d, 0x10
call sub.user32.dll_MessageBoxW
jmp 0x40ecd8
mov rax, qword [rbp + 0x40]
cmp dword [rax], 0
jne 0x40ecd2
mov rax, qword [rbp + 0x40]
cmp dword [rax + 0x2c], 0
jne 0x40ecd2
mov rax, qword [rbp + 0x40]
cmp byte [rax + 0x12], 0
jne 0x40ecd8
xor rcx, rcx
lea rdx, [0x0040efbe]
lea r8, [0x0040ede2]
mov r9d, 0x30
call sub.user32.dll_MessageBoxW
jmp 0x40ecd8
mov al, 1
mov byte [rbp + 0x3f], al
nop
lea rcx, [rbp + 0x60]
mov edx, 0xa
call fcn.004058d0
lea rcx, [rbp + 0xb0]
call fcn.00405840
lea rcx, [rbp + 0xb8]
mov edx, 3
call fcn.004058d0
movzx rax, byte [rbp + 0x3f]
lea rsp, [rbp + 0xd8]
pop rbx
pop rsi
pop rdi
pop rbp
ret