Function at 0x14000e884
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 0x10], rdx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rbp, qword [0x140019060]
mov r13, r8
movzx edx, cx
xor ebx, ebx
and qword [rsp + 0x28], rbx
mov rcx, rbp
mov r8d, 0x1f4
mov r12, r9
xor edi, edi
xor r15d, r15d
call qword [sym.imp.KERNEL32.dll_FindResourceW]
nop dword [rax + rax]
mov r14, rax
test rax, rax
jne 0x14000e8fb
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
js 0x14000e95c
mov rdx, r14
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
jne 0x14000e92f
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
js 0x14000e95c
mov rdx, r14
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
nop dword [rax + rax]
mov rcx, rsi
mov r15d, eax
call qword [sym.imp.KERNEL32.dll_LockResource]
nop dword [rax + rax]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], rbx
test edi, edi
js 0x14000eb9a
mov edx, r15d
mov ecx, 2
mov r14d, r15d
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
jne 0x14000e9a7
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx edi, ax
mov r15d, 0x80070000
or edi, r15d
test eax, eax
cmovle edi, eax
jmp 0x14000e9ad
mov r15d, 0x80070000
test edi, edi
js 0x14000eb6a
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalLock]
nop dword [rax + rax]
mov rbp, rax
test rax, rax
jne 0x14000e9e3
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx edi, ax
or edi, r15d
test eax, eax
cmovle edi, eax
test edi, edi
js 0x14000eb6a
mov rdx, qword [rsp + 0x28]
mov r8, r14
mov rcx, rbp
call sub.msvcrt.dll_memcpy
lea r8, [rsp + 0x20]
mov edx, 1
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CreateStreamOnHGlobal]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jns 0x14000ea3d
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
nop dword [rax + rax]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
jmp 0x14000eb6a
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
nop dword [rax + rax]
test eax, eax
jne 0x14000ea67
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx edi, ax
or edi, r15d
test eax, eax
cmovle edi, eax
test edi, edi
js 0x14000eb6a
mov ecx, 0x18
call qword [sym.imp.GDIPLUS.dll_GdipAlloc]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x14000eabc
mov rcx, qword [rsp + 0x20]
lea rax, [0x1400131c8]
and qword [rsp + 0x28], 0
lea rdx, [rsp + 0x28]
mov qword [rbx], rax
call qword [sym.imp.GDIPLUS.dll_GdipCreateBitmapFromStream]
nop dword [rax + rax]
mov dword [rbx + 0x10], eax
mov rax, qword [rsp + 0x28]
mov qword [rbx + 8], rax
jmp 0x14000eabe
xor ebx, ebx
test rbx, rbx
mov eax, 0x8007000e
cmove edi, eax
test edi, edi
js 0x14000eb6a
mov rsi, qword [rsp + 0x88]
mov r8d, 0xff000000
mov rcx, qword [rbx + 8]
mov rdx, rsi
call qword [sym.imp.GDIPLUS.dll_GdipCreateHBITMAPFromBitmap]
nop dword [rax + rax]
test eax, eax
je 0x14000eafb
mov dword [rbx + 0x10], eax
jmp 0x14000eafd
xor eax, eax
test eax, eax
je 0x14000eb0c
movzx edi, ax
or edi, r15d
test eax, eax
cmovle edi, eax
test edi, edi
js 0x14000eb6a
test r13, r13
jne 0x14000eb1a
test r12, r12
je 0x14000eb6a
mov rcx, qword [rsi]
lea r8, [rsp + 0x30]
mov edx, 0x20
call qword [sym.imp.GDI32.dll_GetObjectW]
nop dword [rax + rax]
test eax, eax
je 0x14000eb53
test r13, r13
je 0x14000eb44
mov eax, dword [rsp + 0x34]
mov dword [r13], eax
test r12, r12
je 0x14000eb6a
mov eax, dword [rsp + 0x38]
mov dword [r12], eax
jmp 0x14000eb6a
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx edi, ax
or edi, r15d
test eax, eax
cmovle edi, eax
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x14000eb81
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140013cf8]
test rbx, rbx
je 0x14000eb9a
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
mov rax, qword [rax]
call qword [0x140013cf8]
lea r11, [rsp + 0x50]
mov eax, edi
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret