Function at 0x140064f00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x140193440]
xor rax, rsp
mov qword [rbp + 0x80], rax
movdqa xmm0, xmmword [0x140179500]
xor r15d, r15d
movdqa xmm1, xmmword [0x140179480]
xor esi, esi
movdqu xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x60], rcx
mov ecx, 0x31
movss xmm0, dword [0x140196f6c]
comiss xmm0, dword [0x140176f88]
movdqu xmmword [rbp - 0x80], xmm1
setbe r15b
xor eax, eax
add r15d, 0xfffffffb
comiss xmm0, dword [0x140176fa0]
seta al
sub r15d, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov r14d, eax
cmp eax, 0x36
jl 0x140064fa2
mov edi, 0x40
mov esi, 0x14
jmp 0x140064fdb
cmp r14d, 0x28
jl 0x140064fb4
mov edi, 0x30
mov esi, 0x14
jmp 0x140064fdb
cmp r14d, 0x1c
jl 0x140064fc6
mov edi, 0x20
mov esi, 0x14
jmp 0x140064fdb
cmp r14d, 0x14
jl 0x140064fd8
mov edi, 0x18
mov esi, 0xa
jmp 0x140064fdb
mov edi, r14d
lea rcx, str.ComDlg32
call fcn.14005fdb0
mov r9d, edi
mov dword [rsp + 0x28], 0x8000
mov edx, 0x241
mov dword [rsp + 0x20], edi
mov r8d, 1
mov rcx, rax
mov rbx, rax
call qword [sym.imp.USER32.dll_LoadImageW]
mov r9d, edi
mov dword [rsp + 0x28], 0x8000
mov edx, 0x242
mov dword [rsp + 0x20], edi
mov r8d, 1
mov rcx, rbx
mov r12, rax
call qword [sym.imp.USER32.dll_LoadImageW]
lea rcx, str.Shell32
mov r13, rax
call fcn.14005fdb0
mov rbx, rax
test r13, r13
jne 0x140065070
mov dword [rsp + 0x28], 0x8000
mov r9d, edi
mov edx, 0x416d
mov dword [rsp + 0x20], edi
mov r8d, 1
mov rcx, rax
call qword [sym.imp.USER32.dll_LoadImageW]
mov r13, rax
test r12, r12
jne 0x14006509b
mov dword [rsp + 0x28], 0x8000
mov r9d, edi
mov edx, 0x416e
mov dword [rsp + 0x20], edi
mov r8d, 1
mov rcx, rbx
call qword [sym.imp.USER32.dll_LoadImageW]
mov r12, rax
xor ebx, ebx
mov r9d, 1
mov r8d, 0x20020
mov dword [rsp + 0x20], ebx
mov edx, r14d
mov ecx, r14d
call qword [sym.imp.COMCTL32.dll_ImageList_Create]
mov r9d, 1
mov dword [rsp + 0x20], ebx
mov r8d, 0x20020
mov qword [0x1401e66f0], rax
mov edx, r14d
mov ecx, r14d
call qword [sym.imp.COMCTL32.dll_ImageList_Create]
mov rcx, qword [0x1401e66f0]
mov r8, r13
mov edx, 0xffffffff
mov qword [0x1401e66f8], rax
call qword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
mov rcx, qword [0x1401e66f8]
mov r8, r12
mov edx, 0xffffffff
call qword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
lea rbx, [0x1401e5310]
xor edx, edx
mov rcx, rbx
mov r8d, 0x200
call fcn.140136540
mov ecx, 0xc2f
call fcn.140021050
xor r12d, r12d
mov rdx, rax
cmp dword [0x1401e82c4], r12d
mov ecx, r12d
setne cl
add ecx, 0xc31
call fcn.140021050
mov r8, rax
mov dword [rsp + 0x28], 0x80
xor edx, edx
mov qword [rsp + 0x20], rbx
mov ecx, 0xfde9
mov r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rax, qword [0x1401e87b8]
lea rdx, str.ToolbarWindow32
mov qword [rsp + 0x58], r12
mov r9d, 0x56011958
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov rax, qword [0x1401e89e8]
xor ecx, ecx
mov qword [rsp + 0x48], 0x413
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
call qword [sym.imp.USER32.dll_CreateWindowExW]
xor r9d, r9d
mov edx, 0x2007
mov rcx, rax
mov qword [0x1401e8180], rax
mov r8d, 6
call qword [sym.imp.USER32.dll_SendMessageW]
xor edx, edx
lea rcx, [rbp - 0x60]
mov r8d, 0xe0
call fcn.140136540
mov r9, qword [0x1401e66f0]
xor r8d, r8d
mov rcx, qword [0x1401e8180]
mov edx, 0x430
mov dword [rbp - 0x5c], 0x404
mov word [rbp - 0x58], 0x5004
mov qword [rbp - 0x48], rbx
mov dword [rbp - 0x60], r12d
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
mov edx, 0x41e
mov r8d, 0x20
mov rcx, qword [0x1401e8180]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x1401e8180]
lea r9, [rbp - 0x60]
mov edx, 0x444
mov r8d, 1
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbx, qword [rsp + 0x60]
mov edx, 0x404
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rbp - 0x70]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov r9d, 2
lea r8, [rbp - 0x70]
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MapWindowPoints]
mov rcx, qword [0x1401e8180]
lea r9, [rsp + 0x68]
xor r8d, r8d
mov edx, 0x463
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [rbp - 0x64]
mov r9d, dword [rbp - 0x6c]
sub edx, r9d
mov r8d, dword [rbp - 0x70]
mov eax, dword [rsp + 0x68]
add r8d, r15d
mov rcx, qword [0x1401e8180]
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], edx
mov rdx, qword [0x1401e8168]
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, 0xc2f
call fcn.140021050
mov rcx, qword [0x1401e8180]
mov rdx, rax
call fcn.140060320
mov ecx, 0xc30
call fcn.140021050
cmp dword [0x1401e82c8], r12d
mov ecx, r12d
mov rdx, rax
setne cl
add ecx, 0xc31
call fcn.140021050
lea rdi, [0x1401e5410]
mov dword [rsp + 0x28], 0x80
mov r8, rax
mov qword [rsp + 0x20], rdi
xor edx, edx
mov ecx, 0xfde9
mov r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rax, qword [0x1401e87b8]
lea rdx, str.ToolbarWindow32
mov qword [rsp + 0x58], r12
mov r9d, 0x56011958
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov rax, qword [0x1401e89e8]
xor ecx, ecx
mov qword [rsp + 0x48], 0x414
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
call qword [sym.imp.USER32.dll_CreateWindowExW]
xor r9d, r9d
mov edx, 0x2007
mov rcx, rax
mov qword [0x1401e81a0], rax
mov r8d, 6
call qword [sym.imp.USER32.dll_SendMessageW]
xor edx, edx
lea rcx, [rbp - 0x60]
mov r8d, 0xe0
call fcn.140136540
mov r9, qword [0x1401e66f0]
xor r8d, r8d
mov rcx, qword [0x1401e81a0]
mov edx, 0x430
mov dword [rbp - 0x5c], 0x405
mov word [rbp - 0x58], 0x5004
mov qword [rbp - 0x48], rdi
mov dword [rbp - 0x60], r12d
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x1401e81a0]
xor r9d, r9d
mov edx, 0x41e
mov r8d, 0x20
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x1401e81a0]
lea r9, [rbp - 0x60]
mov edx, 0x444
mov r8d, 1
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, 0x405
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rbp - 0x70]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov r9d, 2
lea r8, [rbp - 0x70]
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MapWindowPoints]
mov rcx, qword [0x1401e81a0]
lea r9, [rsp + 0x68]
xor r8d, r8d
mov edx, 0x463
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [rbp - 0x64]
mov r9d, dword [rbp - 0x6c]
sub edx, r9d
mov r8d, dword [rbp - 0x70]
mov eax, dword [rsp + 0x68]
add r8d, r15d
mov rcx, qword [0x1401e81a0]
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], edx
mov rdx, qword [0x1401e87c8]
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, 0xc30
call fcn.140021050
mov rcx, qword [0x1401e81a0]
mov rdx, rax
call fcn.140060320
mov rax, qword [0x1401e87b8]
lea rdx, str.ToolbarWindow32
mov qword [rsp + 0x58], r12
mov r9d, 0x56011958
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov rax, qword [0x1401e89e8]
xor ecx, ecx
mov qword [rsp + 0x48], 0x417
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov r9d, 8
mov dword [rsp + 0x20], r12d
mov r8d, 0x20020
mov qword [0x1401e8198], rax
mov edx, r14d
mov ecx, r14d
call qword [sym.imp.COMCTL32.dll_ImageList_Create]
mov rdi, qword [0x1401e87b8]
lea ecx, [rsi + 0x79]
movzx edx, cx
mov r15, rax
mov r13d, r12d
mov r8d, 0xa
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r12, rax
test rax, rax
jne 0x140065588
call fcn.14004fba0
mov r8, rax
lea rdx, str.toolbar_icon
lea rcx, str.Could_not_locate_resource__s:__s
call fcn.14004f2f0
mov edi, dword [rsp + 0x68]
jmp 0x1400655d7
mov rdx, r12
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
jne 0x1400655bd
call fcn.14004fba0
mov r8, rax
lea rdx, str.toolbar_icon
lea rcx, str.Could_not_load_resource__s:__s
call fcn.14004f2f0
mov edi, dword [rsp + 0x68]
jmp 0x1400655d7
mov rdx, r12
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r13, rax
xor r12d, r12d
mov r9d, 0x30000
mov dword [rsp + 0x30], r12d
mov r8d, 1
mov dword [rsp + 0x28], r12d
mov edx, edi
mov rcx, r13
mov dword [rsp + 0x20], r12d
call qword [sym.imp.USER32.dll_CreateIconFromResourceEx]
cmp dword [0x14019f590], r12d
mov rbx, rax
je 0x140065617
mov rcx, rax
call fcn.1400598f0
mov rbx, rax
mov r8, rbx
mov edx, 0xffffffff
mov rcx, r15
call qword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
mov rcx, rbx
call qword [sym.imp.USER32.dll_DestroyIcon]
mov rbx, qword [0x1401e87b8]
lea eax, [rsi + 0x7a]
movzx edx, ax
mov r8d, 0xa
mov rcx, rbx
mov qword [rsp + 0x60], r12
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r12, rax
test rax, rax
jne 0x14006567c
call fcn.14004fba0
mov r8, rax
lea rdx, str.toolbar_icon
lea rcx, str.Could_not_locate_resource__s:__s
call fcn.14004f2f0
mov rax, qword [rsp + 0x60]
jmp 0x1400656c9
mov rdx, r12
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r13, rax
test rax, rax
jne 0x1400656b2
call fcn.14004fba0
mov r8, rax
lea rdx, str.toolbar_icon
lea rcx, str.Could_not_load_resource__s:__s
call fcn.14004f2f0
mov rax, qword [rsp + 0x60]
jmp 0x1400656c9
mov rdx, r12
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, r13
mov edi, eax
call qword [sym.imp.KERNEL32.dll_LockResource]
xor r12d, r12d
mov r9d, 0x30000
mov dword [rsp + 0x30], r12d
mov r8d, 1
mov dword [rsp + 0x28], r12d
mov edx, edi
mov rcx, rax
mov dword [rsp + 0x20], r12d
call qword [sym.imp.USER32.dll_CreateIconFromResourceEx]
mov edx, 0xffffffff
mov rcx, r15
mov r8, rax
mov rbx, rax
call qword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
mov rcx, rbx
call qword [sym.imp.USER32.dll_DestroyIcon]
mov rbx, qword [0x1401e87b8]
lea eax, [rsi + 0x7b]
movzx edx, ax
mov r8d, 0xa
mov rcx, rbx
mov qword [rsp + 0x60], r12
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r12, rax
test rax, rax
jne 0x14006575a
call fcn.14004fba0
mov r8, rax
lea rdx, str.toolbar_icon
lea rcx, str.Could_not_locate_resource__s:__s
call fcn.14004f2f0
mov rax, qword [rsp + 0x60]
jmp 0x1400657a7
mov rdx, r12
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r13, rax
test rax, rax
jne 0x140065790
call fcn.14004fba0
mov r8, rax
lea rdx, str.toolbar_icon
lea rcx, str.Could_not_load_resource__s:__s
call fcn.14004f2f0
mov rax, qword [rsp + 0x60]
jmp 0x1400657a7
mov rdx, r12
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, r13
mov edi, eax
call qword [sym.imp.KERNEL32.dll_LockResource]
xor r12d, r12d
mov r9d, 0x30000
mov dword [rsp + 0x30], r12d
mov r8d, 1
mov dword [rsp + 0x28], r12d
mov edx, edi
mov rcx, rax
mov dword [rsp + 0x20], r12d
call qword [sym.imp.USER32.dll_CreateIconFromResourceEx]
mov edx, 0xffffffff
mov rcx, r15
mov r8, rax
mov rbx, rax
call qword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
mov rcx, rbx
call qword [sym.imp.USER32.dll_DestroyIcon]
mov rbx, qword [0x1401e87b8]
add si, 0x7c
movzx edx, si
mov rcx, rbx
mov r8d, 0xa
mov r13d, r12d
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rsi, rax
test rax, rax
jne 0x140065832
call fcn.14004fba0
mov r8, rax
lea rdx, str.toolbar_icon
lea rcx, str.Could_not_locate_resource__s:__s
call fcn.14004f2f0
jmp 0x140065880
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r12, rax
test rax, rax
jne 0x140065863
call fcn.14004fba0
mov r8, rax
lea rdx, str.toolbar_icon
lea rcx, str.Could_not_load_resource__s:__s
call fcn.14004f2f0
jmp 0x14006587d
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, r12
mov edi, eax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r13, rax
xor r12d, r12d
mov dword [rsp + 0x30], r12d
mov r9d, 0x30000
mov dword [rsp + 0x28], r12d
mov r8d, 1
mov edx, edi
mov dword [rsp + 0x20], r12d
mov rcx, r13
call qword [sym.imp.USER32.dll_CreateIconFromResourceEx]
mov edx, 0xffffffff
mov rcx, r15
mov r8, rax
mov rbx, rax
call qword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
mov rcx, rbx
call qword [sym.imp.USER32.dll_DestroyIcon]
mov rcx, qword [0x1401e8198]
mov r9, r15
xor r8d, r8d
mov edx, 0x430
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x1401e8198]
xor r9d, r9d
mov edx, 0x41e
mov r8d, 0x20
call qword [sym.imp.USER32.dll_SendMessageW]
xor edx, edx
lea rcx, [rbp - 0x60]
mov r8d, 0xe0
call fcn.140136540
cmp dword [0x1401a0458], 0
mov r10d, 7
je 0x14006592b
mov dword [rsp + 0x78], 0x41e
mov r10d, 5
mov dword [rbp - 0x78], 3
mov eax, dword [rsp + 0x70]
lea rcx, [rbp - 0x58]
mov dword [rcx - 4], eax
lea r11, [0x140156174]
mov eax, dword [rbp - 0x80]
lea rdx, [rbp + 0x28]
mov r8d, 4
mov word [rcx], r8w
mov dword [rcx - 8], eax
lea rax, [0x1401718e0]
movss xmm0, dword [0x140196f6c]
movss xmm1, dword [0x140176f8c]
comiss xmm1, xmm0
cmova rax, r11
mov qword [rcx + 0x30], rax
mov word [rcx + 0x20], 0x1010
mov dword [rcx + 0x18], 0xfffffffe
mov eax, dword [rsp + 0x74]
mov dword [rcx + 0x3c], eax
mov eax, dword [rbp - 0x7c]
mov word [rcx + 0x40], r8w
mov dword [rcx + 0x38], eax
lea rax, [0x1401718e0]
cmova rax, r11
sub r10, r8
mov qword [rcx + 0x70], rax
mov word [rcx + 0x60], 0x1010
mov dword [rcx + 0x58], 0xfffffffe
test r8b, 1
jne 0x1400659da
mov eax, r8d
test r8d, r8d
jns 0x1400659c3
lea eax, [r8 + 1]
sar eax, 1
movsxd rcx, eax
xor r9b, r9b
mov eax, dword [rsp + rcx*4 + 0x70]
mov dword [rdx - 4], eax
mov eax, dword [rbp + rcx*4 - 0x80]
mov cl, 4
jmp 0x1400659f7
comiss xmm1, xmm0
lea rax, [0x1401718e0]
mov cl, 0x10
movzx r9d, cl
cmova rax, r11
mov qword [rdx + 0x10], rax
mov eax, 0xfffffffe
mov byte [rdx + 1], r9b
inc r8d
mov byte [rdx], cl
mov dword [rdx - 8], eax
add rdx, 0x20
sub r10, 1
jne 0x1400659b1
mov rcx, qword [0x1401e8198]
lea r9, [rbp - 0x60]
movsxd r8, r8d
mov edx, 0x444
call qword [sym.imp.USER32.dll_SendMessageW]
movzx r9d, word [0x1401a0488]
xor r8d, r8d
mov rcx, qword [0x1401e8198]
mov edx, 0x41f
shl r9, 0x10
movzx eax, r14w
or r9, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, 0xcf3
call fcn.140021050
mov rcx, qword [0x1401e8198]
mov rdx, rax
call fcn.140060320
mov rcx, qword [0x14019f5d0]
lea r8, [0x140064810]
mov edx, 0xfffffffc
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
mov qword [0x1401e5570], rax
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.1400b2a30
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret