Function at 0x1800aa250
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x80
mov qword [rax - 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rbx, r9
mov rdi, r8
mov r15, rdx
mov rbp, rcx
lea r8, str.COMBOBOX
mov rax, qword [0x18066df70]
test rax, rax
cmovne r8, rax
mov qword [0x18066df70], r8
lea r9, [rcx + 0x40]
lea r8, [0x18066df20]
call fcn.18009a490
movzx r14d, ax
mov rax, qword [rbp + 0x28]
test rax, rax
jne 0x1800aa2d8
call fcn.18042cc00
mov qword [rbp + 0x28], rax
test rax, rax
jne 0x1800aa2d8
lea ecx, [rax + 0xe]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
mov r15d, ebx
jmp 0x1800aa3ca
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.18042cd30
test r14w, r14w
jne 0x1800aa2f5
xor ebx, ebx
mov r15d, ebx
jmp 0x1800aa3ca
lea rsi, [rbp + 0x10]
test rsi, rsi
je 0x1800aa54b
test rbp, rbp
je 0x1800aa54b
mov qword [rsi], rbp
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsi + 8], eax
lea r12, [0x1807054c8]
mov qword [rsp + 0x68], r12
mov byte [rsp + 0x70], 0
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [rsp + 0x70], 1
mov rax, qword [0x1807054f0]
mov qword [rsi + 0x10], rax
mov qword [0x1807054f0], rsi
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [rsp + 0x70], 0
mov r11, rbp
test rbx, rbx
cmovne r11, rbx
lea rax, [0x18066df08]
test rdi, rdi
cmovne rax, rdi
mov r9d, dword [rax + 4]
mov r10d, dword [rax]
mov r8d, dword [rax + 0xc]
sub r8d, r9d
mov ecx, dword [rax + 8]
sub ecx, r10d
movzx edx, r14w
xor ebx, ebx
mov qword [rsp + 0x58], rbx
mov rax, qword [0x18067b988]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x38], r8d
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], r9d
mov dword [rsp + 0x20], r10d
mov r9d, 0x50200213
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov r15, rax
movss xmm0, dword [0x180670fc8]
comiss xmm0, dword [0x1805bec68]
jb 0x1800aa3e2
mov edx, 0x4f4c
jmp 0x1800aa3f6
mov edx, reloc.WINSPOOL.DRV_Ordinal_203
mov eax, 0x7ee
comiss xmm0, dword [0x1805bec48]
cmovae edx, eax
mov rdi, qword [0x18067c090]
lea r8, [0x1805a5ed8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x1800aa515
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r14d, eax
test eax, eax
je 0x1800aa515
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1800aa515
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
je 0x1800aa515
mov edx, r14d
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rsi, rax
test rax, rax
je 0x1800aa515
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x1800aa50c
mov r8d, r14d
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov qword [rsp + 0xb0], rbx
lea r8, [rsp + 0xb0]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x1800aa50c
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
je 0x1800aa50c
call fcn.1800f76c0
mov rdi, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, qword [rsp + 0xb0]
mov rdx, qword [rcx]
call qword [rdx + reloc.WS2_32.dll_recv]
test rdi, rdi
je 0x1800aa507
mov ecx, dword [rdi + 0x10]
mov dword [rdi + 0x10], ebx
test ecx, ecx
je 0x1800aa507
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
mov rdi, rbx
mov rbx, rdi
jmp 0x1800aa515
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, qword [rbp + 0x68]
mov qword [rbp + 0x68], rbx
test rcx, rcx
je 0x1800aa52c
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov rax, r15
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov edx, 1
mov ecx, 0xc0000005
call fcn.18007c0d0
int3