Function at 0x14000d930
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xd0
mov qword [rbp - 1], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x1401a0e90]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov r15, rcx
mov qword [rbp - 0x11], rcx
movzx ebx, dx
mov r8d, 0xf0
mov edx, ebx
mov rcx, qword [0x1401a74f0]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
xor r13d, r13d
mov qword [rbp - 0x21], r13
mov esi, r13d
test rax, rax
je 0x14000d9b3
mov rdx, rax
mov rcx, qword [0x1401a74f0]
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14000d9b3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rbp - 0x21], rax
mov r12d, 5
mov r8d, r12d
mov rdx, rbx
mov rcx, qword [0x1401a74f0]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x14000de1b
mov rdx, rax
mov rcx, qword [0x1401a74f0]
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14000de14
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
je 0x14000de14
mov ecx, 0xffff
mov edi, r13d
cmp word [rax + 2], cx
sete dil
mov dword [rbp - 0x39], edi
cmp word [rax + 2], cx
lea rcx, [rax + 0x10]
je 0x14000da21
lea rcx, [rax + 8]
movzx ebx, word [rcx]
mov word [rbp - 0x47], bx
mov rcx, rax
call fcn.140003f54
mov r14, rax
mov edx, r12d
mov rcx, qword [r15 + 8]
call qword [sym.imp.USER32.dll_GetWindow]
mov qword [rbp - 0x31], rax
movzx ecx, r13w
mov word [rbp - 0x49], cx
movsxd r12, edi
cmp r13w, bx
jae 0x14000de1b
mov r8d, 1
test r12, r12
je 0x14000da6a
mov edx, dword [r14 + 0x14]
jmp 0x14000da6f
movzx edx, word [r14 + 0x10]
lea rbx, [r14 + 0x18]
mov qword [rbp - 0x19], rbx
lea r15, [r14 + 0x12]
mov r13, r15
test edi, edi
cmovne r13, rbx
cmp word [r13], 0x7b
jne 0x14000dd25
xor edi, edi
mov esi, edi
mov rax, qword [rbp - 0x21]
mov rcx, rax
test rax, rax
je 0x14000dad3
movzx eax, word [rcx]
lea r10, [rcx + 2]
movzx r9d, word [rcx + 2]
mov r8d, dword [rcx + 4]
add rcx, 8
cmp eax, edx
je 0x14000dabf
add rcx, r8
jne 0x14000daa0
jmp 0x14000dad3
mov eax, 0x378
cmp r9w, ax
je 0x14000dad3
mov rsi, r10
lea eax, [r8 + 6]
jmp 0x14000dad5
mov eax, edi
mov qword [rbp - 0x41], rdi
test eax, eax
je 0x14000db63
mov edi, eax
mov edx, eax
mov ecx, 0x42
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbx, rax
test rax, rax
je 0x14000ddf2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x14000dde9
mov r9d, edi
mov r8, rsi
mov edx, edi
mov rcx, rax
call fcn.1400bd9a4
xor edi, edi
test eax, eax
je 0x14000db48
cmp eax, 0xc
je 0x14000ddde
cmp eax, 0x16
je 0x14000ddd3
cmp eax, 0x22
je 0x14000ddd3
cmp eax, 0x50
jne 0x14000ddc8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea r8, [rbp - 0x41]
mov edx, 1
mov rcx, rbx
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov qword [rbp - 0x29], rdi
mov rbx, rdi
mov qword [rbp - 0x29], rbx
mov rcx, qword [rbp - 0x41]
test rcx, rcx
je 0x14000db8e
lea rdx, [rbp - 0x29]
call fcn.140003fe8
mov esi, eax
mov rbx, qword [rbp - 0x29]
test eax, eax
js 0x14000dd0a
call fcn.140009374
test r12, r12
je 0x14000db9f
movzx eax, word [r14 + 0xc]
jmp 0x14000dba4
movzx eax, word [r14 + 8]
movsx ecx, ax
mov dword [rbp + 7], ecx
test r12, r12
je 0x14000dbb6
movzx eax, word [r14 + 0xe]
jmp 0x14000dbbb
movzx eax, word [r14 + 0xa]
movsx edx, ax
mov dword [rbp + 0xb], edx
test r12, r12
je 0x14000dbcd
movzx eax, word [r14 + 0x10]
jmp 0x14000dbd2
movzx eax, word [r14 + 0xc]
cwde
add eax, ecx
mov dword [rbp + 0xf], eax
test r12, r12
je 0x14000dbe3
movzx eax, word [r15]
jmp 0x14000dbe8
movzx eax, word [r14 + 0xe]
cwde
add eax, edx
mov dword [rbp + 0x13], eax
lea rdx, [rbp + 7]
mov rdi, qword [rbp - 0x11]
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_MapDialogRect]
xor edx, edx
test r12, r12
je 0x14000dc0d
mov eax, dword [r14 + 0x14]
jmp 0x14000dc12
movzx eax, word [r14 + 0x10]
test r12, r12
je 0x14000dc1d
mov ecx, dword [r14 + 4]
jmp 0x14000dc1f
mov ecx, edx
test r12, r12
je 0x14000dc2a
mov r9d, dword [r14 + 8]
jmp 0x14000dc2d
mov r9d, dword [r14]
mov r10d, eax
mov r11, qword [rdi + 8]
mov edi, dword [rbp + 0x13]
mov esi, dword [rbp + 0xb]
sub edi, esi
mov edx, dword [rbp + 0xf]
mov r8d, dword [rbp + 7]
sub edx, r8d
bts r9d, 0x10
and qword [rsp + 0x58], 0
mov rax, qword [0x1401a74e8]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], r10
mov qword [rsp + 0x40], r11
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], r8d
xor r8d, r8d
lea rdx, str.AtlAxWinLic110
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov rdi, rax
mov qword [rbp - 9], rax
test rax, rax
je 0x14000dd03
test r12, r12
je 0x14000dca9
mov edx, dword [r14]
test edx, edx
je 0x14000dca9
mov rcx, rax
call qword [sym.imp.USER32.dll_SetWindowContextHelpId]
mov qword [rsp + 0x20], rbx
mov r8, qword [rbp - 0x41]
mov rdx, r13
lea rcx, [rbp - 9]
call fcn.14000e474
mov esi, eax
xor r13d, r13d
test eax, eax
js 0x14000ddf9
movzx eax, word [rbp - 0x49]
neg ax
sbb rdx, rdx
and rdx, qword [rbp - 0x31]
mov dword [rsp + 0x30], 0x13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rax, rdi
mov qword [rbp - 0x31], rax
jmp 0x14000dd0a
call fcn.140003c08
mov esi, eax
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, qword [rbp - 0x41]
test rcx, rcx
je 0x14000dd3e
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x14000dd3e
test cx, cx
je 0x14000dd4f
mov edx, 2
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindow]
mov qword [rbp - 0x31], rax
jmp 0x14000dd45
mov edi, dword [rbp - 0x39]
mov rbx, qword [rbp - 0x19]
movzx ecx, word [rbp - 0x49]
mov r8d, 1
test r12, r12
cmovne r15, rbx
mov edx, 0xffff
cmp word [r15], dx
jne 0x14000dd67
add r15, 4
jmp 0x14000dd74
movzx eax, word [r15]
add r15, 2
test ax, ax
jne 0x14000dd67
cmp word [r15], dx
jne 0x14000dd80
add r15, 4
jmp 0x14000dd8d
movzx eax, word [r15]
add r15, 2
test ax, ax
jne 0x14000dd80
movzx eax, word [r15]
test ax, ax
je 0x14000dda3
test r12, r12
jne 0x14000dda3
mov edx, 0xfffe
add ax, dx
movzx eax, ax
lea r14, [r15 + 5]
add r14, rax
and r14, 0xfffffffffffffffc
add cx, r8w
mov word [rbp - 0x49], cx
cmp cx, word [rbp - 0x47]
jae 0x14000de1b
mov rax, qword [rbp - 0x31]
jmp 0x14000da5f
mov ecx, 0x80004005
call fcn.140001874
int3
mov ecx, 0x80070057
call fcn.140001874
int3
mov ecx, 0x8007000e
call fcn.140001874
int3
call fcn.140003c08
mov esi, eax
jmp 0x14000de03
mov esi, 0x8007000e
jmp 0x14000de03
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, qword [rbp - 0x41]
test rcx, rcx
je 0x14000de1b
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x14000de1b
call fcn.140003c08
mov esi, eax
mov eax, esi
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.1400bcfc0
mov rbx, qword [rsp + 0x120]
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret