Function at 0x1400a48b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x50
xor ebx, ebx
mov ebp, r9d
mov r15d, r8d
mov r14d, edx
mov rsi, rcx
mov r13d, ebx
test rcx, rcx
je 0x1400a48f4
xor edx, edx
mov r8d, 2
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
jmp 0x1400a48fb
mov rdi, qword [0x14012bba8]
test rdi, rdi
je 0x1400a4ae9
mov qword [rsp + 0x88], r12
lea r12, [0x14012e1a4]
test r14d, r14d
jns 0x1400a4924
movzx eax, r14w
neg ax
movzx edx, ax
jmp 0x1400a495c
test r14d, r14d
mov dword [rsp + 0x44], ebx
mov eax, 1
mov qword [rsp + 0x48], r12
cmovne eax, r14d
lea r9, [rsp + 0x40]
lea r8, [0x1400a4890]
mov dword [rsp + 0x40], eax
mov edx, recv
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
mov rdx, qword [rsp + 0x48]
cmp rdx, r12
je 0x1400a4ab4
mov r8d, recv
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x1400a4ab4
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400a4ab4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rsi, rax
test rax, rax
je 0x1400a4aac
cmp r15d, 0xffffffff
cmovne ebp, r15d
test ebp, ebp
jne 0x1400a49c0
mov ecx, reloc.WSOCK32.dll_inet_ntoa
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ebp, eax
movzx eax, word [rsi + 4]
lea rdx, [rsi + 6]
mov r12, rbx
mov r8d, ebx
mov r15d, ebx
cmp bx, ax
jae 0x1400a4aac
mov r9, rdx
mov r11d, eax
mov esi, 0x100
nop word [rax + rax]
movzx ecx, byte [rdx]
mov eax, ebx
movzx r10d, word [rdx + 6]
test ecx, ecx
cmove ecx, esi
cmp ecx, r8d
jle 0x1400a4a0c
cmp r8d, ebp
setl al
jmp 0x1400a4a1b
jge 0x1400a4a15
cmp ecx, ebp
setge al
jmp 0x1400a4a1b
cmp r10d, r15d
setg al
test eax, eax
je 0x1400a4a28
mov r12, r9
mov r8d, ecx
mov r15d, r10d
add r9, 0xe
add rdx, 0xe
sub r11, 1
jne 0x1400a49f0
test r12, r12
je 0x1400a4aac
movzx edx, word [r12 + 0xc]
mov r8d, 3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x1400a4aac
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400a4aac
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbp, rax
test rax, rax
je 0x1400a4aac
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x30], ebx
mov r9d, 0x30000
mov edx, eax
mov dword [rsp + 0x28], ebx
mov r8d, 1
mov dword [rsp + 0x20], ebx
mov rcx, rbp
call qword [sym.imp.USER32.dll_CreateIconFromResourceEx]
mov r13, rax
mov rsi, qword [rsp + 0x80]
mov rcx, qword [rsp + 0xa0]
mov r12, qword [rsp + 0x88]
test rcx, rcx
je 0x1400a4ad6
test r13, r13
je 0x1400a4ad6
mov qword [rcx], rdi
mov rax, r13
jmp 0x1400a4b0a
test rsi, rsi
je 0x1400a4ae4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test r13, r13
jne 0x1400a4ad1
test r14d, r14d
jle 0x1400a4af4
lea ebx, [r14 - 1]
jmp 0x1400a4afc
cmp r14d, 0xffffffff
cmovl ebx, r14d
mov r8d, ebx
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ExtractIconW]
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret