Function at 0x70d8d110
Capabilities:
Access peb ldr_data
Extract resource via kernel32 functions
Get process heap flags
Get process heap force flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x58
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
mov edi, dword [ecx + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ecx + 8]
mov dword [ebp - 0x28], eax
test byte [0x70d95058], 8
jne 0x70d8d210
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x70d8d248
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_FindResourceW]
mov dword [esp + 8], str.PACKTHEM_VERSION
mov dword [esp + 4], 1
mov dword [ebp - 0x34], eax
call eax
sub esp, 0xc
test eax, eax
je 0x70d8d1e0
mov dword [esp + 4], eax
mov dword [ebp - 0x30], eax
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_SizeofResource]
mov edx, dword [ebp - 0x30]
sub esp, 8
cmp eax, 2
je 0x70d8d290
test byte [0x70d95058], 8
jne 0x70d8d2f0
mov esi, 0x8007000b
mov dword [edi], 0
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_FreeLibrary]
sub esp, 4
lea esp, [ebp - 0x10]
mov eax, esi
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
test byte [0x70d95058], 8
je 0x70d8d1b8
mov dword [esp + 0xc], str.No_version_resource_found_n
mov dword [esp + 8], 0x70d980f0
mov dword [esp + 4], 0x70d95058
mov dword [esp], 3
call fcn.70d8bad0
jmp 0x70d8d1b8
mov eax, esi
call fcn.70d8b780
mov dword [esp + 0xc], 0x70d97d18
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0x70d980f0
mov dword [esp + 4], 0x70d95058
mov dword [esp], 3
call fcn.70d8bad0
jmp 0x70d8d142
mov eax, dword fs:[0x18]
mov esi, dword [eax + 0x34]
test esi, esi
jle 0x70d8d278
mov dword [edi], 0
lea esp, [ebp - 0x10]
movzx esi, si
pop ecx
or esi, 0x80070000
pop ebx
mov eax, esi
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
mov dword [edi], 0
lea esp, [ebp - 0x10]
mov eax, esi
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
mov eax, dword [sym.imp.kernel32.dll_LoadResource]
mov dword [esp + 4], edx
mov dword [esp], ebx
mov dword [ebp - 0x30], eax
call eax
movzx eax, word [eax]
sub esp, 8
cmp ax, 3
je 0x70d8d320
test byte [0x70d95058], 8
je 0x70d8d1b8
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Version_of_theme_file_is_unsupported:_0x_04x_n
mov dword [esp + 8], 0x70d980f0
mov dword [esp + 4], 0x70d95058
mov dword [esp], 3
call fcn.70d8bad0
jmp 0x70d8d1b8
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Version_resource_found__but_wrong_size:__ld_n
mov dword [esp + 8], 0x70d980f0
mov dword [esp + 4], 0x70d95058
mov dword [esp], 3
call fcn.70d8bad0
jmp 0x70d8d1b8
mov dword [esp + 8], str.COLORNAMES
mov dword [esp + 4], 1
mov dword [esp], ebx
mov eax, dword [ebp - 0x34]
call eax
sub esp, 0xc
test eax, eax
je 0x70d8d488
mov dword [esp + 4], eax
mov dword [esp], ebx
mov eax, dword [ebp - 0x30]
call eax
sub esp, 8
mov dword [ebp - 0x38], eax
mov dword [esp + 8], str.SIZENAMES
mov dword [esp + 4], 1
mov dword [esp], ebx
mov eax, dword [ebp - 0x34]
call eax
sub esp, 0xc
test eax, eax
je 0x70d8d4da
mov dword [esp + 4], eax
mov dword [esp], ebx
mov eax, dword [ebp - 0x30]
call eax
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
sub esp, 8
test eax, eax
je 0x70d8d401
cmp word [edx], 0
je 0x70d8d622
mov ecx, dword [sym.imp.kernel32.dll_lstrcmpiW]
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x3c], esi
mov esi, edx
mov dword [ebp - 0x40], edi
mov edi, eax
mov ebx, ecx
lea esi, [esi]
nop
mov dword [esp + 4], esi
mov dword [esp], edi
call ebx
sub esp, 8
test eax, eax
je 0x70d8d5b8
cmp word [esi], 0
je 0x70d8d4d0
mov eax, esi
lea esi, [esi]
nop
add eax, 2
cmp word [eax], 0
jne 0x70d8d3e0
sub eax, esi
add eax, 2
add esi, eax
cmp word [esi], 0
jne 0x70d8d3b8
mov ebx, dword [ebp - 0x34]
xor edx, edx
mov esi, dword [ebp - 0x3c]
mov edi, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x28]
test ecx, ecx
je 0x70d8d5c8
mov eax, dword [ebp - 0x30]
cmp word [eax], 0
je 0x70d8d46c
mov ecx, eax
mov eax, dword [sym.imp.kernel32.dll_lstrcmpiW]
mov dword [ebp - 0x3c], edi
mov edi, dword [ebp - 0x28]
mov dword [ebp - 0x34], ebx
mov ebx, ecx
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x40], edx
mov esi, eax
nop
mov dword [esp + 4], ebx
mov dword [esp], edi
call esi
sub esp, 8
test eax, eax
je 0x70d8d510
cmp word [ebx], 0
je 0x70d8d4c0
mov eax, ebx
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x70d8d450
sub eax, ebx
add eax, 2
add ebx, eax
cmp word [ebx], 0
jne 0x70d8d430
mov ebx, dword [ebp - 0x34]
mov edi, dword [ebp - 0x3c]
test byte [0x70d95058], 8
jne 0x70d8d5df
mov esi, 0x80070490
jmp 0x70d8d1bd
test byte [0x70d95058], 8
je 0x70d8d1b8
mov dword [esp + 0xc], str.Color_names_resource_not_found_n
mov dword [esp + 8], 0x70d980f0
mov dword [esp + 4], 0x70d95058
mov dword [esp], 3
call fcn.70d8bad0
jmp 0x70d8d1b8
mov eax, 2
jmp 0x70d8d45e
mov eax, 2
jmp 0x70d8d3ee
test byte [0x70d95058], 8
je 0x70d8d1b8
mov dword [esp + 0xc], str.Size_names_resource_not_found_n
mov dword [esp + 8], 0x70d980f0
mov dword [esp + 4], 0x70d95058
mov dword [esp], 3
call fcn.70d8bad0
jmp 0x70d8d1b8
mov edx, dword [ebp - 0x40]
mov ecx, ebx
mov esi, dword [ebp - 0x44]
mov ebx, dword [ebp - 0x34]
mov edi, dword [ebp - 0x3c]
test edx, edx
sete al
movd xmm1, dword [ebp - 0x38]
movd xmm0, edx
movd xmm2, ecx
movd xmm3, dword [ebp - 0x30]
punpckldq xmm0, xmm2
punpckldq xmm1, xmm3
punpcklqdq xmm1, xmm0
test al, al
jne 0x70d8d46c
movaps xmmword [ebp - 0x28], xmm1
mov eax, dword fs:[0x18]
mov dword [esp + 8], 0x22c
mov dword [esp + 4], 8
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [edi], eax
sub esp, 0xc
add eax, 8
mov dword [eax - 4], ebx
mov dword [esp], esi
xor esi, esi
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 0x104
call dword [sym.imp.kernel32.dll_GetFullPathNameW]
mov eax, dword [edi]
movdqa xmm1, xmmword [ebp - 0x28]
sub esp, 0x10
movups xmmword [eax + 0x210], xmm1
mov dword [eax], 1
jmp 0x70d8d1cf
mov edx, esi
mov ebx, dword [ebp - 0x34]
mov esi, dword [ebp - 0x3c]
mov edi, dword [ebp - 0x40]
jmp 0x70d8d401
mov eax, dword [ebp - 0x30]
test eax, eax
sete al
test edx, edx
sete cl
or eax, ecx
mov ecx, dword [ebp - 0x30]
jmp 0x70d8d523
mov eax, dword [ebp - 0x28]
call fcn.70d8b780
mov esi, eax
mov eax, dword [ebp - 0x2c]
call fcn.70d8b780
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Requested_color_size___s__s__not_found_in_theme_n
mov dword [esp + 8], 0x70d980f0
mov dword [esp + 4], 0x70d95058
mov dword [esp], 3
call fcn.70d8bad0
jmp 0x70d8d479
xor edx, edx
cmp dword [ebp - 0x28], 0
jne 0x70d8d40c
jmp 0x70d8d46c