Function at 0x18005e0e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
push r15
sub rsp, 0x328
mov rax, qword [0x18013b490]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
mov rbx, qword [0x18013cb20]
mov eax, edx
movzx edi, dx
mov esi, r8d
mov r15, rcx
mov rcx, rbx
mov rdx, rdi
mov r8d, 0xf1
mov dword [rsp + 0x64], r9d
mov dword [rsp + 0x60], eax
mov qword [rsp + 0x78], rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
jne 0x18005e13d
xor eax, eax
jmp 0x18005e528
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x18005e136
mov rcx, rax
mov qword [rsp + 0x318], r12
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r12, rax
test rax, rax
je 0x18005e520
xor r8d, r8d
lea rbx, [rax + 8]
movzx eax, word [rax + 6]
test esi, esi
mov qword [rsp + 0x320], rbp
mov qword [rsp + 0x310], r13
mov r13d, r8d
setne r13b
mov qword [rsp + 0x308], r14
add eax, r13d
mov qword [rsp + 0xe0], r8
movsxd r14, eax
je 0x18005e1eb
xor edx, edx
or rax, 0xffffffffffffffff
div r14
cmp rax, 0x20
jb 0x18005e1e0
mov rdx, r14
shl rdx, 5
cmp rdx, 0x200
jbe 0x18005e1eb
lea rcx, [rsp + 0xe0]
call fcn.18005a480
mov rbp, qword [rsp + 0xe0]
xor r8d, r8d
jmp 0x18005e1fb
mov ecx, 0x80070057
call fcn.1800014f0
int3
lea rbp, [rsp + 0xe8]
mov qword [rsp + 0xe0], rbp
test rbp, rbp
jne 0x18005e210
lea rax, [rsp + 0xe8]
test rax, rax
jmp 0x18005e30c
test esi, esi
je 0x18005e22f
mov dword [rbp], 4
mov dword [rbp + 4], r8d
mov byte [rbp + 8], 0
mov byte [rbp + 9], 1
mov qword [rbp + 0x10], r8
mov qword [rbp + 0x18], r8
mov esi, r8d
mov edx, r8d
movsxd rax, r13d
cmp r8w, word [r12 + 6]
jae 0x18005e2a0
shl rax, 5
lea rcx, [rax + rbp + 8]
nop dword [rax]
cmp word [rbx], 0
je 0x18005e272
mov dword [rcx - 8], esi
movzx eax, word [rbx]
inc esi
mov byte [rcx], 4
mov byte [rcx + 1], 0
mov qword [rcx + 8], r8
mov dword [rcx - 4], eax
mov qword [rcx + 0x10], r8
jmp 0x18005e28c
mov dword [rcx - 8], 8
mov dword [rcx - 4], r8d
mov byte [rcx], 0
mov byte [rcx + 1], 1
mov qword [rcx + 8], r8
mov qword [rcx + 0x10], r8
movzx eax, word [r12 + 6]
inc edx
add rbx, 2
add rcx, 0x20
cmp edx, eax
jl 0x18005e250
movsxd rcx, dword [rsp + 0x370]
mov rax, qword [0x18013cb18]
mov r9d, dword [rsp + 0x64]
mov qword [rsp + 0x58], r8
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x38], 0x64
mov dword [rsp + 0x30], 0x64
mov dword [rsp + 0x28], r8d
mov dword [rsp + 0x20], r8d
lea rdx, str.ToolbarWindow32
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov r13, rax
test rax, rax
jne 0x18005e322
lea rax, [rsp + 0xe8]
cmp qword [rsp + 0xe0], rax
je 0x18005e31b
lea rcx, [rsp + 0xe0]
call fcn.18005a230
xor eax, eax
jmp 0x18005e508
xor r9d, r9d
mov edx, 0x41e
mov rcx, rax
lea r8d, [r9 + 0x20]
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x31]
mov rcx, r13
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbx, rax
test rax, rax
jne 0x18005e35e
lea ecx, [rax + 0xd]
call qword [sym.imp.GDI32.dll_GetStockObject]
mov rbx, rax
xor edx, edx
lea rcx, [rsp + 0x80]
lea r8d, [rdx + 0x5c]
call fcn.180076350
lea r8, [rsp + 0x80]
mov edx, 0x5c
mov rcx, rbx
call qword [sym.imp.GDI32.dll_GetObjectW]
mov eax, dword [rsp + 0x80]
mov rbx, qword [0x18013cb20]
cdq
mov r8d, 2
mov rcx, rbx
mov r15d, eax
xor r15d, edx
sub r15d, edx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
movzx ecx, word [rax + 0xe]
cmp cx, 4
jbe 0x18005e425
movzx r8d, word [r12 + 2]
or edx, 0xffffffff
cmp cx, 0x20
mov rcx, qword [0x18013cb20]
mov eax, 0xff000000
mov dword [rsp + 0x30], 0x2040
cmove eax, edx
mov r9d, 1
mov rdx, rdi
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], eax
call qword [sym.imp.COMCTL32.dll_ImageList_LoadImageW]
xor r8d, r8d
mov edx, 0x430
mov rcx, r13
mov r9, rax
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x18005e460
xor eax, eax
lea r9, [rsp + 0x68]
movsxd r8, esi
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x6c], eax
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x74], eax
mov rax, qword [rsp + 0x78]
mov edx, 0x413
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x60]
mov rcx, r13
mov qword [rsp + 0x70], rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov r9, rbp
mov r8, r14
mov edx, 0x444
mov rcx, r13
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, word [r12 + 4]
movzx ecx, r15w
cmp ax, r15w
mov edx, 0x420
cmova cx, ax
movzx eax, word [r12 + 2]
xor r8d, r8d
movzx ecx, cx
shl ecx, 0x10
or ecx, eax
movsxd r9, ecx
mov rcx, r13
call qword [sym.imp.USER32.dll_SendMessageW]
movzx r11d, word [r12 + 4]
movzx eax, word [r12 + 2]
cmp r11w, r15w
cmova r15w, r11w
add ax, 7
xor r8d, r8d
movzx ecx, ax
add r15w, 7
movzx edx, r15w
shl edx, 0x10
or edx, ecx
mov rcx, r13
movsxd r9, edx
mov edx, 0x41f
call qword [sym.imp.USER32.dll_SendMessageW]
lea r11, [rsp + 0xe8]
cmp qword [rsp + 0xe0], r11
je 0x18005e505
lea rcx, [rsp + 0xe0]
call fcn.18005a230
mov rax, r13
mov r13, qword [rsp + 0x310]
mov rbp, qword [rsp + 0x320]
mov r14, qword [rsp + 0x308]
mov r12, qword [rsp + 0x318]
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.180076320
add rsp, 0x328
pop r15
pop rdi
pop rsi
pop rbx
ret