Function at 0x100006840
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x48], rbx
lea rdx, [0x1000016f8]
mov r8d, 0xa
xor ecx, ecx
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdi
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, 0x40
lea edx, [rax + 1]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
test rax, rax
mov rsi, rax
mov qword [0x100012bb0], rax
jne 0x100006909
xor ebx, ebx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x4b5
xor ecx, ecx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 0x10
call fcn.100005260
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x1000068de
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x100012170], eax
xor eax, eax
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
add rsp, 0x38
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
xor eax, eax
mov dword [0x100012170], ecx
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
add rsp, 0x38
ret
lea rdx, [0x1000016f8]
mov r8d, 0xa
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
cmp eax, edi
mov ebx, eax
ja 0x100006980
test rsi, rsi
je 0x100006980
test eax, eax
je 0x100006984
lea rdx, [0x1000016f8]
mov r8d, 0xa
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rdi, rax
je 0x100006984
mov r8, rbx
mov rdx, rax
mov rcx, rsi
call sub.msvcrt.dll_memcpy
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeResource]
test ebx, ebx
jne 0x1000069d1
xor ebx, ebx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x4b1
xor ecx, ecx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 0x10
call fcn.100005260
mov rcx, qword [0x100012bb0]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [0x100012170], 0x80070714
xor eax, eax
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
add rsp, 0x38
ret
mov rcx, qword [0x100012bb0]
lea rdx, [0x1000016d4]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
xor ebx, ebx
test eax, eax
je 0x100006aa1
mov rdi, qword [0x100012bc0]
lea r8d, [rbx + 5]
mov edx, 0x7d1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceA]
test rax, rax
je 0x100006a4e
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
mov rsi, rax
je 0x100006a4e
lea r9, [0x100005070]
xor r8d, r8d
mov rdx, rax
mov rcx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.USER32.dll_DialogBoxIndirectParamA]
mov rcx, rsi
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_FreeResource]
cmp rdi, 0xffffffffffffffff
jne 0x100006a6f
xor r9d, r9d
xor r8d, r8d
mov edx, 0x4fb
xor ecx, ecx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 0x10
call fcn.100005260
mov rdi, rbx
mov rcx, qword [0x100012bb0]
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rdi, rdi
jne 0x100006aae
mov dword [0x100012170], 0x800704c7
xor eax, eax
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
add rsp, 0x38
ret
mov rcx, qword [0x100012bb0]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov dword [0x100012170], ebx
mov rbx, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x38
ret