Function at 0x140004b00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xc0
mov rax, qword [0x14001c340]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov r15, rcx
mov qword [rbp - 0x19], rcx
movzx ebx, dx
mov r8d, 0xf0
mov edx, ebx
mov rcx, qword [0x14001dea0]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
xor r14d, r14d
mov edi, r14d
mov qword [rbp - 9], r14
mov esi, r14d
test rax, rax
je 0x140004b80
mov rdx, rax
mov rcx, qword [0x14001dea0]
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140004b80
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov qword [rbp - 9], rax
mov r8d, 5
mov rdx, rbx
mov rcx, qword [0x14001dea0]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x140004fec
mov rdx, rax
mov rcx, qword [0x14001dea0]
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140004fe5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rcx, rax
test rax, rax
je 0x140004fe5
movzx r12d, word [rax + 2]
mov edx, 0xffff
mov eax, r14d
cmp r12w, dx
sete al
mov dword [rbp - 0x21], eax
mov eax, 0x10
mov r8d, 8
cmovne eax, r8d
movzx r8d, word [rax + rcx]
mov word [rbp - 0x39], r8w
call fcn.140006720
mov r14, rax
mov edx, 5
mov rcx, qword [r15 + 8]
call qword [sym.imp.USER32.dll_GetWindow]
mov rbx, rax
mov qword [rbp - 0x29], rax
xor r11d, r11d
movzx r13d, r11w
movzx r15d, word [rbp - 0x39]
cmp r11w, r15w
jae 0x140004fec
mov edx, 0x12
mov ecx, 0xffff
cmp r12w, cx
jne 0x140004c47
mov r8d, dword [r14 + 0x14]
jmp 0x140004c4c
movzx r8d, word [r14 + 0x10]
mov eax, 0x18
cmovne rax, rdx
cmp word [rax + r14], 0x7b
jne 0x140004f28
mov rsi, r11
mov rax, rdi
test rdi, rdi
je 0x140004c91
nop dword [rax]
movzx ecx, word [rax]
lea r10, [rax + 2]
movzx r9d, word [rax + 2]
mov edx, dword [rax + 4]
cmp ecx, r8d
je 0x140004d96
add rax, 8
add rax, rdx
jne 0x140004c70
mov edx, r11d
mov rcx, r11
mov qword [rbp - 0x31], rcx
test edx, edx
je 0x140004d11
mov edi, edx
mov ecx, 0x42
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbx, rax
test rax, rax
je 0x140004fa4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x140004f84
mov r8d, edi
mov rcx, rax
test rsi, rsi
je 0x140005015
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea r8, [rbp - 0x31]
mov edx, 1
mov rcx, rbx
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov esi, eax
test eax, eax
js 0x140004f6b
mov rcx, qword [rbp - 0x31]
mov rbx, qword [rbp - 0x29]
xor r11d, r11d
mov qword [rbp - 0x11], r11
lea rdx, [rbp - 0x11]
call fcn.14000af20
mov esi, eax
mov rdi, qword [rbp - 0x11]
test eax, eax
js 0x140004f05
call fcn.14000f300
mov ecx, 0xffff
mov r15d, 0x18
cmp r12w, cx
mov edx, 0x12
cmovne r15d, edx
add r15, r14
cmp r12w, cx
jne 0x140004db0
movsx ecx, word [r14 + 0xc]
mov dword [rbp + 7], ecx
movsx edx, word [r14 + 0xe]
mov dword [rbp + 0xb], edx
movsx eax, word [r14 + 0x10]
add eax, ecx
mov dword [rbp + 0xf], eax
movsx eax, word [r14 + 0x12]
add eax, edx
mov dword [rbp + 0x13], eax
lea rdx, [rbp + 7]
mov rcx, qword [rbp - 0x19]
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_MapDialogRect]
mov ecx, dword [r14 + 0x14]
mov esi, dword [r14 + 4]
lea r9, [r14 + 8]
jmp 0x140004df0
mov eax, 0x378
cmp r9w, ax
je 0x140004c91
mov rsi, r10
add edx, 6
jmp 0x140004c94
movsx ecx, word [r14 + 8]
mov dword [rbp + 7], ecx
movsx edx, word [r14 + 0xa]
mov dword [rbp + 0xb], edx
movsx eax, word [r14 + 0xc]
add eax, ecx
mov dword [rbp + 0xf], eax
movsx eax, word [r14 + 0xe]
add eax, edx
mov dword [rbp + 0x13], eax
lea rdx, [rbp + 7]
mov rcx, qword [rbp - 0x19]
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_MapDialogRect]
movzx ecx, word [r14 + 0x10]
xor esi, esi
mov r9, r14
mov r9d, dword [r9]
bts r9d, 0x10
mov rax, qword [rbp - 0x19]
mov rbx, qword [rax + 8]
mov r10d, dword [rbp + 0x13]
mov r11d, dword [rbp + 0xb]
sub r10d, r11d
mov edx, dword [rbp + 0xf]
mov r8d, dword [rbp + 7]
sub edx, r8d
mov qword [rsp + 0x58], 0
mov rax, qword [0x14001de98]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x38], r10d
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x28], r11d
mov dword [rsp + 0x20], r8d
xor r8d, r8d
lea rdx, str.AtlAxWinLic140
mov ecx, esi
call fcn.14000f5a0
mov rbx, rax
mov qword [rbp - 1], rax
test rax, rax
je 0x140004ef5
mov edx, 0xffff
cmp r12w, dx
jne 0x140004e84
mov edx, dword [r14]
test edx, edx
je 0x140004e84
mov rcx, rax
call qword [sym.imp.USER32.dll_SetWindowContextHelpId]
nop
mov qword [rsp + 0x38], rdi
xor eax, eax
mov qword [rsp + 0x30], rax
lea rcx, [0x140014f90]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, qword [rbp - 0x31]
mov rdx, r15
lea rcx, [rbp - 1]
call fcn.140005170
mov esi, eax
test eax, eax
js 0x140004fc2
test r13w, r13w
mov rdx, qword [rbp - 0x29]
mov eax, 0
cmove rdx, rax
mov dword [rsp + 0x30], 0x13
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetWindowPos]
nop
mov qword [rbp - 0x29], rbx
jmp 0x140004f00
call fcn.140003cc0
mov esi, eax
mov rbx, qword [rbp - 0x29]
movzx r15d, word [rbp - 0x39]
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, qword [rbp - 0x31]
test rcx, rcx
je 0x140004f26
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140013710]
nop
jmp 0x140004f43
test r13w, r13w
je 0x140004f43
mov edx, 2
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindow]
mov rbx, rax
mov qword [rbp - 0x29], rax
mov edx, dword [rbp - 0x21]
mov rcx, r14
call fcn.1400067e0
mov r14, rax
inc r13w
cmp r13w, r15w
jae 0x140004fec
mov rdi, qword [rbp - 9]
xor r11d, r11d
jmp 0x140004c31
mov rcx, qword [rbp - 0x31]
test rcx, rcx
je 0x140004f82
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140013710]
nop
jmp 0x140004fec
call fcn.140003cc0
mov esi, eax
mov rcx, qword [rbp - 0x31]
test rcx, rcx
je 0x140004fa2
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140013710]
nop
jmp 0x140004fec
mov esi, 0x8007000e
mov rcx, qword [rbp - 0x31]
test rcx, rcx
je 0x140004fc0
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140013710]
nop
jmp 0x140004fec
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, qword [rbp - 0x31]
test rcx, rcx
je 0x140004fe3
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140013710]
nop
jmp 0x140004fec
call fcn.140003cc0
mov esi, eax
mov eax, esi
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.140010860
mov rbx, qword [rsp + 0x110]
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor edx, edx
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x16
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo]
mov ecx, 0x80070057
call fcn.1400014b0
int3