Function at 0x140065730
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov rax, qword [0x140193440]
xor rax, rsp
mov qword [rbp + 0x90], rax
movdqa xmm0, xmmword [0x140179480]
xor esi, esi
movdqa xmm1, xmmword [0x140179400]
xor r15d, r15d
movdqu xmmword [rbp - 0x80], xmm0
mov qword [rsp + 0x60], rcx
movss xmm0, dword [0x140196f6c]
comiss xmm0, dword [0x140176f18]
lea ecx, [r15 + 0x31]
movdqu xmmword [rbp - 0x70], xmm1
setbe sil
xor eax, eax
add esi, 0xfffffffb
comiss xmm0, dword [0x140176f30]
seta al
sub esi, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rsp + 0x70], eax
mov r14d, eax
cmp eax, 0x36
jl 0x1400657d0
lea edi, [r15 + 0x40]
lea r15d, [rdi - 0x2c]
jmp 0x140065806
cmp r14d, 0x28
jl 0x1400657e1
mov edi, 0x30
lea r15d, [rdi - 0x1c]
jmp 0x140065806
cmp r14d, 0x1c
jl 0x1400657f2
mov edi, 0x20
lea r15d, [rdi - 0xc]
jmp 0x140065806
cmp r14d, 0x14
jl 0x140065803
mov edi, 0x18
lea r15d, [rdi - 0xe]
jmp 0x140065806
mov edi, r14d
lea rcx, str.ComDlg32
call fcn.140060610
mov r9d, edi
mov dword [rsp + 0x28], 0x8000
mov edx, 0x241
mov dword [rsp + 0x20], edi
mov r8d, 1
mov rcx, rax
mov rbx, rax
call qword [sym.imp.USER32.dll_LoadImageW]
mov r9d, edi
mov dword [rsp + 0x28], 0x8000
mov edx, 0x242
mov dword [rsp + 0x20], edi
mov r8d, 1
mov rcx, rbx
mov r12, rax
call qword [sym.imp.USER32.dll_LoadImageW]
lea rcx, str.Shell32
mov r13, rax
call fcn.140060610
mov rbx, rax
test r13, r13
jne 0x140065899
mov dword [rsp + 0x28], 0x8000
lea r8d, [r13 + 1]
mov r9d, edi
mov dword [rsp + 0x20], edi
mov edx, 0x416d
mov rcx, rax
call qword [sym.imp.USER32.dll_LoadImageW]
mov r13, rax
test r12, r12
jne 0x1400658c3
mov dword [rsp + 0x28], 0x8000
lea r8d, [r12 + 1]
mov r9d, edi
mov dword [rsp + 0x20], edi
mov edx, 0x416e
mov rcx, rbx
call qword [sym.imp.USER32.dll_LoadImageW]
mov r12, rax
xor ebx, ebx
mov r8d, 0x20020
mov edx, r14d
mov dword [rsp + 0x20], ebx
mov ecx, r14d
lea r9d, [rbx + 1]
call qword [sym.imp.COMCTL32.dll_ImageList_Create]
lea r9d, [rbx + 1]
mov dword [rsp + 0x20], ebx
mov r8d, 0x20020
mov qword [0x1401e6770], rax
mov edx, r14d
mov ecx, r14d
call qword [sym.imp.COMCTL32.dll_ImageList_Create]
mov rcx, qword [0x1401e6770]
lea edx, [rbx - 1]
mov r8, r13
mov qword [0x1401e6778], rax
call qword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
mov rcx, qword [0x1401e6778]
lea edx, [rbx - 1]
mov r8, r12
call qword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
lea rbx, [0x1401e5360]
xor edx, edx
mov rcx, rbx
mov r8d, 0x200
call fcn.140136960
mov ecx, 0xc2f
call fcn.1400207e0
xor r12d, r12d
mov rdx, rax
cmp dword [0x1401e8344], r12d
mov ecx, r12d
setne cl
add ecx, 0xc31
call fcn.1400207e0
mov r8, rax
mov dword [rsp + 0x28], 0x80
xor edx, edx
mov qword [rsp + 0x20], rbx
mov ecx, 0xfde9
lea r9d, [r12 - 1]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rax, qword [0x1401e8838]
lea rdx, str.ToolbarWindow32
mov qword [rsp + 0x58], r12
mov r9d, 0x56011958
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov rax, qword [0x1401e8a68]
xor ecx, ecx
mov qword [rsp + 0x48], 0x413
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
call qword [sym.imp.USER32.dll_CreateWindowExW]
xor r9d, r9d
lea r8d, [r12 + 6]
mov rcx, rax
mov qword [0x1401e8200], rax
mov edx, 0x2007
call qword [sym.imp.USER32.dll_SendMessageW]
xor edx, edx
lea rcx, [rbp - 0x50]
mov r8d, 0xe0
call fcn.140136960
mov r9, qword [0x1401e6770]
xor r8d, r8d
mov rcx, qword [0x1401e8200]
mov edx, 0x430
mov dword [rbp - 0x4c], 0x404
mov word [rbp - 0x48], 0x5004
mov qword [rbp - 0x38], rbx
mov dword [rbp - 0x50], r12d
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
lea r8d, [r12 + 0x20]
mov edx, 0x41e
mov rcx, qword [0x1401e8200]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x1401e8200]
lea r9, [rbp - 0x50]
mov edx, 0x444
lea r8d, [r12 + 1]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbx, qword [rsp + 0x60]
mov edx, 0x404
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rbp - 0x60]
call qword [sym.imp.USER32.dll_GetWindowRect]
lea r9d, [r12 + 2]
mov rdx, rbx
lea r8, [rbp - 0x60]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MapWindowPoints]
mov rcx, qword [0x1401e8200]
lea r9, [rsp + 0x78]
xor r8d, r8d
mov edx, 0x463
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [rbp - 0x54]
mov r9d, dword [rbp - 0x5c]
sub edx, r9d
mov r8d, dword [rbp - 0x60]
mov eax, dword [rsp + 0x78]
add r8d, esi
mov rcx, qword [0x1401e8200]
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], edx
mov rdx, qword [0x1401e81e8]
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, 0xc2f
call fcn.1400207e0
mov rcx, qword [0x1401e8200]
mov rdx, rax
call fcn.140060b80
mov ecx, 0xc30
call fcn.1400207e0
cmp dword [0x1401e8348], r12d
mov ecx, r12d
mov rdx, rax
setne cl
add ecx, 0xc31
call fcn.1400207e0
lea rdi, [0x1401e5460]
mov dword [rsp + 0x28], 0x80
mov r8, rax
mov qword [rsp + 0x20], rdi
xor edx, edx
lea r9d, [r12 - 1]
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rax, qword [0x1401e8838]
lea rdx, str.ToolbarWindow32
mov qword [rsp + 0x58], r12
mov r9d, 0x56011958
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov rax, qword [0x1401e8a68]
xor ecx, ecx
mov qword [rsp + 0x48], 0x414
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
call qword [sym.imp.USER32.dll_CreateWindowExW]
xor r9d, r9d
lea r8d, [r12 + 6]
mov rcx, rax
mov qword [0x1401e8220], rax
mov edx, 0x2007
call qword [sym.imp.USER32.dll_SendMessageW]
xor edx, edx
lea rcx, [rbp - 0x50]
mov r8d, 0xe0
call fcn.140136960
mov r9, qword [0x1401e6770]
xor r8d, r8d
mov rcx, qword [0x1401e8220]
mov edx, 0x430
mov dword [rbp - 0x4c], 0x405
mov word [rbp - 0x48], 0x5004
mov qword [rbp - 0x38], rdi
mov dword [rbp - 0x50], r12d
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x1401e8220]
lea r8d, [r12 + 0x20]
xor r9d, r9d
mov edx, 0x41e
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x1401e8220]
lea r9, [rbp - 0x50]
mov edx, 0x444
lea r8d, [r12 + 1]
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, 0x405
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rbp - 0x60]
call qword [sym.imp.USER32.dll_GetWindowRect]
lea r9d, [r12 + 2]
mov rdx, rbx
lea r8, [rbp - 0x60]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MapWindowPoints]
mov rcx, qword [0x1401e8220]
lea r9, [rsp + 0x78]
xor r8d, r8d
mov edx, 0x463
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [rbp - 0x54]
mov r9d, dword [rbp - 0x5c]
sub edx, r9d
mov r8d, dword [rbp - 0x60]
mov eax, dword [rsp + 0x78]
add r8d, esi
mov rcx, qword [0x1401e8220]
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], edx
mov rdx, qword [0x1401e8848]
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, 0xc30
call fcn.1400207e0
mov rcx, qword [0x1401e8220]
mov rdx, rax
call fcn.140060b80
mov rax, qword [0x1401e8838]
lea rdx, str.ToolbarWindow32
mov qword [rsp + 0x58], r12
mov r9d, 0x56011958
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov rax, qword [0x1401e8a68]
xor ecx, ecx
mov qword [rsp + 0x48], 0x417
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
call qword [sym.imp.USER32.dll_CreateWindowExW]
lea r9d, [r12 + 8]
mov dword [rsp + 0x20], r12d
mov r8d, 0x20020
mov qword [0x1401e8218], rax
mov edx, r14d
mov ecx, r14d
call qword [sym.imp.COMCTL32.dll_ImageList_Create]
mov ebx, dword [rsp + 0x70]
lea rsi, [0x14015341c]
mov r13, rax
mov edi, r12d
nop dword [rax]
nop word [rax + rax]
mov r14, qword [0x1401e8838]
movzx ecx, r15w
add cx, word [rsi - 4]
mov r8d, 0xa
movzx edx, cx
mov rcx, r14
mov qword [rsp + 0x60], r12
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r12, rax
test rax, rax
jne 0x140065dc0
call fcn.140050120
mov r8, rax
lea rdx, str.toolbar_icon
lea rcx, str.Could_not_locate_resource__s:__s
call fcn.14004f910
mov rax, qword [rsp + 0x60]
jmp 0x140065e11
mov rdx, r12
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x68], rax
test rax, rax
jne 0x140065df8
call fcn.140050120
mov r8, rax
lea rdx, str.toolbar_icon
lea rcx, str.Could_not_load_resource__s:__s
call fcn.14004f910
mov rax, qword [rsp + 0x60]
jmp 0x140065e11
mov rdx, r12
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, qword [rsp + 0x68]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LockResource]
xor r12d, r12d
mov r9d, 0x30000
mov dword [rsp + 0x30], r12d
mov edx, ebx
mov dword [rsp + 0x28], r12d
mov rcx, rax
mov dword [rsp + 0x20], r12d
lea r8d, [r12 + 1]
call qword [sym.imp.USER32.dll_CreateIconFromResourceEx]
cmp dword [0x14019f510], r12d
mov r14, rax
je 0x140065e54
test edi, edi
jne 0x140065e54
mov rcx, rax
call fcn.14005a0a0
mov r14, rax
mov r8, r14
mov edx, 0xffffffff
mov rcx, r13
call qword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
mov rcx, r14
call qword [sym.imp.USER32.dll_DestroyIcon]
mov r14, qword [0x1401e8838]
movzx eax, r15w
add ax, word [rsi]
mov r8d, 0xa
movzx edx, ax
mov rcx, r14
mov qword [rsp + 0x60], r12
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r12, rax
test rax, rax
jne 0x140065ebd
call fcn.140050120
mov r8, rax
lea rdx, str.toolbar_icon
lea rcx, str.Could_not_locate_resource__s:__s
call fcn.14004f910
mov rax, qword [rsp + 0x60]
jmp 0x140065f0e
mov rdx, r12
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x68], rax
test rax, rax
jne 0x140065ef5
call fcn.140050120
mov r8, rax
lea rdx, str.toolbar_icon
lea rcx, str.Could_not_load_resource__s:__s
call fcn.14004f910
mov rax, qword [rsp + 0x60]
jmp 0x140065f0e
mov rdx, r12
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, qword [rsp + 0x68]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LockResource]
xor r12d, r12d
mov r9d, 0x30000
mov dword [rsp + 0x30], r12d
mov edx, ebx
mov dword [rsp + 0x28], r12d
mov rcx, rax
mov dword [rsp + 0x20], r12d
lea r8d, [r12 + 1]
call qword [sym.imp.USER32.dll_CreateIconFromResourceEx]
cmp dword [0x14019f510], r12d
mov r14, rax
je 0x140065f54
lea ecx, [rdi + 1]
test ecx, ecx
jne 0x140065f54
mov rcx, rax
call fcn.14005a0a0
mov r14, rax
mov r8, r14
mov edx, 0xffffffff
mov rcx, r13
call qword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
mov rcx, r14
call qword [sym.imp.USER32.dll_DestroyIcon]
mov r14, qword [0x1401e8838]
movzx eax, r15w
add ax, word [rsi + 4]
mov r8d, 0xa
movzx edx, ax
mov rcx, r14
mov qword [rsp + 0x60], r12
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r12, rax
test rax, rax
jne 0x140065fbe
call fcn.140050120
mov r8, rax
lea rdx, str.toolbar_icon
lea rcx, str.Could_not_locate_resource__s:__s
call fcn.14004f910
mov rax, qword [rsp + 0x60]
jmp 0x14006600f
mov rdx, r12
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x68], rax
test rax, rax
jne 0x140065ff6
call fcn.140050120
mov r8, rax
lea rdx, str.toolbar_icon
lea rcx, str.Could_not_load_resource__s:__s
call fcn.14004f910
mov rax, qword [rsp + 0x60]
jmp 0x14006600f
mov rdx, r12
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, qword [rsp + 0x68]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LockResource]
xor r12d, r12d
mov r9d, 0x30000
mov dword [rsp + 0x30], r12d
mov edx, ebx
mov dword [rsp + 0x28], r12d
mov rcx, rax
mov dword [rsp + 0x20], r12d
lea r8d, [r12 + 1]
call qword [sym.imp.USER32.dll_CreateIconFromResourceEx]
cmp dword [0x14019f510], r12d
mov r14, rax
je 0x140066055
lea ecx, [rdi + 2]
test ecx, ecx
jne 0x140066055
mov rcx, rax
call fcn.14005a0a0
mov r14, rax
mov r8, r14
mov edx, 0xffffffff
mov rcx, r13
call qword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
mov rcx, r14
call qword [sym.imp.USER32.dll_DestroyIcon]
mov r14, qword [0x1401e8838]
movzx eax, r15w
add ax, word [rsi + 8]
mov r8d, 0xa
movzx edx, ax
mov rcx, r14
mov qword [rsp + 0x60], r12
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r12, rax
test rax, rax
jne 0x1400660bf
call fcn.140050120
mov r8, rax
lea rdx, str.toolbar_icon
lea rcx, str.Could_not_locate_resource__s:__s
call fcn.14004f910
mov rax, qword [rsp + 0x60]
jmp 0x140066110
mov rdx, r12
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x68], rax
test rax, rax
jne 0x1400660f7
call fcn.140050120
mov r8, rax
lea rdx, str.toolbar_icon
lea rcx, str.Could_not_load_resource__s:__s
call fcn.14004f910
mov rax, qword [rsp + 0x60]
jmp 0x140066110
mov rdx, r12
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, qword [rsp + 0x68]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LockResource]
xor r12d, r12d
mov r9d, 0x30000
mov dword [rsp + 0x30], r12d
mov edx, ebx
mov dword [rsp + 0x28], r12d
mov rcx, rax
mov dword [rsp + 0x20], r12d
lea r8d, [r12 + 1]
call qword [sym.imp.USER32.dll_CreateIconFromResourceEx]
cmp dword [0x14019f510], r12d
mov r14, rax
je 0x140066156
lea ecx, [rdi + 3]
test ecx, ecx
jne 0x140066156
mov rcx, rax
call fcn.14005a0a0
mov r14, rax
mov r8, r14
mov edx, 0xffffffff
mov rcx, r13
call qword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
mov rcx, r14
call qword [sym.imp.USER32.dll_DestroyIcon]
add edi, 4
add rsi, 0x10
cmp edi, 4
jb 0x140065d70
mov rcx, qword [0x1401e8218]
mov r9, r13
xor r8d, r8d
mov edx, 0x430
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x1401e8218]
xor r9d, r9d
mov edx, 0x41e
lea r8d, [r9 + 0x20]
call qword [sym.imp.USER32.dll_SendMessageW]
xor edx, edx
lea rcx, [rbp - 0x50]
mov r8d, 0xe0
call fcn.140136960
cmp dword [0x1401a03d8], r12d
mov r10d, 7
je 0x1400661e3
mov eax, dword [rbp - 0x74]
mov r10d, 5
mov dword [rbp - 0x78], eax
mov eax, dword [rbp - 0x64]
mov dword [rbp - 0x68], eax
mov eax, dword [rbp - 0x80]
lea rcx, [rbp - 0x48]
mov dword [rcx - 4], eax
lea r11, [0x1401560f4]
mov eax, dword [rbp - 0x70]
lea rdx, [rbp + 0x38]
mov r8d, 4
mov word [rcx], r8w
mov dword [rcx - 8], eax
lea rax, [0x140171800]
movss xmm0, dword [0x140196f6c]
movss xmm1, dword [0x140176f1c]
comiss xmm1, xmm0
cmova rax, r11
mov qword [rcx + 0x30], rax
mov word [rcx + 0x20], 0x1010
mov dword [rcx + 0x18], 0xfffffffe
mov eax, dword [rbp - 0x7c]
mov dword [rcx + 0x3c], eax
mov eax, dword [rbp - 0x6c]
mov word [rcx + 0x40], r8w
mov dword [rcx + 0x38], eax
lea rax, [0x140171800]
cmova rax, r11
sub r10, r8
mov qword [rcx + 0x70], rax
mov word [rcx + 0x60], 0x1010
mov dword [rcx + 0x58], 0xfffffffe
test r8b, 1
jne 0x140066290
mov eax, r8d
test r8d, r8d
jns 0x140066279
lea eax, [r8 + 1]
sar eax, 1
movsxd rcx, eax
xor r9b, r9b
mov eax, dword [rbp + rcx*4 - 0x80]
mov dword [rdx - 4], eax
mov eax, dword [rbp + rcx*4 - 0x70]
mov cl, 4
jmp 0x1400662ad
comiss xmm1, xmm0
lea rax, [0x140171800]
mov cl, 0x10
movzx r9d, cl
cmova rax, r11
mov qword [rdx + 0x10], rax
mov eax, 0xfffffffe
mov byte [rdx + 1], r9b
inc r8d
mov byte [rdx], cl
mov dword [rdx - 8], eax
add rdx, 0x20
sub r10, 1
jne 0x140066267
mov rcx, qword [0x1401e8218]
lea r9, [rbp - 0x50]
movsxd r8, r8d
mov edx, 0x444
call qword [sym.imp.USER32.dll_SendMessageW]
movzx r9d, word [0x1401a0408]
xor r8d, r8d
movzx eax, word [rsp + 0x70]
mov edx, 0x41f
mov rcx, qword [0x1401e8218]
shl r9, 0x10
or r9, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, 0xcf3
call fcn.1400207e0
mov rcx, qword [0x1401e8218]
mov rdx, rax
call fcn.140060b80
mov rcx, qword [0x14019f550]
lea r8, [0x140065040]
mov edx, 0xfffffffc
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
mov qword [0x1401e55c0], rax
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.1400b1f80
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret