Function at 0x1400378d8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x78
xor r14d, r14d
movsxd r13, r8d
mov rdi, rcx
mov rsi, rdx
mov ebx, r14d
mov al, r14b
mov r15b, r14b
lea ecx, [r14 + 1]
test rdi, rdi
je 0x14003791d
cmp qword [rdi + 8], r14
movzx eax, al
cmove eax, ecx
test rdx, rdx
je 0x14003792e
cmp qword [rdx + 8], r14
movzx r15d, r15b
cmove r15d, ecx
lea rcx, [0x14010d200]
mov r12d, 0x8007000e
test al, al
je 0x140037c22
imul r12, r13, 0x70
lea r8, [0x1400f17d0]
movzx edx, word [r12 + rcx + 4]
mov rcx, qword [0x140111af0]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
jne 0x140037973
mov eax, 0x80004005
jmp 0x140037c9e
mov rcx, qword [0x140111af0]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, qword [0x140111af0]
mov rdx, rsi
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rbp - 0x48], rax
mov esi, 0x80004005
test rax, rax
je 0x140037b13
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov edx, r14d
mov ecx, 2
mov qword [rbp + 0x60], rax
mov r13d, r14d
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov r14, rax
test rax, rax
jne 0x1400379d8
mov ebx, 0x8007000e
jmp 0x140037af8
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GlobalLock]
xor ecx, ecx
mov edx, 0x8007000e
test rax, rax
mov qword [rbp + 0x48], rcx
cmove ebx, edx
test ebx, ebx
js 0x140037ae6
mov rdx, qword [rbp + 0x60]
mov r8, r13
mov rcx, rax
call sub.msvcrt.dll_memcpy
lea r8, [rbp + 0x48]
xor edx, edx
mov rcx, r14
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov ebx, eax
test eax, eax
js 0x140037ad0
mov r13, qword [rbp + 0x48]
lea rcx, [0x140111ab0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor eax, eax
mov bl, 1
cmp qword [0x140111aa8], rax
jne 0x140037a6e
lea r8, [rbp - 0x38]
mov dword [rbp - 0x28], 1
lea rdx, [rbp - 0x28]
mov qword [rbp - 0x20], rax
lea rcx, [0x140111aa8]
mov qword [rbp - 0x18], rax
call qword [sym.imp.gdiplus.dll_GdiplusStartup]
xor ecx, ecx
movzx ebx, bl
test eax, eax
cmovne ebx, ecx
lea rcx, [0x140111ab0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test bl, bl
jne 0x140037a83
mov ebx, esi
jmp 0x140037ad0
lea rax, [0x1400e8310]
xor ebx, ebx
lea rdx, [rbp + 0x60]
mov qword [rbp - 0x28], rax
mov rcx, r13
mov qword [rbp + 0x60], rbx
call qword [sym.imp.gdiplus.dll_GdipCreateBitmapFromStream]
mov rcx, qword [rbp + 0x60]
mov qword [rbp - 0x20], rcx
mov dword [rbp - 0x18], ebx
test eax, eax
je 0x140037ab8
call qword [sym.imp.gdiplus.dll_GdipDisposeImage]
jmp 0x140037a7f
lea rdx, [rbp - 0x28]
mov rcx, rdi
call fcn.14003a120
mov rcx, qword [rbp - 0x20]
mov ebx, eax
call qword [sym.imp.gdiplus.dll_GdipDisposeImage]
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x140037ae6
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x1400739fa.0]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_FreeResource]
xor r14d, r14d
test ebx, ebx
js 0x140037c9c
mov r13d, dword [rbp + 0x58]
jmp 0x140037b16
xor r14d, r14d
cmp dword [rdi + 0x24], 0x20
jne 0x140037ba4
mov eax, dword [rdi + 0x20]
mov r8d, dword [rdi + 0x1c]
mov r9, qword [rdi + 0x10]
test eax, eax
jns 0x140037b3c
lea ecx, [r8 - 1]
imul ecx, eax
movsxd rcx, ecx
add r9, rcx
cdq
xor eax, edx
sub eax, edx
imul eax, r8d
movsxd r10, eax
add r10, r9
cmp r9, r10
jae 0x140037ba1
mov r11d, 0x80808081
movzx r8d, byte [r9 + 3]
mov eax, r11d
movzx ecx, byte [r9]
imul ecx, r8d
mul ecx
mov eax, r11d
shr edx, 7
mov byte [r9], dl
movzx ecx, byte [r9 + 1]
imul ecx, r8d
mul ecx
mov eax, r11d
shr edx, 7
mov byte [r9 + 1], dl
movzx ecx, byte [r9 + 2]
imul ecx, r8d
mul ecx
shr edx, 7
mov byte [r9 + 2], dl
add r9, 4
cmp r9, r10
jb 0x140037b56
mov ebx, r14d
test ebx, ebx
js 0x140037c9c
lea r10, [0x14010d200]
mov r8d, r14d
mov r9, qword [r12 + r10 + 0x18]
mov edx, r14d
mov eax, dword [r9 + 0x18]
mov dword [r12 + r10 + 0x3c], eax
mov eax, dword [r12 + r10 + 0xc]
bt eax, edx
lea ecx, [r8 + 1]
cmovae ecx, r8d
inc edx
mov r8d, ecx
cmp edx, 0x20
jl 0x140037bcc
test ecx, ecx
je 0x140037bf5
mov eax, dword [r9 + 0x1c]
xor edx, edx
div r8d
mov dword [r12 + r10 + 0x40], eax
jmp 0x140037bf7
mov ebx, esi
test ebx, ebx
js 0x140037c9c
lea rcx, [r10 + 0x50]
mov qword [r12 + r10 + 0x48], r14
add rcx, r12
call qword [sym.imp.USER32.dll_SetRectEmpty]
mov rsi, qword [rbp + 0x50]
lea rcx, [0x14010d200]
mov r12d, 0x8007000e
movsxd rax, r13d
imul rdi, rax, 0x70
cmp dword [rdi + rcx + 8], r14d
je 0x140037c9c
test r15b, r15b
je 0x140037c9c
mov ecx, 8
mov dword [rbp - 0x48], r14d
call qword [sym.imp.USER32.dll_GetSysColor]
mov ecx, 0x11
mov dword [rbp - 0x40], 0xffff
mov dword [rbp - 0x44], eax
call qword [sym.imp.USER32.dll_GetSysColor]
mov rcx, qword [0x140111af0]
lea r9, [rbp - 0x48]
mov dword [rbp - 0x3c], eax
xor r8d, r8d
lea rax, [0x14010d200]
mov dword [rsp + 0x20], 2
mov edx, dword [rdi + rax + 8]
call qword [sym.imp.COMCTL32.dll_CreateMappedBitmap]
test rax, rax
cmove ebx, r12d
test ebx, ebx
js 0x140037c9c
xor r8d, r8d
mov rdx, rax
mov rcx, rsi
call fcn.140039f78
mov eax, ebx
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret