Function at 0x4912d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4da6fd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc8
push ebx
mov ebx, ecx
mov dword [ebp - 0x1c], 0
push esi
push edi
mov dword [ebp - 0x14], ebx
cmp dword [ebx + 0xe0], 0
je 0x4913a2
mov edx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x24], 7
mov dword [ebp - 0x28], 0
mov word [ebp - 0x38], ax
mov edx, dword [edx + 8]
cmp word [edx], ax
jne 0x49132d
xor ecx, ecx
jmp 0x491341
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x491332
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x38]
call fcn.0049f240
mov dword [ebp - 0x1c], 1
lea ecx, [ebp - 0x38]
mov eax, dword [ebx + 0xe0]
push ecx
mov ecx, eax
mov dword [ebp - 0x48], eax
mov edi, dword [eax]
call fcn.00486690
mov esi, eax
mov eax, dword [ebp - 0x48]
cmp esi, dword [eax]
je 0x491398
cmp dword [esi + 0x24], 8
lea ecx, [esi + 0x10]
jb 0x49137c
mov ecx, dword [ecx]
cmp dword [ebp - 0x24], 8
lea eax, [ebp - 0x38]
push ecx
cmovae eax, dword [ebp - 0x38]
push eax
call fcn.004ab182
add esp, 8
test eax, eax
jns 0x49139a
mov eax, dword [ebp - 0x48]
mov esi, dword [eax]
mov byte [ebp - 0xd], 1
cmp esi, edi
jne 0x4913a6
mov byte [ebp - 0xd], 0
test byte [ebp - 0x1c], 1
je 0x4913c1
mov eax, dword [ebp - 0x24]
cmp eax, 8
jb 0x4913c1
inc eax
lea ecx, [ebp - 0x38]
push eax
push dword [ebp - 0x38]
call fcn.0049f0e0
cmp byte [ebp - 0xd], 0
je 0x49190d
add ebx, 8
push 1
mov ecx, ebx
call fcn.00492ee0
mov eax, 0xf9
mov ecx, ebx
mov word [ebp - 0x1c], ax
push dword [ebp - 0x1c]
call fcn.00492e30
push str.Secure.Net.Host.Runtime.HostAssemblyStore__HostAssemblyProviderResource:_Requested_Assembly_found_in_dictionary._Trying_to_decrypt_from_Resource_Library...
mov ecx, ebx
call fcn.00492d70
mov ecx, eax
call fcn.00492f90
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], 7
mov dword [ebp - 0x28], 0
mov edx, dword [eax + 8]
xor eax, eax
mov word [ebp - 0x38], ax
cmp word [edx], ax
jne 0x491420
xor ecx, ecx
jmp 0x491434
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x491425
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x38]
call fcn.0049f240
mov dword [ebp - 4], 0
lea eax, [ebp - 0x38]
mov edi, dword [ebp - 0x14]
push eax
mov edi, dword [edi + 0xe0]
mov ecx, edi
call fcn.00486690
mov esi, eax
cmp esi, dword [edi]
je 0x491903
cmp dword [esi + 0x24], 8
lea ecx, [esi + 0x10]
jb 0x49146e
mov ecx, dword [ecx]
cmp dword [ebp - 0x24], 8
lea eax, [ebp - 0x38]
push ecx
cmovae eax, dword [ebp - 0x38]
push eax
call fcn.004ab182
add esp, 8
test eax, eax
js 0x491903
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x24]
cmp eax, 8
jb 0x4914a7
inc eax
lea ecx, [ebp - 0x38]
push eax
push dword [ebp - 0x38]
call fcn.0049f0e0
xor eax, eax
mov dword [ebp - 0x24], 7
lea edi, [esi + 0x30]
mov dword [ebp - 0x28], 0
mov word [ebp - 0x38], ax
mov byte [ebp - 0x14], al
cmp dword [edi + 0x10], eax
jbe 0x4914ea
cmp dword [edi + 0x14], 8
jb 0x4914db
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov byte [ebp - 0x14], 1
jmp 0x4914f2
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov byte [ebp - 0x14], 1
jmp 0x4914f2
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 1
test ecx, ecx
jne 0x491557
cmp dword [edi + 0x14], 8
jb 0x49150a
mov edi, dword [edi]
push 3
mov ecx, ebx
call fcn.00492ee0
mov eax, 0xf8
mov ecx, ebx
mov word [ebp + 8], ax
push dword [ebp + 8]
call fcn.00492e30
push str._not_found...
push edi
push str.Secure.Net.Host.Runtime.HostAssemblyStore__HostAssemblyProviderResource:_Resource_Library
mov ecx, ebx
call fcn.00492d70
mov ecx, eax
call fcn.00492d70
mov ecx, eax
call fcn.00492d70
mov ecx, eax
call fcn.00492f90
mov esi, 0x80070002
jmp 0x49184c
mov eax, dword [esi + 0x28]
push 0xa
movzx eax, ax
push eax
push ecx
mov dword [ebp - 0x44], 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
je 0x4915a1
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x40], eax
test eax, eax
je 0x4915a1
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push dword [ebp + 8]
mov dword [ebp - 0x44], eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x3c], eax
jmp 0x4915a4
mov eax, dword [ebp - 0x3c]
mov byte [ebp - 4], 3
cmp dword [ebp - 0x44], 0
jne 0x491642
mov edx, dword [esi + 0x28]
lea ecx, [ebp - 0x5c]
call fcn.004919d0
mov esi, eax
mov byte [ebp - 4], 4
cmp dword [edi + 0x14], 8
jb 0x4915cb
mov edi, dword [edi]
cmp dword [esi + 0x14], 8
jb 0x4915d3
mov esi, dword [esi]
push 3
mov ecx, ebx
call fcn.00492ee0
mov eax, 0xf8
mov ecx, ebx
mov word [ebp + 8], ax
push dword [ebp + 8]
call fcn.00492e30
push 0x55b3b8
push edi
push str._not_found_in_Resource_Library
push esi
push str.Secure.Net.Host.Runtime.HostAssemblyStore__HostAssemblyProviderResource:_Resource_Id
mov ecx, ebx
call fcn.00492d70
mov ecx, eax
call fcn.00492d70
mov ecx, eax
call fcn.00492d70
mov ecx, eax
call fcn.00492d70
mov ecx, eax
call fcn.00492d70
mov ecx, eax
call fcn.00492f90
lea ecx, [ebp - 0x5c]
call fcn.0049e810
mov edi, dword [sym.imp.KERNEL32.dll_FreeResource]
mov esi, 0x80070002
jmp 0x491847
push eax
call fcn.0049fb92
add esp, 4
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x1c], 0
push eax
call fcn.0048dd30
mov byte [ebp - 4], 6
mov edi, dword [ebp - 0x3c]
push edi
push dword [ebp - 0x44]
push dword [ebp - 0x20]
call fcn.004a45a0
add esp, 0xc
lea eax, [ebp - 0x20]
push edi
sub esp, 8
mov ecx, esp
push eax
call fcn.00490b50
lea ecx, [ebp - 0xd4]
call fcn.00490a20
mov byte [ebp - 4], 7
cmp byte [ebp - 0x5f], 0
jne 0x49187c
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0xd4]
call fcn.00490e40
mov eax, dword [esi + 0x60]
mov edi, 0xce
sub eax, 1
je 0x49171d
sub eax, 1
je 0x49170c
push 3
mov ecx, ebx
call fcn.00492ee0
mov word [ebp + 8], di
mov ecx, ebx
push dword [ebp + 8]
call fcn.00492e30
push str.Secure.Net.Host.Runtime.HostAssemblyStore__HostAssemblyProviderResource:_Unknown_Encryption_Algorithm_for_Requested_Assembly.
mov ecx, ebx
call fcn.00492d70
mov ecx, eax
call fcn.00492f90
push 3
mov ecx, ebx
call fcn.00492ee0
mov word [ebp + 8], di
mov ecx, ebx
push dword [ebp + 8]
call fcn.00492e30
push str.Secure.Net.Host.Runtime.HostAssemblyStore__HostAssemblyProviderResource:_Failed_to_decrypt_Assembly_
jmp 0x49189d
mov edx, dword [ebp - 0x48]
lea eax, [esi + 0x48]
mov ecx, dword [ebp - 0x4c]
push eax
call fcn.00491150
jmp 0x49172c
mov edx, dword [ebp - 0x48]
lea eax, [esi + 0x48]
mov ecx, dword [ebp - 0x4c]
push eax
call fcn.00490f70
add esp, 4
test al, al
je 0x4916eb
push 1
mov ecx, ebx
call fcn.00492ee0
mov eax, 0xf2
mov ecx, ebx
mov word [ebp + 8], ax
push dword [ebp + 8]
call fcn.00492e30
push str.Secure.Net.Host.Runtime.HostAssemblyStore__HostAssemblyProviderResource:_Assembly_successfully_decrypted.
mov ecx, ebx
call fcn.00492d70
mov ecx, eax
call fcn.00492f90
mov ecx, dword [ebp + 0xc]
mov eax, dword [esi + 0x64]
mov dword [ecx], eax
mov eax, dword [ebp + 0x10]
mov dword [ecx + 4], 0
mov dword [eax], 0x4d414e4e
mov dword [eax + 4], 0x53454c4c
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x49180d
push eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x50]
call fcn.00491240
mov byte [ebp - 4], 8
mov ecx, ebx
mov esi, dword [ebp - 0x50]
push 1
call fcn.00492ee0
mov eax, 0xf8
mov ecx, ebx
mov word [ebp + 8], ax
push dword [ebp + 8]
call fcn.00492e30
mov ecx, ebx
test esi, esi
jne 0x4917e0
push str.Secure.Net.Host.Runtime.HostAssemblyStore__HostAssemblyProviderResource:_Assembly_PDB_File_not_loaded.
call fcn.00492d70
mov ecx, eax
call fcn.00492f90
push dword [ebp - 0x4c]
mov edi, dword [sym.imp.KERNEL32.dll_FreeResource]
call edi
jmp 0x491813
push str.Secure.Net.Host.Runtime.HostAssemblyStore__HostAssemblyProviderResource:_Assembly_PDB_resolved.
call fcn.00492d70
mov ecx, eax
call fcn.00492f90
push dword [ebp - 0x48]
push esi
call dword [sym.imp.SHLWAPI.dll_SHCreateMemStream]
mov ecx, dword [ebp + 0x18]
push dword [ebp - 0x4c]
mov edi, dword [sym.imp.KERNEL32.dll_FreeResource]
mov dword [ecx], eax
call edi
jmp 0x491813
mov edi, dword [sym.imp.KERNEL32.dll_FreeResource]
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0xd4]
call fcn.004912b0
push dword [eax + 4]
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_SHCreateMemStream]
mov ecx, dword [ebp + 0x14]
xor esi, esi
mov dword [ecx], eax
lea ecx, [ebp - 0xd4]
call fcn.00490d30
lea ecx, [ebp - 0x20]
call fcn.00490c10
push dword [ebp - 0x40]
call edi
mov dword [ebp - 4], 9
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x491867
cmp byte [ebp - 0x14], 0
je 0x491867
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
push 2
mov ecx, ebx
call fcn.00492ee0
mov eax, 0xf8
mov ecx, ebx
mov word [ebp + 8], ax
push dword [ebp + 8]
call fcn.00492e30
push str.Secure.Net.Host.Runtime.HostAssemblyStore__HostAssemblyProviderResource:_Requested_Assembly_is_not_encrypted._Skipping_Decryption.
mov ecx, ebx
call fcn.00492d70
mov ecx, eax
call fcn.00492f90
lea ecx, [ebp - 0xd4]
call fcn.00490d30
mov byte [ebp - 4], 0xa
mov esi, dword [ebp - 0x1c]
test esi, esi
je 0x4918e2
or edi, 0xffffffff
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x4918e2
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x4918e2
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov dword [ebp - 4], 0xb
cmp byte [ebp - 0x14], 0
je 0x49193f
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x49193f
push str.invalid_map_K__T__key
call fcn.004a06fd
push 2
lea ecx, [ebx + 8]
call fcn.00492ee0
mov eax, 0xf8
lea ecx, [ebx + 8]
mov word [ebp + 8], ax
push dword [ebp + 8]
call fcn.00492e30
push str.Secure.Net.Host.Runtime.HostAssemblyStore__HostAssemblyProviderResource:_Requested_Assembly_not_found_in_dictionary.
lea ecx, [ebx + 8]
call fcn.00492d70
mov ecx, eax
call fcn.00492f90
mov ecx, dword [ebp - 0xc]
mov eax, 0x80070002
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x14