Function at 0x41e5d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x4702a3
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x487550]
xor eax, esp
mov dword [esp + 0x88], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x487550]
xor eax, esp
push eax
lea eax, [esp + 0xa0]
mov dword fs:[0], eax
mov eax, dword [esp + 0xb0]
xor ecx, ecx
xor ebx, ebx
push 0xffffffffffffffff
mov dword [esp + 0x54], eax
mov word [esp + 0x88], cx
mov esi, 7
push ebx
mov eax, 0x48a8c0
lea ecx, [esp + 0x88]
mov byte [esp + 0x1f], bl
mov dword [esp + 0xa0], esi
mov dword [esp + 0x9c], ebx
call fcn.004042a0
mov dword [esp + 0xa8], ebx
cmp dword [esp + 0x94], ebx
jne 0x41e764
call fcn.0041fe10
mov edx, dword [eax]
push eax
mov eax, dword [edx + 0xc]
call eax
mov dword [esp + 0x30], esi
xor ecx, ecx
push 8
mov eax, 0x479674
lea esi, [esp + 0x1c]
mov dword [esp + 0x30], ebx
mov word [esp + 0x20], cx
call fcn.00403ee0
mov byte [esp + 0xa8], 1
call fcn.0041fe10
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x38]
mov esi, eax
call fcn.0042c040
add esp, 4
mov edi, 0x10
mov byte [esp + 0xa8], 2
cmp dword [eax + 0x18], edi
jb 0x41e6c4
mov eax, dword [eax + 4]
jmp 0x41e6c7
add eax, 4
mov ecx, dword [esi]
mov edx, dword [ecx + 0x18]
push eax
push str.error_status
push esi
call edx
cmp dword [esp + 0x4c], edi
jb 0x41e6e8
mov eax, dword [esp + 0x38]
push eax
call fcn.0044caf8
add esp, 4
mov esi, 0xf
mov byte [esp + 0xa8], bl
cmp dword [esp + 0x30], 8
mov dword [esp + 0x4c], esi
mov dword [esp + 0x48], ebx
mov byte [esp + 0x38], bl
jb 0x41e714
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.0044caf8
add esp, 4
push 0xe
push str.vResourceError
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], esi
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
call fcn.00403b10
mov byte [esp + 0xa8], 3
call fcn.0041fe10
mov edx, dword [eax]
mov edx, dword [edx + 8]
lea ecx, [esp + 0x18]
push ecx
push eax
call edx
mov byte [esp + 0xa8], bl
cmp dword [esp + 0x30], edi
jb 0x41e764
mov eax, dword [esp + 0x1c]
push eax
call fcn.0044caf8
add esp, 4
lea ecx, [esp + 0x80]
push ecx
mov ebx, 0x479648
lea esi, [esp + 0x68]
call fcn.004059c0
add esp, 4
push str.BinarySystem
push 0x67
mov byte [esp + 0xb0], 4
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor ebx, ebx
push ebx
call edi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, ebx
jne 0x41e8f5
call fcn.0041fe10
mov edx, dword [eax]
push eax
mov eax, dword [edx + 0xc]
call eax
xor ecx, ecx
push 6
mov eax, 0x479664
lea esi, [esp + 0x1c]
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], ebx
mov word [esp + 0x20], cx
call fcn.00403ee0
mov byte [esp + 0xa8], 5
call fcn.0041fe10
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x38]
mov esi, eax
call fcn.0042c040
add esp, 4
mov edi, 0x10
mov byte [esp + 0xa8], 6
cmp dword [eax + 0x18], edi
jb 0x41e80f
mov eax, dword [eax + 4]
jmp 0x41e812
add eax, 4
mov ecx, dword [esi]
mov edx, dword [ecx + 0x18]
push eax
push str.error_status
push esi
call edx
cmp dword [esp + 0x4c], edi
jb 0x41e833
mov eax, dword [esp + 0x38]
push eax
call fcn.0044caf8
add esp, 4
mov ebp, 8
mov esi, 0xf
mov byte [esp + 0xa8], 4
mov dword [esp + 0x4c], esi
mov dword [esp + 0x48], ebx
mov byte [esp + 0x38], 0
cmp dword [esp + 0x30], ebp
jb 0x41e865
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.0044caf8
add esp, 4
push 0xe
push str.vResourceError
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], esi
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], 0
call fcn.00403b10
mov byte [esp + 0xa8], 7
call fcn.0041fe10
mov edx, dword [eax]
mov edx, dword [edx + 8]
lea ecx, [esp + 0x18]
push ecx
push eax
call edx
cmp dword [esp + 0x30], edi
jb 0x41e8af
mov eax, dword [esp + 0x1c]
push eax
call fcn.0044caf8
add esp, 4
cmp dword [esp + 0x7c], ebp
jb 0x41e8c2
mov ecx, dword [esp + 0x68]
push ecx
call fcn.0044caf8
add esp, 4
xor edx, edx
mov dword [esp + 0x7c], 7
mov dword [esp + 0x78], ebx
mov word [esp + 0x68], dx
cmp dword [esp + 0x98], ebp
jb 0x41e8ee
mov eax, dword [esp + 0x84]
push eax
call fcn.0044caf8
add esp, 4
xor al, al
jmp 0x41eda3
push esi
push ebx
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, eax
cmp ebp, ebx
ja 0x41ea5b
call fcn.0041fe10
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
push eax
call edx
xor eax, eax
mov word [esp + 0x1c], ax
push 6
mov eax, 0x479664
lea esi, [esp + 0x1c]
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], ebx
call fcn.00403ee0
mov byte [esp + 0xa8], 8
call fcn.0041fe10
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x38]
mov esi, eax
call fcn.0042c040
add esp, 4
mov edi, 0x10
mov byte [esp + 0xa8], 9
cmp dword [eax + 0x18], edi
jb 0x41e971
mov eax, dword [eax + 4]
jmp 0x41e974
add eax, 4
mov edx, dword [esi]
push eax
mov eax, dword [edx + 0x18]
push str.error_status
push esi
call eax
cmp dword [esp + 0x4c], edi
jb 0x41e995
mov ecx, dword [esp + 0x38]
push ecx
call fcn.0044caf8
add esp, 4
mov ebp, 8
mov esi, 0xf
mov byte [esp + 0xa8], 4
mov dword [esp + 0x4c], esi
mov dword [esp + 0x48], ebx
mov byte [esp + 0x38], 0
cmp dword [esp + 0x30], ebp
jb 0x41e9c7
mov edx, dword [esp + 0x1c]
push edx
call fcn.0044caf8
add esp, 4
push 0xe
push str.vResourceError
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], esi
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], 0
call fcn.00403b10
mov byte [esp + 0xa8], 0xa
call fcn.0041fe10
mov ecx, dword [eax]
lea edx, [esp + 0x18]
push edx
push eax
mov eax, dword [ecx + 8]
call eax
cmp dword [esp + 0x30], edi
jb 0x41ea11
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.0044caf8
add esp, 4
cmp dword [esp + 0x7c], ebp
jb 0x41ea24
mov edx, dword [esp + 0x68]
push edx
call fcn.0044caf8
add esp, 4
xor eax, eax
cmp dword [esp + 0x98], ebp
mov word [esp + 0x68], ax
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], 7
jb 0x41e8ee
mov ecx, dword [esp + 0x84]
push ecx
call fcn.0044caf8
add esp, 4
xor al, al
jmp 0x41eda3
push esi
push ebx
call edi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [esp + 0x54], eax
cmp eax, ebx
jne 0x41eb75
call fcn.0041fe10
mov edx, dword [eax]
push eax
mov eax, dword [edx + 0xc]
call eax
mov eax, 0x479664
lea ecx, [esp + 0x18]
call fcn.004037f0
mov byte [esp + 0xa8], 0xb
call fcn.0041fe10
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x38]
mov esi, eax
call fcn.0042c040
add esp, 4
mov edi, 0x10
mov byte [esp + 0xa8], 0xc
cmp dword [eax + 0x18], edi
jb 0x41eac4
mov eax, dword [eax + 4]
jmp 0x41eac7
add eax, 4
mov edx, dword [esi]
push eax
mov eax, dword [edx + 0x18]
push str.error_status
push esi
call eax
cmp dword [esp + 0x4c], edi
jb 0x41eae8
mov ecx, dword [esp + 0x38]
push ecx
call fcn.0044caf8
add esp, 4
mov esi, 8
mov byte [esp + 0xa8], 4
mov dword [esp + 0x4c], 0xf
mov dword [esp + 0x48], ebx
mov byte [esp + 0x38], 0
cmp dword [esp + 0x30], esi
jb 0x41eb19
mov edx, dword [esp + 0x1c]
push edx
call fcn.0044caf8
add esp, 4
push str.vResourceError
lea ecx, [esp + 0x38]
call fcn.00403740
mov byte [esp + 0xa8], 0xd
call fcn.0041fe10
mov ecx, dword [eax]
lea edx, [esp + 0x34]
push edx
push eax
mov eax, dword [ecx + 8]
call eax
cmp dword [esp + 0x4c], edi
jb 0x41eb54
mov ecx, dword [esp + 0x38]
push ecx
call fcn.0044caf8
add esp, 4
cmp dword [esp + 0x7c], esi
jb 0x41eb67
mov edx, dword [esp + 0x68]
push edx
call fcn.0044caf8
add esp, 4
xor eax, eax
cmp dword [esp + 0x98], esi
jmp 0x41ea2d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
cmp edi, ebx
jne 0x41ec44
call fcn.0041fe10
mov edx, dword [eax]
push eax
mov eax, dword [edx + 0xc]
call eax
mov eax, 0x479664
lea ecx, [esp + 0x34]
call fcn.004037f0
mov byte [esp + 0xa8], 0xe
call fcn.0041fe10
lea ecx, [esp + 0x34]
push ecx
lea ecx, [esp + 0x1c]
mov esi, eax
call fcn.0042c040
add esp, 4
mov ebx, 0x10
mov byte [esp + 0xa8], 0xf
cmp dword [eax + 0x18], ebx
jb 0x41ebd8
mov eax, dword [eax + 4]
jmp 0x41ebdb
add eax, 4
mov edx, dword [esi]
push eax
mov eax, dword [edx + 0x18]
push str.error_status
push esi
call eax
lea ecx, [esp + 0x18]
call fcn.004037b0
lea esi, [esp + 0x34]
mov byte [esp + 0xa8], 4
call fcn.00418c90
push str.vResourceError
lea ecx, [esp + 0x38]
call fcn.00403740
mov byte [esp + 0xa8], bl
call fcn.0041fe10
mov ecx, dword [eax]
lea edx, [esp + 0x34]
push edx
push eax
mov eax, dword [ecx + 8]
call eax
lea ecx, [esp + 0x34]
mov byte [esp + 0xa8], 4
call fcn.004037b0
mov bl, byte [esp + 0x17]
jmp 0x41ed3b
mov ecx, 0xffff
lea esi, [esp + 0x64]
mov dword [esp + 0x58], vtable.CFileStream.0
mov byte [esp + 0x60], bl
call fcn.0042f4f0
mov dword [esp + 0x5c], eax
push ebp
push edi
lea ecx, [esp + 0x60]
mov bl, 0x11
push ecx
mov byte [esp + 0xb4], bl
call fcn.0042f2e0
test eax, eax
jg 0x41ed28
call fcn.0041fe10
mov edx, dword [eax]
push eax
mov eax, dword [edx + 0xc]
call eax
mov eax, 0x479664
lea ecx, [esp + 0x34]
call fcn.004037f0
mov byte [esp + 0xa8], 0x12
call fcn.0041fe10
lea ecx, [esp + 0x34]
push ecx
lea ecx, [esp + 0x1c]
mov esi, eax
call fcn.0042c040
add esp, 4
mov byte [esp + 0xa8], 0x13
cmp dword [eax + 0x18], 0x10
jb 0x41eccd
mov eax, dword [eax + 4]
jmp 0x41ecd0
add eax, 4
mov edx, dword [esi]
push eax
mov eax, dword [edx + 0x18]
push str.error_status
push esi
call eax
lea ecx, [esp + 0x18]
call fcn.004037b0
lea esi, [esp + 0x34]
mov byte [esp + 0xa8], bl
call fcn.00418c90
push str.vResourceError
lea ecx, [esp + 0x38]
call fcn.00403740
mov byte [esp + 0xa8], 0x14
call fcn.0041fe10
mov ecx, dword [eax]
lea edx, [esp + 0x34]
push edx
push eax
mov eax, dword [ecx + 8]
call eax
lea ecx, [esp + 0x34]
call fcn.004037b0
lea ecx, [esp + 0x58]
mov byte [esp + 0xa8], 4
call fcn.0042f130
mov bl, 1
mov ecx, dword [esp + 0x54]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
test bl, bl
je 0x41ed59
mov ecx, dword [esp + 0x50]
call fcn.0041e360
mov byte [esp + 0x17], al
mov bl, al
mov esi, 8
cmp dword [esp + 0x7c], esi
jb 0x41ed71
mov edx, dword [esp + 0x68]
push edx
call fcn.0044caf8
add esp, 4
xor eax, eax
mov dword [esp + 0x7c], 7
mov dword [esp + 0x78], 0
mov word [esp + 0x68], ax
cmp dword [esp + 0x98], esi
jb 0x41eda1
mov ecx, dword [esp + 0x84]
push ecx
call fcn.0044caf8
add esp, 4
mov al, bl
mov ecx, dword [esp + 0xa0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x88]
xor ecx, esp
call fcn.0044c790
add esp, 0x98
ret 4