Function at 0x401000
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x43c
push 0xa
push 0xd2e2e2e
push 0x79726576
push 0x6f636572
push 0x20656c67
push 0x6e6f6420
push 0x676e6974
push 0x72617453
push esp
call fcn.00401836
add esp, 0x20
push 0
push 1
push 0x400000
call fcn.0040897c
lea eax, [ebp - 0x43c]
push eax
push 0
call fcn.00403bba
cmp dword [ebp - 0x43c], 0
jne 0x401097
push 0xa0d31
push 0x2320726f
push 0x72726520
push 0x2c646e75
push 0x6f662074
push 0x6f6e2065
push 0x6c676e6f
push 0x4429524f
push 0x52524528
push esp
call fcn.00401836
add esp, 0x24
jmp 0x401810
push dword [ebp - 0x43c]
push 0x40
call dword [sym.imp.kernel32.dll_GlobalAlloc]
mov dword [ebp - 0x438], eax
mov dword [ebp - 0x434], eax
lea eax, [ebp - 0x43c]
push eax
push dword [ebp - 0x438]
call fcn.00403bba
push 0x6f7270
push 0x5f554345
mov dword [ebp - 0x18], esp
cmp dword [ebp - 0x43c], 0
ja 0x401114
push 0xa0d32
push 0x2320726f
push 0x72726520
push 0x2c646e75
push 0x6f662074
push 0x6f6e2065
push 0x6c676e6f
push 0x4429524f
push 0x52524528
push esp
call fcn.00401836
add esp, 0x24
jmp 0x401810
mov eax, dword [ebp - 0x434]
lea eax, [eax + 0x50]
push esp
push eax
call dword [sym.imp.kernel32.dll_lstrcmpA]
cmp eax, 0
je 0x40113a
add dword [ebp - 0x434], 0x5c
sub dword [ebp - 0x43c], 0x5c
jmp 0x4010d0
push 0xa
push 0xd2e2e2e
push 0x646e756f
push 0x6620656c
push 0x676e6f44
push esp
call fcn.00401836
add esp, 0x14
push dword [ebp - 0x434]
call fcn.00403c6e
cmp eax, 0
je 0x40119c
push 0
push 0xa0d656c
push 0x676e6f64
push 0x206e6570
push 0x6f20746f
push 0x6e206e61
push 0x4329524f
push 0x52524528
push esp
call fcn.00401836
add esp, 0x20
jmp 0x401810
push 0x5c
push esp
push dword [ebp - 0x434]
call fcn.00404e9e
add esp, 4
cmp eax, 0
je 0x4011e5
push 0
push 0xa0d3123
push 0x20726f72
push 0x7265206e
push 0x6f697463
push 0x65746f72
push 0x5029524f
push 0x52524528
push esp
call fcn.00401836
add esp, 0x20
jmp 0x401810
push 0
push 0x38373635
push 0x34333231
push 0xa1
push 8
lea edx, [esp + 8]
push edx
push dword [ebp - 0x434]
call fcn.0040518e
add esp, 0xc
cmp eax, 0
je 0x401243
push 0
push 0xa0d3223
push 0x20726f72
push 0x7265206e
push 0x6f697463
push 0x65746f72
push 0x5029524f
push 0x52524528
push esp
call fcn.00401836
add esp, 0x20
jmp 0x401810
push 0
push 0x33313030
mov dword [ebp - 0x14], esp
push 2
lea edx, [ebp - 0x430]
push edx
push 0x20
lea edx, [ebp - 0x31c]
push edx
push 2
lea edx, [esp + 0x10]
push edx
push dword [ebp - 0x14]
push dword [ebp - 0x434]
call fcn.00405cbe
add esp, 4
cmp eax, 0
je 0x4012af
push 0
push 0xa0d3323
push 0x20726f72
push 0x7265206e
push 0x6f697463
push 0x65746f72
push 0x5029524f
push 0x52524528
push esp
call fcn.00401836
add esp, 0x20
jmp 0x40180d
push 0xa
push 0x3e8
push 0x400000
call dword [sym.imp.kernel32.dll_FindResourceA]
test eax, eax
jne 0x4012f6
push 0xa0d
push 0x31232072
push 0x6f727265
push 0x206c616e
push 0x7265746e
push 0x4929524f
push 0x52524528
push esp
call fcn.00401836
add esp, 0x1c
jmp 0x40180d
mov dword [ebp - 0x42c], eax
push dword [ebp - 0x42c]
push 0x400000
call dword [sym.imp.kernel32.dll_LoadResource]
test eax, eax
jne 0x401342
push 0xa0d
push 0x32232072
push 0x6f727265
push 0x206c616e
push 0x7265746e
push 0x4929524f
push 0x52524528
push esp
call fcn.00401836
add esp, 0x1c
jmp 0x401801
mov dword [ebp - 0x428], eax
movzx eax, word [ebp - 0x31c]
xchg ah, al
push 0
push 0x676e6974
push 0x69727765
push 0x520a0d64
push 0x352e2520
push 0x3a65736e
push 0x6563694c
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.user32.dll_wsprintfA]
add esp, 0x28
lea edx, [ebp - 0x11c]
push edx
call fcn.00401836
pushal
xor ebx, ebx
cmp ebx, 0x10
jae 0x40150f
mov edi, 0x208
mov esi, dword [ebp - 0x428]
add esi, 6
mov eax, edi
shl eax, 0x10
cmp edi, 0
jbe 0x401509
lea edx, [ebp - 0x430]
push edx
push 0xfa
lea edx, [ebp - 0x31c]
push edx
push 0x82
push esi
push dword [ebp - 0x14]
push dword [ebp - 0x434]
call fcn.00405cbe
cmp eax, 0
je 0x40141a
push 0
push 0xa0d3723
push 0x20726f72
push 0x7265206e
push 0x6f697463
push 0x65746f72
push 0x5029524f
push 0x52524528
push esp
call fcn.00401836
add esp, 0x20
jmp 0x401509
cmp byte [ebp - 0x31c], 1
jne 0x401456
push 0
push 0xa0d3823
push 0x20726f72
push 0x7265206e
push 0x6f697463
push 0x65746f72
push 0x5029524f
push 0x52524528
push esp
call fcn.00401836
add esp, 0x20
jmp 0x401509
cmp byte [ebp - 0x31c], 2
jne 0x4014ab
push 0xa0d
push 0x29726562
push 0x6d756e20
push 0x65736e65
push 0x63696c20
push 0x676e6f72
push 0x57283923
push 0x20726f72
push 0x7265206e
push 0x6f697463
push 0x65746f72
push 0x5029524f
push 0x52524528
push esp
call fcn.00401836
add esp, 0x34
jmp 0x401509
cmp byte [ebp - 0x31c], 3
jne 0x4014e4
push 0xa
push 0xd303123
push 0x20726f72
push 0x7265206e
push 0x6f697463
push 0x65746f72
push 0x5029524f
push 0x52524528
push esp
call fcn.00401836
add esp, 0x20
jmp 0x401509
cmp byte [ebp - 0x31c], 0
jne 0x401509
push 0x2e
push esp
call fcn.00401836
add esp, 4
sub edi, 0x82
add esi, 0x82
jmp 0x4013b2
inc ebx
jmp 0x401396
popal
mov dword [ebp - 0x424], 0
lea edx, [ebp - 0x430]
push edx
push 2
lea edx, [ebp - 0x424]
push edx
push 0
push 0
push 0x29
push dword [ebp - 0x438]
call fcn.00403d3e
cmp eax, 0
jne 0x401549
cmp dword [ebp - 0x424], 0
jne 0x40157c
push 0
push 0xa0d3823
push 0x20726f72
push 0x7265206e
push 0x6f697463
push 0x65746f72
push 0x5029524f
push 0x52524528
push esp
call fcn.00401836
add esp, 0x20
jmp 0x401801
push 0
push 0x30303043
mov dword [ebp - 0x10], esp
push 0
push 0x31303043
mov dword [ebp - 0xc], esp
push 0
push 0x32303043
mov dword [ebp - 8], esp
push 0
push 0x33303043
mov dword [ebp - 4], esp
push 1
lea edx, [ebp - 0x430]
push edx
push pe_nt_image_headers32
lea edx, [ebp - 0x31c]
push edx
push 2
lea edx, [esp + 0x10]
push edx
push dword [ebp - 0x10]
push dword [ebp - 0x434]
call fcn.00405cbe
cmp eax, 0
je 0x401606
push 0
push 0xa0d3723
push 0x20726f72
push 0x7265206e
push 0x6f697463
push 0x65746f72
push 0x5029524f
push 0x52524528
push esp
call fcn.00401836
add esp, 0x20
jmp 0x4017f2
lea eax, [ebp - 0x31c]
push 0xa0d
push 0x7325203a
push 0x3020746f
push 0x6c530a0d
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.user32.dll_wsprintfA]
add esp, 0x1c
lea edx, [ebp - 0x11c]
push edx
call fcn.00401836
lea edx, [ebp - 0x430]
push edx
push pe_nt_image_headers32
lea edx, [ebp - 0x31c]
push edx
push 2
lea edx, [esp + 0x10]
push edx
push dword [ebp - 0xc]
push dword [ebp - 0x434]
call fcn.00405cbe
cmp eax, 0
je 0x4016a2
push 0
push 0xa0d3723
push 0x20726f72
push 0x7265206e
push 0x6f697463
push 0x65746f72
push 0x5029524f
push 0x52524528
push esp
call fcn.00401836
add esp, 0x20
jmp 0x4017f2
lea eax, [ebp - 0x31c]
push 0
push 0xa0d7325
push 0x203a3120
push 0x746f6c53
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.user32.dll_wsprintfA]
add esp, 0x1c
lea edx, [ebp - 0x11c]
push edx
call fcn.00401836
cmp dword [ebp - 0x424], 0x7fff
jbe 0x4017f2
lea edx, [ebp - 0x430]
push edx
push pe_nt_image_headers32
lea edx, [ebp - 0x31c]
push edx
push 2
lea edx, [esp + 0x10]
push edx
push dword [ebp - 8]
push dword [ebp - 0x434]
call fcn.00405cbe
cmp eax, 0
je 0x40174b
push 0
push 0xa0d3723
push 0x20726f72
push 0x7265206e
push 0x6f697463
push 0x65746f72
push 0x5029524f
push 0x52524528
push esp
call fcn.00401836
add esp, 0x20
jmp 0x4017f2
lea eax, [ebp - 0x31c]
push 0
push 0xa0d7325
push 0x203a3220
push 0x746f6c53
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.user32.dll_wsprintfA]
add esp, 0x1c
lea edx, [ebp - 0x11c]
push edx
call fcn.00401836
lea edx, [ebp - 0x430]
push edx
push pe_nt_image_headers32
lea edx, [ebp - 0x31c]
push edx
push 2
lea edx, [esp + 0x10]
push edx
push dword [ebp - 4]
push dword [ebp - 0x434]
call fcn.00405cbe
cmp eax, 0
jne 0x4017f2
lea eax, [ebp - 0x31c]
push 0xa0d2e
push 0x656e6f44
push 0xa0d7325
push 0x203a3320
push 0x746f6c53
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.user32.dll_wsprintfA]
add esp, 0x20
lea edx, [ebp - 0x11c]
push edx
call fcn.00401836
add esp, 4
add esp, 8
add esp, 8
add esp, 8
add esp, 8
push dword [ebp - 0x42c]
call dword [sym.imp.kernel32.dll_FreeResource]
add esp, 8
push 0xfffffffffffffff6
call dword [sym.imp.kernel32.dll_GetStdHandle]
push 0
lea edx, [ebp - 0x430]
push edx
push 0x104
lea edx, [ebp - 0x420]
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadConsoleA]
leave
ret