Function at 0x496a66
Capabilities:
Extract resource via kernel32 functions
Get file size
Read file on windows

Disassembly:
push 0x850
mov eax, 0x541134
call fcn.00506b61
mov esi, dword [ebp + 0xc]
call fcn.00402160
or edi, 0xffffffff
test esi, esi
jne 0x496ca4
call fcn.00476b16
push eax
lea ecx, [ebp - 0x580]
call fcn.004746ad
and dword [ebp - 4], esi
call fcn.00476b98
mov ecx, eax
call fcn.00474e8b
test al, al
je 0x496b53
push dword [ebp + 8]
lea ecx, [ebp - 0x580]
call fcn.004748eb
push esi
push 0x80
push 3
push esi
push 1
push connect
lea ecx, [ebp - 0x580]
call fcn.004ca09e
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x496afb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x580]
call fcn.004747e9
jmp 0x496f66
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
test ebx, ebx
je 0x496ae7
and dword [ebp - 0x854], 0
push ebx
call fcn.0046831d
pop ecx
mov esi, eax
lea eax, [ebp - 0x854]
push 0
push eax
push ebx
push esi
push edi
mov dword [ebp - 0x83c], esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00402160
cmp dword [ebp - 0x854], ebx
je 0x496c99
push esi
call fcn.00468326
pop ecx
jmp 0x496ae7
and dword [ebp - 0x494], 0
and dword [ebp - 0x490], 0
and dword [ebp - 0x48c], 0
push 0x62
pop ecx
mov esi, str.5nO8x22fwSPrBNp3KQwPJXaK5MvU6rQMs0wLxu9f7pvCl4wAcvUvxcp0HsJOwfwUPZLUeFmE9dwhYWogxrOaBOxjYAEHW9logf4AKzfZrULDzZSVNDklo7ISCT2SqKBRB0dY1ePK7fUjL0IFj6qub4nxNhtB5DXnRlqOZECblFXnIZAtFiAFXuNX5HBVyInRElbfobAvIUbupp2otEktCQhHSUZ5mBUR43h2NDQOen67OWwmFDvGk7lmdl0rP5uNmX4iiW9I3pOy4Oysxm5kHniyf0gaUwG5QGCuJLKFTnPp9EfPUdsQfXhq5ohRwYFuYdoiPOITeGVDF7AwAfZjaml6ySeHWu4n6g5tGGArDkRkmYxfRRsD1SLW4MHyjchdo2BwQyu
mov byte [ebp - 4], 1
lea edi, [ebp - 0x488]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x488]
push eax
lea ecx, [ebp - 0x4b8]
call fcn.00405820
lea eax, [ebp - 0x4b8]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x494]
call fcn.00407e30
xor eax, eax
lea ecx, [ebp - 0x4b8]
inc eax
push 0
push eax
mov byte [ebp - 4], al
call fcn.0046d37e
call fcn.00476b98
push eax
lea ecx, [ebp - 0x580]
call fcn.004748ce
call fcn.00476d6b
test al, al
je 0x496bd9
call fcn.00476c1b
jmp 0x496bf1
push 2
push 0
lea ecx, [ebp - 0x580]
call fcn.004ca09e
push eax
call fcn.0049aa77
add esp, 0xc
mov edi, eax
test edi, edi
jne 0x496c07
lea ecx, [ebp - 0x494]
call fcn.0046d3d0
jmp 0x496ae7
call fcn.00402160
lea eax, [ebp - 0x834]
push eax
lea eax, [ebp - 0x848]
push eax
push 1
push dword [ebp + 8]
push edi
call fcn.0049a4b8
add esp, 0x14
test eax, eax
jne 0x496bf7
mov ebx, dword [ebp - 0x608]
test ebx, ebx
je 0x496bf7
push ebx
call fcn.0046831d
push 3
push ebx
mov esi, eax
mov dword [ebp - 0x83c], eax
push esi
push dword [ebp - 0x848]
push edi
call fcn.0049ae37
add esp, 0x18
test eax, eax
je 0x496c7e
cmp eax, 0x600
je 0x496c7e
push esi
call fcn.00468326
pop ecx
call fcn.00476d6b
test al, al
jne 0x496bf7
push edi
call fcn.0049a312
pop ecx
jmp 0x496bf7
call fcn.00476d6b
test al, al
jne 0x496c8e
push edi
call fcn.0049a312
pop ecx
lea ecx, [ebp - 0x494]
call fcn.0046d3d0
lea ecx, [ebp - 0x580]
jmp 0x496e5f
push str.fullpath
push esi
call fcn.004f39f7
pop ecx
pop ecx
test eax, eax
jne 0x496e6d
push edi
push dword [ebp + 8]
lea ecx, [ebp - 0x604]
call fcn.004746d2
push 3
pop eax
push 0
push 0x80
push eax
push 0
push 1
push connect
lea ecx, [ebp - 0x604]
mov dword [ebp - 4], eax
call fcn.004ca09e
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x848], eax
cmp eax, edi
jne 0x496d09
mov dword [ebp - 4], edi
lea ecx, [ebp - 0x604]
jmp 0x496af1
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
test ebx, ebx
je 0x496cfb
xor esi, esi
push ebx
mov dword [ebp - 0x858], esi
call fcn.0046831d
pop ecx
mov dword [ebp - 0x83c], eax
mov dword [ebp - 0x4ac], esi
mov dword [ebp - 0x4a8], esi
mov dword [ebp - 0x4a4], esi
push 0x33
pop ecx
mov esi, str.oBPKKYubZD71MpYk4o6Ck1L99mjjXHnBK2gFvuVZanRKUEie69e3bDKxlZtjvNjvuyehdz4314EoI87XQtl32yJnk8gWPESWk4QPTknNRECQV01TYNQrVZZDSNyciAEgF8jPlxMC6cMZQOiXIpZgZo0KqndAtBw1guLa9kxdIy2AQF2GVrg4wCBLS1azoWm4jvR5bdNgt9EbP6
mov byte [ebp - 4], 4
lea edi, [ebp - 0xe0]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0xe0]
push eax
lea ecx, [ebp - 0x4a0]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.00405820
lea eax, [ebp - 0x4a0]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x4ac]
call fcn.00407e30
xor edi, edi
lea ecx, [ebp - 0x4a0]
push edi
push 1
call fcn.0046d37e
mov esi, dword [ebp - 0x848]
lea eax, [ebp - 0x858]
push edi
push eax
push ebx
push dword [ebp - 0x83c]
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x494], edi
mov dword [ebp - 0x490], edi
mov dword [ebp - 0x48c], edi
push 0x4d
pop ecx
mov esi, str.z4DhtK7HBKSfe25BVpnRl2A3luBUFJ3HO2f7PekfIxGYl6hsqeyz2mi7A79hJSVdVMzUIoUpzGzFMbctnnIw58gFcxZEfdgZ7BJxqaRIn1n9YSprCHHe23kwvFUq5YsIeUboyISCOGRr98qZv65FqHYdnsuzP5cfczUYbKTM5Sr1hpRZLDiVsZQOoRTZNOOhohjq5aepipAiAUe2OtIEh42amEFKtpncYUrcDAqSubrbrGSjuunmQ5B44I2dOn5r0cIDFtDhbVUf0wReNT4BegbgKQyh0ccR3cVTseyN5NsH1yvQOVCl1
mov byte [ebp - 4], 6
lea edi, [ebp - 0x300]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x300]
push eax
lea ecx, [ebp - 0x4d0]
movsw word es:[edi], word [esi]
call fcn.00405820
lea eax, [ebp - 0x4d0]
mov byte [ebp - 4], 7
push eax
lea ecx, [ebp - 0x494]
call fcn.00407e30
push 0
push 1
lea ecx, [ebp - 0x4d0]
call fcn.0046d37e
cmp dword [ebp - 0x858], ebx
je 0x496e43
push dword [ebp - 0x83c]
call fcn.00468326
pop ecx
lea ecx, [ebp - 0x494]
call fcn.0046d3d0
lea ecx, [ebp - 0x4ac]
call fcn.0046d3d0
or dword [ebp - 4], 0xffffffff
jmp 0x496cfe
lea ecx, [ebp - 0x494]
call fcn.0046d3d0
lea ecx, [ebp - 0x4ac]
call fcn.0046d3d0
lea ecx, [ebp - 0x604]
or dword [ebp - 4], 0xffffffff
call fcn.004747e9
jmp 0x496f59
push str.respath
push esi
call fcn.004f39f7
pop ecx
pop ecx
test eax, eax
jne 0x496edf
call fcn.00402160
call fcn.00476b02
push 0x600590
push dword [ebp + 8]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x4972b3
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x496f66
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push ebx
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push ebx
call fcn.0046831d
push ebx
push esi
push eax
mov dword [ebp - 0x83c], eax
call fcn.004e3220
add esp, 0x10
jmp 0x496f59
call fcn.00402160
push esi
push dword [ebp + 8]
call fcn.00476b02
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x496f66
push esi
call fcn.00476b02
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x496f16
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x496f66
call fcn.00402160
push esi
call fcn.00476b02
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
test ebx, ebx
je 0x496f66
push ebx
call fcn.0046831d
pop ecx
push ebx
push edi
mov dword [ebp - 0x83c], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push dword [ebp - 0x83c]
call fcn.004e3220
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [ebp - 0x83c], 0
jne 0x496ff7
call fcn.0046fe28
push 0
push 0x80
push 3
push 0
push 1
push connect
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4972b3
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
test ebx, ebx
je 0x4972b3
and dword [ebp - 0x850], 0
push ebx
call fcn.0046831d
pop ecx
mov esi, eax
mov dword [ebp - 0x83c], eax
call fcn.00402160
push 0
lea eax, [ebp - 0x850]
push eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x850], ebx
je 0x496fef
push esi
call fcn.00468326
xor esi, esi
pop ecx
mov dword [ebp - 0x83c], esi
test esi, esi
je 0x4972b3
xor eax, eax
mov dword [ebp - 0x4ac], eax
mov dword [ebp - 0x4a8], eax
mov dword [ebp - 0x4a4], eax
push 0x39
pop ecx
mov esi, str.T56advkkKGbF1klmJBAk0dZsZPOHwiKU46HjlZOKWyTbMpdrcH7chRPwX2yCQfkJj9WzF5tUlmzv7etheUWUrcFACVuhQ1093Zca6ytuuQazU48ABGFGSeqMmK465CRIVtgPFDJqoWmeaH9ECFjkidhEyxtNU1BI9n0WaAc8o55kbHYUuCFrJV0ZyYKjEoBaJKBgZdnNu4jL56uKFdlvGMXJAKK4OPS6tyIjj
mov dword [ebp - 4], 8
lea edi, [ebp - 0x1c8]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x1c8]
push eax
lea ecx, [ebp - 0x4d0]
movsw word es:[edi], word [esi]
call fcn.00405820
lea eax, [ebp - 0x4d0]
mov byte [ebp - 4], 9
push eax
lea ecx, [ebp - 0x4ac]
call fcn.00407e30
push 0
push 1
lea ecx, [ebp - 0x4d0]
mov byte [ebp - 4], 8
call fcn.0046d37e
push 4
lea eax, [ebp - 0x85c]
push eax
lea eax, [ebp - 0x844]
push eax
lea eax, [ebp - 0x84c]
push eax
push ebx
mov ebx, dword [ebp - 0x83c]
push ebx
call fcn.004beb73
push ebx
mov edi, eax
call fcn.00468326
add esp, 0x1c
test edi, edi
je 0x4972a2
push 0x2c
lea eax, [ebp - 0x4fc]
push 0
push eax
call fcn.004e37a0
add esp, 0xc
call fcn.00402160
mov eax, dword [ebp - 0x844]
xor bl, bl
mov ecx, dword [ebp - 0x84c]
neg eax
and dword [ebp - 0x4ec], 0
and dword [ebp - 0x840], 0
mov dword [ebp - 0x4f8], ecx
imul ecx, dword [ebp - 0x844]
mov dword [ebp - 0x4f4], eax
xor eax, eax
inc eax
mov dword [ebp - 0x4fc], 0x28
mov word [ebp - 0x4f0], ax
push 0x20
pop eax
shl ecx, 2
mov word [ebp - 0x4ee], ax
mov dword [ebp - 0x4e8], ecx
mov byte [ebp - 0x835], bl
call fcn.00473506
xor ecx, ecx
lea eax, [ebp - 0x840]
push ecx
push ecx
push eax
push ecx
lea eax, [ebp - 0x4fc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_CreateDIBSection]
mov dword [ebp - 0x848], eax
test eax, eax
je 0x4972a2
call fcn.0047021c
mov ecx, dword [ebp - 0x84c]
xor esi, esi
imul ecx, dword [ebp - 0x844]
test ecx, ecx
jle 0x497255
mov edx, 0xff
mov eax, dword [ebp - 0x840]
mov cl, byte [edi + esi*4 + 3]
mov byte [eax + esi*4 + 3], cl
mov ebx, dword [ebp - 0x840]
cmp byte [ebx + esi*4 + 3], dl
jae 0x4971d4
movzx ecx, byte [edi + esi*4 + 3]
xor edx, edx
movzx eax, byte [edi + esi*4 + 2]
imul eax, ecx
mov ecx, 0xff
div ecx
xor edx, edx
mov byte [ebx + esi*4], al
mov ebx, 0xff
movzx ecx, byte [edi + esi*4 + 3]
movzx eax, byte [edi + esi*4 + 1]
imul eax, ecx
mov ecx, dword [ebp - 0x840]
div ebx
xor edx, edx
mov byte [ecx + esi*4 + 1], al
movzx ecx, byte [edi + esi*4 + 3]
movzx eax, byte [edi + esi*4]
imul eax, ecx
mov ecx, dword [ebp - 0x840]
div ebx
xor edx, edx
inc edx
mov byte [ecx + esi*4 + 2], al
mov bl, dl
mov byte [ebp - 0x835], bl
jmp 0x4971ff
mov al, byte [edi + esi*4 + 2]
xor edx, edx
mov byte [ebx + esi*4], al
inc edx
mov eax, dword [ebp - 0x840]
mov cl, byte [edi + esi*4 + 1]
mov bl, byte [ebp - 0x835]
mov byte [eax + esi*4 + 1], cl
mov eax, dword [ebp - 0x840]
mov cl, byte [edi + esi*4]
mov byte [eax + esi*4 + 2], cl
mov eax, dword [ebp - 0x840]
mov ecx, dword [ebp + 0x10]
cmp dword [eax + esi*4], ecx
jne 0x49723a
mov byte [eax + esi*4], 0
mov bl, dl
mov eax, dword [ebp - 0x840]
mov byte [ebp - 0x835], bl
mov byte [eax + esi*4 + 1], 0
mov eax, dword [ebp - 0x840]
mov byte [eax + esi*4 + 2], 0
mov eax, dword [ebp - 0x840]
mov byte [eax + esi*4 + 3], 0
mov eax, dword [ebp - 0x84c]
inc esi
imul eax, dword [ebp - 0x844]
mov edx, 0xff
cmp esi, eax
jl 0x49715a
push edi
call fcn.004bead5
push 0x9c
call fcn.0046828f
pop ecx
mov esi, eax
pop ecx
mov dword [ebp - 0x850], esi
mov byte [ebp - 4], 0xa
test esi, esi
je 0x497281
lea ecx, [esi + 0x14]
call fcn.004746f6
jmp 0x497283
xor esi, esi
mov eax, dword [ebp - 0x848]
mov dword [esi], eax
mov eax, dword [ebp - 0x84c]
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x844]
mov dword [esi + 8], eax
mov byte [esi + 0x10], bl
jmp 0x4972a4
xor esi, esi
lea ecx, [ebp - 0x4ac]
call fcn.0046d3d0
mov eax, esi
jmp 0x4972b5
xor eax, eax
call fcn.00506b0b
ret