Function at 0x4e0694
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe78
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x188], ecx
mov dword [ebp - 0x180], ecx
mov dword [ebp - 0x184], ecx
mov dword [ebp - 0x17c], ecx
mov esi, edx
lea edi, [ebp - 0x104]
xor ecx, ecx
mov cl, byte [esi]
inc ecx
rep movsb byte es:[edi], byte [esi]
mov ebx, eax
xor eax, eax
push ebp
push 0x4e09f1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x104]
xor ecx, ecx
mov edx, 0xff
call fcn.004b3c08
push ebp
xor eax, eax
call fcn.004e064c
pop ecx
mov byte [ebp - 0x10d], al
cmp byte [ebp - 0x10d], 0
jne 0x4e071e
push ebp
mov eax, dword [0x4f9668]
test eax, eax
jns 0x4e0712
call fcn.00403f54
call fcn.004e064c
pop ecx
mov byte [ebp - 0x10d], al
cmp byte [ebp - 0x10d], 0
je 0x4e09d3
mov eax, dword [ebp - 0x108]
push eax
mov eax, dword [ebp - 0x10c]
test eax, eax
jns 0x4e0741
call fcn.00403f54
push eax
call sub.kernel32.dll_LoadResource
mov dword [ebp - 0x114], eax
xor edx, edx
push ebp
push 0x4e09cc
push dword fs:[edx]
mov dword fs:[edx], esp
cmp dword [ebp - 0x114], 0
je 0x4e09b2
mov eax, dword [ebp - 0x114]
push eax
call sub.kernel32.dll_LockResource
mov dword [ebp - 4], eax
xor edx, edx
push ebp
push 0x4e09ab
push dword fs:[edx]
mov dword fs:[edx], esp
cmp dword [ebp - 4], 0
setne byte [ebp - 0x10d]
cmp byte [ebp - 0x10d], 0
je 0x4e0992
mov eax, dword [ebp - 4]
mov al, byte [eax]
and eax, 0xff
inc eax
add dword [ebp - 4], eax
lea edx, [ebp - 0x17c]
mov eax, dword [ebp - 4]
call fcn.0040a4d0
mov eax, dword [ebp - 0x17c]
call fcn.00409ac8
mov esi, eax
mov eax, ebx
call fcn.004e0608
call fcn.0040a240
inc eax
add dword [ebp - 4], eax
mov eax, ebx
call fcn.004e0618
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.0040a370
test eax, eax
je 0x4e0992
mov eax, esi
dec eax
je 0x4e07fc
dec eax
je 0x4e0859
jmp 0x4e0935
push 0
push 0x4e0a10
lea eax, [ebp - 0x184]
lea edx, [ebp - 0x104]
call fcn.00405048
push dword [ebp - 0x184]
push 0x4e0a2c
push 0x4e0a38
lea eax, [ebp - 0x180]
mov edx, 4
call fcn.00405164
mov eax, dword [ebp - 0x180]
mov cx, word [0x4e0a64]
mov dl, 1
call fcn.004349a0
mov eax, dword [0x4f7e78]
mov eax, dword [eax]
call fcn.0046b4ec
jmp 0x4e093e
lea eax, [ebp - 0x156]
mov dx, 0x3e
call fcn.004b3c70
push ebp
lea eax, [ebp - 0x156]
mov dx, 2
call fcn.004e0628
pop ecx
mov di, word [ebp - 0x156]
push ebp
lea eax, [ebp - 0x176]
mov dx, 1
call fcn.004e0628
pop ecx
push ebp
xor edx, edx
mov dl, byte [ebp - 0x176]
lea eax, [ebp - 0x175]
call fcn.004e0628
pop ecx
lea eax, [ebp - 0x188]
lea edx, [ebp - 0x176]
call fcn.00405048
mov edx, dword [ebp - 0x188]
lea eax, [ebp - 0x154]
mov ecx, 0x1f
call fcn.0040a304
push ebp
lea eax, [ebp - 0x134]
mov dx, 2
call fcn.004e0628
pop ecx
push ebp
lea eax, [ebp - 0x132]
mov dx, 2
call fcn.004e0628
pop ecx
push ebp
lea eax, [ebp - 0x130]
mov dx, 2
call fcn.004e0628
pop ecx
push ebp
lea eax, [ebp - 0x12e]
mov dx, 2
call fcn.004e0628
pop ecx
push ebp
lea eax, [ebp - 0x12c]
mov dx, 2
call fcn.004e0628
pop ecx
push ebp
lea eax, [ebp - 0x12a]
mov dx, 2
call fcn.004e0628
pop ecx
jmp 0x4e093e
mov byte [ebp - 0x10d], 0
jmp 0x4e0992
push ebp
lea eax, [ebp - 0x116]
mov dx, 2
call fcn.004e0628
pop ecx
push ebp
lea eax, [ebp - 0x118]
mov dx, 2
call fcn.004e0628
pop ecx
lea eax, [ebp - 0x156]
push eax
push edi
mov ax, word [ebp - 0x116]
push eax
mov ax, word [ebp - 0x118]
push eax
mov eax, dword [ebx + 4]
mov ecx, dword [eax + 0xa04]
mov dl, 1
mov eax, dword [0x4b93e4]
call fcn.004ba3a4
jmp 0x4e07d6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e09b2
mov eax, dword [ebp - 0x114]
call fcn.00407f98
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e09d3
mov eax, dword [ebp - 0x114]
push eax
call sub.kernel32.dll_FreeResource
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e09f8
lea eax, [ebp - 0x188]
mov edx, 4
call fcn.00404e08
ret