Function at 0x4032c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov edi, dword [0x423d64]
mov esi, ecx
push 0x104
lea eax, [esi + 0x2b10]
push eax
push 0
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x4032f8
pop edi
mov eax, 0x210000d5
pop esi
mov esp, ebp
pop ebp
ret 0xc
push ebx
push 0x409
push 0x409
push 0x86
xor ecx, ecx
push edi
mov word [esi + eax*2 + 0x2b10], cx
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x403852
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
cmp ebx, 0xe
jb 0x403852
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x403852
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x403852
movzx ecx, word [edi]
cmp ecx, 0xe
jb 0x403852
cmp ecx, 0x14
jb 0x403372
mov ax, word [edi + 0x10]
mov word [esi], ax
movzx eax, word [edi + 2]
mov dword [esi + 0x1290], eax
movzx eax, byte [edi + 8]
and al, 1
mov byte [esi + 0x1aa0], al
movzx eax, byte [edi + 8]
shr al, 1
and al, 1
mov byte [esi + 0x1aa1], al
movzx eax, byte [edi + 8]
shr al, 2
and al, 1
mov byte [esi + 0x1aa2], al
movzx eax, byte [edi + 8]
shr al, 3
and al, 1
mov byte [esi + 0x1aa3], al
mov byte [esi + 0x1cb0], 0
movzx eax, byte [edi + 8]
shr al, 4
and al, 1
mov byte [esi + 0x1cb1], al
movzx eax, byte [edi + 8]
shr al, 5
and al, 1
mov byte [esi + 0x1cb2], al
movzx eax, byte [edi + 8]
shr al, 6
and al, 1
mov byte [esi + 0x1cb3], al
test byte [edi + 8], 0x80
mov eax, dword [ebp - 8]
lea esi, [ecx - 2]
lea ecx, [eax + 0x1aa4]
mov byte [ebp - 1], 0
lea edx, [esi + edi]
mov dword [ebp - 0xc], ecx
je 0x403459
add esi, 2
cmp esi, ebx
ja 0x403809
movzx ecx, word [edx]
test ecx, ecx
je 0x403459
add esi, ecx
cmp esi, ebx
ja 0x403809
push 0x104
push dword [ebp - 0xc]
lea eax, [edx + 2]
push ecx
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x403809
cmp eax, 0x459
je 0x403809
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov word [ecx + eax*2], dx
mov eax, dword [ebp - 8]
test byte [edi + 9], 1
lea ecx, [eax + 0x1294]
lea edx, [esi + edi]
mov dword [ebp - 0xc], ecx
je 0x4034c0
add esi, 2
cmp esi, ebx
ja 0x403809
movzx ecx, word [edx]
test ecx, ecx
je 0x4034c0
add esi, ecx
cmp esi, ebx
ja 0x403809
push 0x104
push dword [ebp - 0xc]
lea eax, [edx + 2]
push ecx
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x403809
cmp eax, 0x459
je 0x403809
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov word [ecx + eax*2], dx
mov eax, dword [ebp - 8]
lea ecx, [eax + 0x149e]
mov dword [ebp - 0xc], ecx
mov ecx, 0x200
lea edx, [esi + edi]
test word [edi + 8], cx
je 0x40352c
add esi, 2
cmp esi, ebx
ja 0x403809
movzx ecx, word [edx]
test ecx, ecx
je 0x40352c
add esi, ecx
cmp esi, ebx
ja 0x403809
push 0xff
push dword [ebp - 0xc]
lea eax, [edx + 2]
push ecx
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x403809
cmp eax, 0x459
je 0x403809
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov word [ecx + eax*2], dx
mov eax, dword [ebp - 8]
lea ecx, [eax + 0x169e]
mov dword [ebp - 0xc], ecx
mov ecx, 0x400
lea edx, [esi + edi]
test word [edi + 8], cx
je 0x403598
add esi, 2
cmp esi, ebx
ja 0x403809
movzx ecx, word [edx]
test ecx, ecx
je 0x403598
add esi, ecx
cmp esi, ebx
ja 0x403809
push 0xff
push dword [ebp - 0xc]
lea eax, [edx + 2]
push ecx
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x403809
cmp eax, 0x459
je 0x403809
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov word [ecx + eax*2], dx
mov eax, dword [ebp - 8]
lea ecx, [eax + 0x189e]
mov dword [ebp - 0xc], ecx
mov ecx, 0x800
lea edx, [esi + edi]
test word [edi + 8], cx
je 0x403604
add esi, 2
cmp esi, ebx
ja 0x403809
movzx ecx, word [edx]
test ecx, ecx
je 0x403604
add esi, ecx
cmp esi, ebx
ja 0x403809
push 0xff
push dword [ebp - 0xc]
lea eax, [edx + 2]
push ecx
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x403809
cmp eax, 0x459
je 0x403809
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov word [ecx + eax*2], dx
mov eax, dword [ebp - 8]
lea ecx, [eax + 0x1cb4]
mov dword [ebp - 0xc], ecx
mov ecx, 0x1000
lea edx, [esi + edi]
test word [edi + 8], cx
je 0x403670
add esi, 2
cmp esi, ebx
ja 0x403809
movzx ecx, word [edx]
test ecx, ecx
je 0x403670
add esi, ecx
cmp esi, ebx
ja 0x403809
push 0x104
push dword [ebp - 0xc]
lea eax, [edx + 2]
push ecx
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x403809
cmp eax, 0x459
je 0x403809
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov word [ecx + eax*2], dx
mov eax, dword [ebp - 8]
lea ecx, [eax + 0x20c8]
mov dword [ebp - 0xc], ecx
mov ecx, 0x2000
lea edx, [esi + edi]
test word [edi + 8], cx
je 0x4036dc
add esi, 2
cmp esi, ebx
ja 0x403809
movzx ecx, word [edx]
test ecx, ecx
je 0x4036dc
add esi, ecx
cmp esi, ebx
ja 0x403809
push 0x208
push dword [ebp - 0xc]
lea eax, [edx + 2]
push ecx
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x403809
cmp eax, 0x459
je 0x403809
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov word [ecx + eax*2], dx
mov eax, dword [ebp - 8]
lea ecx, [eax + 0x24da]
mov dword [ebp - 0xc], ecx
mov ecx, 0x4000
lea edx, [esi + edi]
test word [edi + 8], cx
je 0x403748
add esi, 2
cmp esi, ebx
ja 0x403809
movzx ecx, word [edx]
test ecx, ecx
je 0x403748
add esi, ecx
cmp esi, ebx
ja 0x403809
push 0x104
push dword [ebp - 0xc]
lea eax, [edx + 2]
push ecx
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x403809
cmp eax, 0x459
je 0x403809
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov word [ecx + eax*2], dx
mov eax, dword [ebp - 8]
lea ecx, [eax + 0x26e4]
mov dword [ebp - 0xc], ecx
mov ecx, 0x8000
lea edx, [esi + edi]
test word [edi + 8], cx
je 0x4037ac
add esi, 2
cmp esi, ebx
ja 0x403809
movzx ecx, word [edx]
test ecx, ecx
je 0x4037ac
add esi, ecx
cmp esi, ebx
ja 0x403809
push 0x104
push dword [ebp - 0xc]
lea eax, [edx + 2]
push ecx
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x403809
cmp eax, 0x459
je 0x403809
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov word [ecx + eax*2], dx
mov eax, dword [ebp - 8]
test byte [edi + 0xa], 1
lea ecx, [esi + edi]
lea edx, [eax + 0x28ee]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], edx
je 0x403805
add esi, 2
cmp esi, ebx
ja 0x403809
movzx ecx, word [ecx]
test ecx, ecx
je 0x403805
lea eax, [ecx + esi]
cmp eax, ebx
ja 0x403809
mov eax, dword [ebp - 0xc]
push 0x104
push edx
push ecx
add eax, 2
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x403809
cmp eax, 0x459
je 0x403809
mov ecx, dword [ebp - 0x10]
xor edx, edx
mov word [ecx + eax*2], dx
mov bl, 1
jmp 0x40380c
mov bl, byte [ebp - 1]
mov eax, dword [ebp - 8]
lea ecx, [eax + 0x1cb4]
test ecx, ecx
je 0x40383a
xor edx, edx
cmp dx, word [ecx]
je 0x40383a
lea esi, [eax + 0x1ebe]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str.wb.exe
push esi
call dword [sym.imp.SHLWAPI.dll_PathRenameExtensionW]
test bl, bl
pop ebx
mov ecx, 0x210000e3
mov eax, 0
pop edi
cmove eax, ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc
pop ebx
pop edi
mov eax, 0x210000e2
pop esi
mov esp, ebp
pop ebp
ret 0xc