Function at 0x41f7e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53ee0e
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x5a6008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], 0
push 0x10
mov dword [ebp - 4], 0
call fcn.0051134c
mov dword [ebp - 0x18], eax
lea ebx, [esi + 0x2dc]
add esp, 4
mov dword [ebp - 0x10], eax
mov ecx, ebx
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
lea eax, [ebp - 0x10]
push eax
call fcn.0041fe20
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x10]
test esi, esi
je 0x41f8b5
mov dword [ebp - 4], 2
mov eax, dword [esi]
test eax, eax
je 0x41f87b
push eax
call fcn.00515679
add esp, 4
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x41f887
call fcn.0041d680
mov eax, dword [esi + 8]
test eax, eax
je 0x41f897
push eax
call fcn.00515679
add esp, 4
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x41f8a3
call fcn.0041d680
push 0x10
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.0051137c
add esp, 8
mov ebx, dword [ebx]
push str.ENCRYPTIONDLL
push 0xb1
push dword [0x5b4878]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push dword [0x5b4878]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push dword [0x5b4878]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
push esi
call fcn.0051138a
push esi
push edi
push eax
mov dword [ebx + 8], eax
call fcn.00512db0
mov ecx, dword [ebx + 8]
sub esp, 8
mov edx, esi
call fcn.0041cfa0
add esp, 0x18
mov dword [ebx + 0xc], eax
mov edx, str.Description
mov ecx, eax
call fcn.0041d540
mov esi, dword [ebp - 0x14]
mov edx, str.Startup
mov dword [esi + 0x28c], eax
mov ecx, dword [ebx + 0xc]
call fcn.0041d540
mov dword [esi + 0x294], eax
mov edx, str.Shutdown
mov ecx, dword [ebx + 0xc]
call fcn.0041d540
mov dword [esi + 0x290], eax
mov edx, str.SetParams
mov ecx, dword [ebx + 0xc]
call fcn.0041d540
mov dword [esi + 0x298], eax
mov edx, str.GetParams
mov ecx, dword [ebx + 0xc]
call fcn.0041d540
mov dword [esi + 0x29c], eax
mov edx, str.TransformBuffer
mov ecx, dword [ebx + 0xc]
call fcn.0041d540
mov dword [esi + 0x2a0], eax
mov edx, str.RestoreBuffer
mov ecx, dword [ebx + 0xc]
call fcn.0041d540
mov dword [esi + 0x2a4], eax
mov edx, str.FreeBuffer
mov ecx, dword [ebx + 0xc]
call fcn.0041d540
mov dword [esi + 0x2a8], eax
mov edx, str.Reset
mov ecx, dword [ebx + 0xc]
call fcn.0041d540
mov dword [esi + 0x2ac], eax
mov edx, str.CreatePluginInterface
mov ecx, dword [ebx + 0xc]
call fcn.0041d540
mov dword [esi + 0x2b0], eax
mov edx, str.CreateIntegratedPluginInterface
mov ecx, dword [ebx + 0xc]
call fcn.0041d540
mov dword [esi + 0x2b4], eax
mov edx, 0x58e338
mov ecx, dword [ebx + 0xc]
call fcn.0041d540
cmp dword [esi + 0x294], 0
mov dword [esi + 0x2b8], eax
je 0x41fa76
cmp dword [esi + 0x290], 0
je 0x41fa76
cmp dword [esi + 0x298], 0
je 0x41fa76
cmp dword [esi + 0x29c], 0
je 0x41fa76
cmp dword [esi + 0x2a0], 0
je 0x41fa76
cmp dword [esi + 0x2a4], 0
je 0x41fa76
cmp dword [esi + 0x2a8], 0
je 0x41fa76
cmp dword [esi + 0x2ac], 0
je 0x41fa76
cmp dword [esi + 0x2b0], 0
je 0x41fa76
cmp dword [esi + 0x2b4], 0
je 0x41fa76
test eax, eax
je 0x41fa76
mov byte [esi + 0x20], 1
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8