Function at 0x4a1af0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov ecx, dword [ebp + 8]
sub esp, 0x3c
push ebx
push esi
xor ebx, ebx
cmp word [ecx], 0x40
push edi
jne 0x4a1d90
lea eax, [ecx + 2]
push ecx
mov dword [esp + 0x34], eax
call sym.ProcessHacker.exe_PhCountStringZ
lea eax, [eax*2 - 2]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x28]
push eax
push 0x2c
lea eax, [esp + 0x38]
push eax
call sym.ProcessHacker.exe_PhSplitStringRefAtChar
test al, al
je 0x4a1d9b
lea eax, [esp + 0x18]
push eax
push 0xa
lea eax, [esp + 0x3c]
push eax
call sym.ProcessHacker.exe_PhStringToInteger64
test al, al
jne 0x4a1bdd
mov eax, dword [esp + 0x38]
cmp word [eax], 0x25
jne 0x4a1d9b
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x28]
push eax
push 0x3b
lea eax, [esp + 0x38]
push eax
call sym.ProcessHacker.exe_PhSplitStringRefAtChar
test al, al
je 0x4a1d9b
mov edi, dword [esp + 0x34]
test edi, edi
jne 0x4a1b9e
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov esi, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push dword [0x54b7b4]
lea eax, [edi + 0xa]
push eax
call sym.ProcessHacker.exe_PhCreateObject
mov esi, eax
xor ecx, ecx
lea eax, [esi + 8]
mov dword [esi + 4], eax
mov dword [esi], edi
mov word [eax + edi], cx
mov eax, dword [esp + 0x38]
test eax, eax
je 0x4a1bd2
push edi
push eax
push dword [esi + 4]
call fcn.004dd620
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, dword [esp + 0x24]
test edi, edi
jne 0x4a1bee
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov esi, eax
jmp 0x4a1c22
push dword [0x54b7b4]
lea eax, [edi + 0xa]
push eax
call sym.ProcessHacker.exe_PhCreateObject
mov esi, eax
xor ecx, ecx
lea eax, [esi + 8]
mov dword [esi + 4], eax
mov dword [esi], edi
mov word [eax + edi], cx
mov eax, dword [esp + 0x28]
test eax, eax
je 0x4a1c22
push edi
push eax
push dword [esi + 4]
call fcn.004dd620
add esp, 0xc
mov eax, dword [esi + 4]
or edi, 0xffffffff
mov dword [esp + 0xc], esi
cmp word [eax], 0x25
jne 0x4a1c52
push esi
call sym.ProcessHacker.exe_PhExpandEnvironmentStrings
test eax, eax
je 0x4a1c52
mov dword [esp + 0xc], eax
lea ecx, [esi - 8]
mov eax, edi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4a1c52
call fcn.004a2a20
mov eax, dword [esp + 0xc]
push 0x22
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
mov dword [esp + 0x34], esi
test esi, esi
je 0x4a1d7c
mov edi, dword [esp + 0x18]
xor ebx, ebx
neg edi
mov dword [esp + 0x3c], 6
mov ax, di
mov dword [esp + 0x44], ebx
shr ax, 4
inc ax
movzx eax, ax
mov dword [esp + 0x40], eax
lea eax, [esp + 0x18]
push eax
push 3
lea eax, [esp + 0x44]
push eax
push esi
call dword [sym.imp.ntdll.dll_LdrFindResource_U]
test eax, eax
js 0x4a1d70
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x30]
push eax
push dword [esp + 0x20]
push esi
call dword [sym.imp.ntdll.dll_LdrAccessResource]
test eax, eax
js 0x4a1d70
mov eax, dword [esp + 0x24]
mov esi, dword [esp + 0x2c]
push eax
push 4
push dword [0x54b674]
mov dword [esp + 0x1c], eax
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
push dword [esp + 0x10]
mov dword [esp + 0x18], eax
push esi
push eax
call fcn.004dd620
mov ecx, dword [esp + 0x20]
add esp, 0xc
and edi, 0xf
jbe 0x4a1d11
movzx eax, word [ecx]
lea ecx, [ecx + eax*2]
add ecx, 2
sub edi, 1
jne 0x4a1d03
mov edx, dword [esp + 0x10]
movzx eax, word [ecx]
dec edx
cmp edx, eax
cmovae edx, eax
test edx, edx
je 0x4a1d58
push dword [0x54b7b4]
lea esi, [edx + edx]
lea eax, [esi + 0xa]
push eax
lea edi, [ecx + 2]
call sym.ProcessHacker.exe_PhCreateObject
mov ebx, eax
xor ecx, ecx
lea eax, [ebx + 8]
mov dword [ebx], esi
mov dword [ebx + 4], eax
mov word [eax + esi], cx
test edi, edi
je 0x4a1d58
push esi
push edi
push dword [ebx + 4]
call fcn.004dd620
add esp, 0xc
push dword [esp + 0x14]
push 0
push dword [0x54b674]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov esi, dword [esp + 0x34]
jmp 0x4a1d72
xor ebx, ebx
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
or edi, 0xffffffff
mov ecx, dword [esp + 0xc]
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], edi
dec edi
jne 0x4a1d90
call fcn.004a2a20
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4