Function at 0x4ec4b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c123d
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x634b28]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x34], ebx
mov edx, dword [ebx + 0x40]
mov ecx, dword [ebx + 0xb8]
lea eax, [edx + 1]
cmp eax, dword [ecx + 0x2c]
jge 0x4ec526
mov edi, edi
add edx, 1
js 0x4ec502
cmp edx, dword [ecx + 0x2c]
jge 0x4ec502
mov eax, dword [ecx + 0x28]
mov edx, dword [eax + edx*4]
jmp 0x4ec504
xor edx, edx
mov eax, dword [edx + 0x44]
cmp eax, dword [0x6342ac]
jl 0x4ec526
mov eax, dword [ecx]
push edx
call dword [eax + 0x50]
mov edx, dword [ebx + 0x40]
mov ecx, dword [ebx + 0xb8]
lea eax, [edx + 1]
cmp eax, dword [ecx + 0x2c]
jl 0x4ec4f0
mov ecx, dword [ebx + 0xc0]
call fcn.004af870
push eax
push 0x5f841c
call fcn.00557e68
add esp, 8
test eax, eax
je 0x4ec54b
mov esi, dword [eax + 0x120]
jmp 0x4ec54d
xor esi, esi
mov ecx, dword [ebx + 0xc0]
mov dword [ebp - 0x24], esi
call fcn.004af950
test eax, eax
jne 0x4ec8b6
test esi, esi
je 0x4ec8b6
mov edi, dword [ebx + 0x40]
or dword [ebx + 0x90], 1
inc edi
mov dword [ebp - 0x10], edi
call fcn.0054671f
mov ecx, eax
test ecx, ecx
je 0x4ec8d4
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
push 0
push 0
push 0x229
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x2c], eax
test eax, eax
je 0x4ec5e6
push eax
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
mov edx, dword [0x6342ac]
mov dword [ebp - 0x20], 0x8000
lea ecx, [eax - 0x8000]
cmp ecx, 0x2e
cmovbe edx, dword [ebp - 0x20]
dec eax
cmp eax, 0x2d
mov eax, 1
cmovbe edx, eax
mov dword [0x6342ac], edx
jmp 0x4ec5ec
mov edx, dword [0x6342ac]
push edx
push esi
mov dword [ebp - 0x14], edx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
test esi, esi
je 0x4ec880
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4ec84e
lea eax, [ebp - 0x18]
push eax
push esi
call fcn.004726e0
add esp, 8
mov ecx, 0xb
cmp dword [0x63da74], 0
mov eax, 1
cmovne eax, ecx
mov ecx, dword [ebx + 0xb8]
push 1
push edi
push 0x5ca050
push dword [ebp - 0x14]
push eax
call fcn.004937e0
mov ecx, dword [ebp - 0x10]
mov edi, eax
sub ecx, dword [ebx + 0x40]
lea eax, [ebp - 0x18]
push ecx
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x20], edi
push eax
call fcn.004eb030
add esp, 0xc
push dword [eax]
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.00499d50
mov edx, dword [ebp - 0x28]
or eax, 0xffffffff
mov byte [ebp - 4], 0
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4ec690
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebx + 0x40]
xor ecx, ecx
mov edx, dword [edi]
inc eax
cmp dword [ebp - 0x10], eax
sete cl
push ecx
mov ecx, edi
call dword [edx + 0x5c]
mov edx, dword [edi]
xor eax, eax
cmp dword [ebp - 0x2c], esi
mov esi, dword [ebp - 0x20]
mov ecx, esi
sete al
push eax
call dword [edx + 0x68]
push 8
mov ecx, esi
call fcn.0049a0f0
mov ecx, ebx
mov dword [esi + 0x4c], 0xef1f
call fcn.00498ec0
test al, al
jns 0x4ec6ef
mov eax, dword [ebx + 0x40]
inc eax
cmp dword [ebp - 0x10], eax
jne 0x4ec6ef
mov ecx, esi
call fcn.00498ec0
or eax, 0x80
mov ecx, esi
push eax
call fcn.0049a0f0
call fcn.0054671f
mov ecx, eax
test ecx, ecx
je 0x4ec8d4
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x1c], esi
push 0xef1f
mov byte [ebp - 4], 2
call fcn.005465d8
mov ebx, eax
test ebx, ebx
je 0x4ec812
push 6
push 0xef2
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x30], eax
test eax, eax
je 0x4ec812
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4ec812
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x4ec812
push dword [ebp - 0x30]
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, 0xf
lea ecx, [eax + edi]
lea ecx, [ecx]
cmp edi, ecx
jae 0x4ec812
movzx edx, word [edi]
inc edx
lea edx, [edi + edx*2]
cmp edx, ecx
jae 0x4ec812
movzx eax, word [edx]
lea edx, [edx + eax*2]
add edx, 2
cmp edx, ecx
jae 0x4ec812
movzx eax, word [edx]
lea edx, [edx + eax*2]
add edx, 2
cmp edx, ecx
jae 0x4ec812
movzx eax, word [edx]
lea edx, [edx + eax*2]
add edx, 2
cmp edx, ecx
jae 0x4ec812
movzx edi, word [edx]
inc edi
lea edi, [edx + edi*2]
sub ebx, 5
jne 0x4ec770
cmp edi, ecx
jae 0x4ec812
movzx edx, word [edi]
test dx, dx
je 0x4ec812
mov eax, dword [esi - 8]
mov ebx, edx
mov ecx, 1
sub eax, ebx
sub ecx, dword [esi - 4]
or eax, ecx
jge 0x4ec7e8
push ebx
lea ecx, [ebp - 0x1c]
call fcn.004054e8
movzx edx, word [edi]
mov esi, dword [ebp - 0x1c]
movzx eax, dx
add edi, 2
push eax
push edi
push ebx
push esi
call fcn.00587b67
push eax
call fcn.00404c98
add esp, 0x14
cmp ebx, dword [esi - 8]
jg 0x4ec8de
xor eax, eax
mov dword [esi - 0xc], ebx
mov word [esi + ebx*2], ax
mov ecx, dword [ebp - 0x20]
push esi
call fcn.0049a1d0
mov edi, dword [ebp - 0x10]
add esi, 0xfffffff0
mov ebx, dword [ebp - 0x34]
inc edi
mov eax, edi
mov dword [ebp - 0x10], edi
mov byte [ebp - 4], 0
sub eax, dword [ebx + 0x40]
cmp eax, dword [0x6342b0]
jg 0x4ec86b
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4ec84e
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x14]
inc eax
push eax
push dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
test esi, esi
jne 0x4ec601
jmp 0x4ec880
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4ec880
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x18]
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4ec8c0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [ebx + 0x90], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00404d7e
push 0x80070057
call fcn.00404d7e
int3