Function at 0x41c800
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47566d
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x490040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
cmp dword [esi + 0x14], 0xf
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x40], eax
jbe 0x41c83e
mov esi, dword [esi]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push esi
push 0x69
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x41c914
mov eax, dword fs:[0x2c]
movaps xmm0, xmmword [0x488640]
movups xmmword [ebp - 0x3c], xmm0
mov dword [ebp - 0x1c], 0x465e8e6f
mov ecx, dword [eax]
movaps xmm0, xmmword [0x488ba0]
mov eax, dword [0x496264]
movups xmmword [ebp - 0x2c], xmm0
mov word [ebp - 0x18], 0x84ee
mov byte [ebp - 0x16], 0xb0
cmp eax, dword [ecx + 4]
jle 0x41c8f4
push 0x496264
call fcn.00452992
add esp, 4
cmp dword [0x496264], 0xffffffff
jne 0x41c8f4
xorps xmm0, xmm0
mov byte [0x49671f], 1
movlpd qword [ebp - 0x44], xmm0
mov edx, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x44]
mov al, byte [ebp + ecx - 0x3c]
mov byte [ecx + 0x4966f8], al
add ecx, 1
adc edx, 0
test edx, edx
jne 0x41c8da
cmp ecx, 0x27
jb 0x41c8c1
push 0x47a9f0
call fcn.00452c62
add esp, 4
push 0x496264
call fcn.00452941
add esp, 4
mov ecx, 0x4966f8
call fcn.0040b460
push 0x4966f8
push 1
call fcn.00401610
add esp, 8
xor al, al
jmp 0x41cb14
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x41ca3e
push ecx
or edx, 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.0041a470
add esp, 4
mov esi, eax
mov dword [ebp - 4], edi
cmp dword [esi + 0x14], 7
jbe 0x41c943
mov esi, dword [esi]
mov eax, dword fs:[0x2c]
movaps xmm0, xmmword [0x488650]
movups xmmword [ebp - 0x70], xmm0
mov dword [ebp - 0x50], 0x4b489a78
mov ecx, dword [eax]
movaps xmm0, xmmword [0x487eb0]
mov eax, dword [0x496268]
movups xmmword [ebp - 0x60], xmm0
mov dword [ebp - 0x4c], 0x38d5c9e9
mov dword [ebp - 0x48], 0x2a6fca3b
cmp eax, dword [ecx + 4]
jle 0x41c9e3
push 0x496268
call fcn.00452992
add esp, 4
cmp dword [0x496268], 0xffffffff
jne 0x41c9e3
xorps xmm0, xmm0
mov byte [0x4961c4], 1
movlpd qword [ebp - 0x44], xmm0
mov edx, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x44]
nop
mov al, byte [ebp + ecx - 0x70]
mov byte [ecx + 0x496198], al
add ecx, 1
adc edx, 0
test edx, edx
jne 0x41c9c9
cmp ecx, 0x2c
jb 0x41c9b0
push 0x47a9c0
call fcn.00452c62
add esp, 4
push 0x496268
call fcn.00452941
add esp, 4
mov ecx, 0x496198
call fcn.0040a4d0
push esi
push 0x496198
push 1
call fcn.00401610
mov ecx, dword [ebp - 0x1c]
add esp, 0xc
cmp ecx, 7
jbe 0x41ca37
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x41ca2d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41cb30
push ecx
push edx
call fcn.00452c7c
add esp, 8
xor al, al
jmp 0x41cb14
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [ebp - 0x40]
mov dword [ecx], eax
test eax, eax
jne 0x41cb07
mov eax, dword fs:[0x2c]
movaps xmm0, xmmword [0x487dd0]
movups xmmword [ebp - 0x3c], xmm0
mov dword [ebp - 0x1c], 0x2a1d8a78
mov ecx, dword [eax]
movaps xmm0, xmmword [0x4886f0]
mov eax, dword [0x49645c]
movups xmmword [ebp - 0x2c], xmm0
cmp eax, dword [ecx + 4]
jle 0x41cae3
push 0x49645c
call fcn.00452992
add esp, 4
cmp dword [0x49645c], 0xffffffff
jne 0x41cae3
xorps xmm0, xmm0
mov byte [0x496674], 1
movlpd qword [ebp - 0x44], xmm0
mov edx, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x44]
nop
mov al, byte [ebp + ecx - 0x3c]
mov byte [ecx + 0x496650], al
add ecx, 1
adc edx, 0
test edx, edx
jne 0x41cac9
cmp ecx, 0x24
jb 0x41cab0
push 0x47a990
call fcn.00452c62
add esp, 4
push 0x49645c
call fcn.00452941
add esp, 4
mov ecx, 0x496650
call fcn.0040b1b0
push 0x496650
push 1
call fcn.00401610
add esp, 8
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor al, al
jmp 0x41cb14
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebx], eax
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00452933
mov esp, ebp
pop ebp
ret
call fcn.004579bf
int3