Function at 0x401000
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
pushal
cmp dword [ebp + 0xc], 1
jne 0x4012b7
push 0x4e4941
push 0x4d5f3031
push 0x46434d4d
push 0
lea edx, [esp + 4]
push edx
call dword [sym.imp.USER32.DLL_FindWindowA]
add esp, 0xc
cmp eax, 0
je 0x4012b7
push 0xffffffffffffffeb
push eax
call dword [sym.imp.USER32.DLL_GetWindowLongA]
cmp eax, 0
je 0x4012b7
mov ebx, eax
cmp dword [ebx + 4], 0x2710
jne 0x4012b7
mov eax, dword [ebp + 8]
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x138], 1
mov dword [ebp - 0x134], 0x4012c1
mov dword [ebp - 0x130], fcn.004015f5
mov dword [ebp - 0x12c], 0x401964
push 0x20
push 0x29313031
push 0x28303720
push 0x24454c55
push 0x444f4d24
push esp
lea edx, [ebp - 0x128]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
add esp, 0x14
push 0x118
lea edx, [ebp - 0x13c]
push edx
lea edx, [ebx + 0x8c]
push edx
call fcn.004097dc
push 0x75
push 0x7a757349
push esp
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp + 8]
push 0
lea edx, [ebx + 0xa4]
push edx
call fcn.0040226b
add esp, 8
mov dword [ebp - 0x1c], eax
push 0xa
push 0x3e8
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
test eax, eax
je 0x401140
mov dword [ebp - 0x24], eax
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
je 0x401137
mov dword [ebp - 0x20], eax
push 0x3a66
lea edx, [eax + 0x14]
push edx
push 0x40b598
call dword [sym.imp.NTDLL.DLL_memcpy]
add esp, 0xc
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.DLL_FreeResource]
push 0x6e6163
push 0x5f6e6f72
push 0x74736e61
push 0x72745f75
push 0x7a757369
mov dword [ebp - 0x14], esp
push 0x3130
push 0x302e3031
mov dword [ebp - 0x10], esp
push 0x4e41
push 0x43205d6b
push 0x30363532
push 0x2f383430
push 0x322f3633
push 0x35312f34
push 0x3230315b
push 0x6e6f7274
push 0x736e6172
push 0x5424315f
push 0x3037757a
push 0x75736924
push esp
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 0x3a66
push 0x40b598
push 0x200000
push 0x93
push dword [ebp + 8]
push dword [ebp - 0x1c]
lea edx, [ebx + 0xa4]
push edx
call fcn.0040226b
add esp, 0x30
add esp, 8
add esp, 0x14
mov dword [ebp - 0x18], eax
push 0xa
push 0x3e8
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
test eax, eax
je 0x401226
mov dword [ebp - 0x24], eax
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
je 0x40121d
mov dword [ebp - 0x20], eax
push 0x3a66
lea edx, [eax + 0x14]
push edx
push 0x40b598
call dword [sym.imp.NTDLL.DLL_memcpy]
add esp, 0xc
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.DLL_FreeResource]
push 0x6e6163
push 0x5f6e6f72
push 0x74736e61
push 0x72745f75
push 0x7a757369
mov dword [ebp - 8], esp
push 0x3130
push 0x302e3031
mov dword [ebp - 4], esp
push 0x656e
push 0x696c2d4b
push 0x205d6b34
push 0x3230312f
push 0x3231355b
push 0x6e6f7274
push 0x736e6172
push 0x5424325f
push 0x3037757a
push 0x75736924
push esp
push dword [ebp - 4]
push dword [ebp - 8]
push 0x3a66
push 0x40b598
push 0
push 0x83
push dword [ebp + 8]
push dword [ebp - 0x1c]
lea edx, [ebx + 0xa4]
push edx
call fcn.0040226b
add esp, 0x28
add esp, 8
add esp, 0x14
mov dword [ebp - 0xc], eax
popal
mov eax, 1
leave
ret 0xc