Function at 0x1004e060
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x34
mov eax, 0x100c9178
call fcn.100c7256
mov esi, ecx
mov dword [ebp - 0x1c], esi
lea edi, [esi + 0x10c]
and dword [edi], 0
mov eax, dword [0x100d5394]
mov ebx, eax
neg ebx
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x14], eax
sbb ebx, ebx
and ebx, 0x7fffbffb
add ebx, 0x80004005
test eax, eax
je 0x1004e0af
xor edx, edx
push ecx
inc edx
mov ecx, eax
call fcn.1005af5a
test eax, eax
jne 0x1004e0af
mov ebx, 0x80004005
test ebx, ebx
js 0x1004e40d
push 0x10009518
lea ecx, [esi + 8]
call fcn.10056f09
test eax, eax
je 0x1004e0cd
mov ebx, 0x80004005
test ebx, ebx
js 0x1004e40d
push 0x1000952c
lea ecx, [esi + 0x48]
call fcn.10056f09
test eax, eax
je 0x1004e0eb
mov ebx, 0x80004005
test ebx, ebx
js 0x1004e40d
push 0x10009548
lea ecx, [esi + 0x68]
call fcn.10056f09
test eax, eax
je 0x1004e109
mov ebx, 0x80004005
test ebx, ebx
js 0x1004e40d
push 0x10009590
lea ecx, [esi + 0x28]
call fcn.10056f09
test eax, eax
je 0x1004e127
mov ebx, 0x80004005
test ebx, ebx
js 0x1004e40d
push 0x10009610
lea ecx, [esi + 0x88]
call fcn.10056f09
test eax, eax
je 0x1004e148
mov ebx, 0x80004005
test ebx, ebx
js 0x1004e40d
push 0x1000963c
push 0xc352
push dword [ebp - 0x14]
xor edi, edi
and dword [ebp - 0x18], edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
jne 0x1004e171
mov ebx, 0x80004005
test ebx, ebx
js 0x1004e185
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x1004e18d
jmp 0x1004e188
mov eax, dword [ebp - 0x18]
mov ebx, 0x80004005
test ebx, ebx
js 0x1004e19e
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x1004e1a3
mov ebx, 0x80004005
test ebx, ebx
js 0x1004e40a
push 0x100ce9e4
lea ecx, [ebp - 0x18]
call fcn.10048190
and dword [ebp - 4], 0
test edi, edi
je 0x1004e1d6
test edi, 0xffff0000
jne 0x1004e1d6
movzx eax, di
lea ecx, [ebp - 0x18]
push eax
call fcn.10048256
jmp 0x1004e1df
push edi
lea ecx, [ebp - 0x18]
call fcn.1005770e
xor eax, eax
add esi, 0xa8
inc eax
mov ecx, esi
push eax
push 0xbb8
mov dword [ebp - 4], eax
call fcn.100258bd
push esi
push ecx
mov esi, esp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x2c], esi
mov edi, dword [ebp - 0x18]
lea ecx, [edi - 0x10]
call fcn.10058ca6
add eax, 0x10
mov dword [esi], eax
mov esi, dword [ebp - 0x1c]
mov ecx, esi
mov byte [ebp - 4], 3
mov byte [ebp - 4], 1
call fcn.1004f6c2
or dword [ebp - 4], 0xffffffff
lea ecx, [edi - 0x10]
call fcn.10048327
mov edi, dword [ebp - 0x14]
and dword [ebp - 0x18], 0
and dword [ebp - 0x24], 0
push 0x1000963c
push 0xc351
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x1004e258
mov ebx, 0x80004005
test ebx, ebx
js 0x1004e26a
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x1004e272
jmp 0x1004e26d
mov eax, dword [ebp - 0x24]
mov ebx, 0x80004005
test ebx, ebx
js 0x1004e284
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x18], eax
test eax, eax
jne 0x1004e289
mov ebx, 0x80004005
test ebx, ebx
js 0x1004e40a
push dword [ebp - 0x14]
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cdq
lea ecx, [ebp - 0x24]
sub eax, edx
push 0x100ce9e4
sar eax, 1
push eax
push dword [ebp - 0x18]
call fcn.10058b3d
push 1
add esi, 0xd8
mov dword [ebp - 4], 5
push 0x64
mov ecx, esi
call fcn.100258bd
push esi
push ecx
mov esi, esp
mov dword [ebp - 0x2c], esp
mov dword [ebp - 0x14], esi
mov edi, dword [ebp - 0x24]
lea ecx, [edi - 0x10]
call fcn.10058ca6
add eax, 0x10
mov dword [esi], eax
mov ebx, dword [ebp - 0x1c]
mov ecx, ebx
mov byte [ebp - 4], 7
mov byte [ebp - 4], 5
call fcn.1004f6c2
or dword [ebp - 4], 0xffffffff
lea ecx, [edi - 0x10]
call fcn.10048327
lea esi, [ebx + 0x108]
push esi
push 0x10009f7c
push 7
push 0
push 0x10005964
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
test ebx, ebx
js 0x1004e40a
mov eax, dword [esi]
and dword [ebp - 0x14], 0
test eax, eax
je 0x1004e346
mov esi, dword [eax]
lea ecx, [ebp - 0x14]
push ecx
push 0x10009f8c
push eax
mov ecx, dword [esi]
call dword [0x100d6738]
call dword [esi]
push 0x10009648
mov dword [ebp - 4], 8
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x1004e4ca
xor eax, eax
mov byte [ebp - 4], 9
push 0x1000966c
lea ecx, [ebp - 0x40]
mov word [ebp - 0x40], ax
call fcn.10027261
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x1004e3ac
mov ecx, dword [eax]
lea esi, [ebp - 0x40]
sub esp, 0x10
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x18]
mov edi, dword [ecx + 0x140]
mov ecx, edi
push esi
push eax
call dword [0x100d6738]
call edi
mov ebx, eax
jmp 0x1004e3af
mov esi, dword [ebp - 0x18]
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 9
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push esi
mov byte [ebp - 4], 8
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [ebp - 4], 0xc
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x1004e3e6
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x100d6738]
call esi
or dword [ebp - 4], 0xffffffff
mov edi, dword [ebp - 0x20]
test ebx, ebx
js 0x1004e40d
mov ecx, edi
call fcn.100586bf
mov ebx, eax
test ebx, ebx
js 0x1004e40d
cmp dword [edi], 0
jne 0x1004e40d
mov ebx, 0x80004002
jmp 0x1004e40d
mov edi, dword [ebp - 0x20]
and dword [ebp - 0x28], 0
mov dword [ebp - 4], 0xd
test ebx, ebx
js 0x1004e496
mov eax, dword [edi]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 4]
mov ecx, esi
call dword [0x100d6738]
call esi
mov eax, dword [edi]
lea ecx, [ebp - 0x28]
push ecx
push 0x1000a1ec
push eax
mov esi, dword [eax]
mov ecx, dword [esi]
call dword [0x100d6738]
call dword [esi]
mov ebx, eax
test ebx, ebx
js 0x1004e496
mov edx, dword [ebp - 0x28]
test edx, edx
jne 0x1004e458
mov ebx, 0x80004002
mov esi, dword [ebp - 0x1c]
test ebx, ebx
js 0x1004e499
lea edi, [esi + 0x110]
test edx, edx
je 0x1004e48f
test edi, edi
je 0x1004e48f
and dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push ecx
push eax
call fcn.1005c1bc
mov ebx, eax
test ebx, ebx
js 0x1004e499
mov eax, dword [ebp - 0x14]
add eax, 0x94
xor ebx, ebx
mov dword [edi], eax
jmp 0x1004e499
mov ebx, 0x80070057
jmp 0x1004e499
mov esi, dword [ebp - 0x1c]
and dword [esi + 0x114], 0
mov dword [ebp - 4], 0xe
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x1004e4be
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x100d6738]
call esi
or dword [ebp - 4], 0xffffffff
mov eax, ebx
call fcn.100c7205
ret
mov ecx, 0x8007000e
call fcn.1001b9e7
int3