Function at 0x10018860
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0
push eax
mov dword [ebp - 0x418], eax
mov dword [ebp - 0x424], 0
call sym.dcapi.dll_dc_disk_open
add esp, 8
mov dword [ebp - 0x420], eax
test eax, eax
jne 0x100188b4
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1000d340
mov esp, ebp
pop ebp
ret
test dword [eax + 8], 0x1ff
je 0x100188c7
mov esi, 0x22
jmp 0x100189f1
mov eax, dword [0x100278f4]
push 0x1001f2cc
push 0x8b
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x100189ec
mov ecx, dword [0x100278f4]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [0x100278f4]
push esi
push edx
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x100189ec
mov esi, eax
mov eax, dword [0x100278f4]
mov ecx, 0x80
lea edi, [ebp - 0x40c]
rep movsd dword es:[edi], dword [esi]
xor edi, edi
push 0x1001f2cc
cmp dword [ebp + 0x10], edi
je 0x1001893b
push 0x8d
jmp 0x10018940
push 0x8c
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x10018974
mov ecx, dword [0x100278f4]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [0x100278f4]
push esi
push edx
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov dword [ebp - 0x410], edi
test edi, edi
je 0x100189ec
lea edi, [ebx + 0x1ff]
and edi, 0xfffffe00
push edi
mov dword [ebp - 0x428], edi
call dword [sym.imp.msvcrt.dll_malloc]
mov esi, eax
add esp, 4
mov dword [ebp - 0x424], esi
test esi, esi
jne 0x100189ab
lea esi, [eax + 9]
jmp 0x100189f1
push edi
push 0
push esi
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 0x410]
add esp, 0xc
push ebx
push eax
push esi
call sub.msvcrt.dll_memcpy
add esp, 0xc
cmp edi, 0x5c8
jbe 0x100189ec
mov eax, 0x7269da46
cmp dword [esi], 0x1434a669
jne 0x100189e2
cmp dword [esi + 4], eax
je 0x10018a2f
dec edi
inc esi
cmp edi, 0x5c8
ja 0x100189d5
mov esi, 1
mov edi, dword [ebp - 0x420]
mov ecx, dword [edi]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
mov edi, dword [sym.imp.msvcrt.dll_free]
call edi
mov eax, dword [ebp - 0x424]
add esp, 4
test eax, eax
je 0x10018a1c
push eax
call edi
add esp, 4
mov ecx, dword [ebp - 8]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000d340
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x410], esi
test esi, esi
je 0x100189ec
mov ecx, dword [ebp - 0x418]
push 1
push ecx
call sym.dcapi.dll_dc_dsk_get_size
add esp, 8
mov dword [ebp - 0x434], eax
or eax, edx
mov dword [ebp - 0x430], edx
jne 0x10018a5f
lea esi, [eax + 0xf]
jmp 0x100189f1
mov eax, dword [ebp - 0x420]
push 0
push 0
push 0x200
lea edx, [ebp - 0x20c]
push edx
push eax
call sym.dcapi.dll_dc_disk_read
mov esi, eax
add esp, 0x14
test esi, esi
jne 0x100189f1
mov ecx, 0xaa55
cmp word [ebp - 0xe], cx
jne 0x10018d02
lea edi, [ebp - 0x20c]
call fcn.10017250
test eax, eax
jne 0x10018d02
mov eax, dword [ebp - 0x20a]
cmp eax, 0x10eb9090
je 0x10018cf8
cmp eax, 0x20b60251
je 0x10018cf8
mov edi, dword [ebp - 0x42]
xor edx, edx
xor ecx, ecx
mov dword [ebp - 0x41c], 0x40
test edi, edi
je 0x10018af3
xor eax, eax
mov esi, dword [ebp - 0x46]
ja 0x10018aef
jb 0x10018ae9
cmp esi, 0x40
ja 0x10018aef
mov dword [ebp - 0x41c], esi
add esi, edi
xor ecx, ecx
mov ebx, dword [ebp - 0x32]
test ebx, ebx
je 0x10018b28
mov eax, dword [ebp - 0x36]
xor edi, edi
cmp edx, edi
jb 0x10018b15
ja 0x10018b0d
cmp dword [ebp - 0x41c], eax
jb 0x10018b15
mov dword [ebp - 0x41c], eax
mov edx, edi
lea edi, [eax + ebx]
xor eax, eax
cmp ecx, eax
ja 0x10018b28
jb 0x10018b24
cmp esi, edi
ja 0x10018b28
mov esi, edi
mov ecx, eax
mov ebx, dword [ebp - 0x22]
test ebx, ebx
je 0x10018b5d
mov eax, dword [ebp - 0x26]
xor edi, edi
cmp edx, edi
jb 0x10018b4a
ja 0x10018b42
cmp dword [ebp - 0x41c], eax
jb 0x10018b4a
mov dword [ebp - 0x41c], eax
mov edx, edi
lea edi, [eax + ebx]
xor eax, eax
cmp ecx, eax
ja 0x10018b5d
jb 0x10018b59
cmp esi, edi
ja 0x10018b5d
mov esi, edi
mov ecx, eax
mov ebx, dword [ebp - 0x12]
test ebx, ebx
je 0x10018b92
mov eax, dword [ebp - 0x16]
xor edi, edi
cmp edx, edi
jb 0x10018b7f
ja 0x10018b77
cmp dword [ebp - 0x41c], eax
jb 0x10018b7f
mov dword [ebp - 0x41c], eax
mov edx, edi
lea edi, [eax + ebx]
xor eax, eax
cmp ecx, eax
ja 0x10018b92
jb 0x10018b8e
cmp esi, edi
ja 0x10018b92
mov esi, edi
mov ecx, eax
cmp dword [ebp + 0xc], 0
je 0x10018c9e
mov eax, dword [ebp - 0x420]
mov eax, dword [eax + 8]
push edx
mov edx, dword [ebp - 0x41c]
push edx
push 0
push eax
call fcn.1000de70
mov esi, eax
mov eax, dword [ebp - 0x428]
add eax, 0x200
mov ecx, edx
cdq
cmp ecx, edx
ja 0x10018bd9
jb 0x10018bcf
cmp esi, eax
jae 0x10018bd9
mov esi, 0x14
jmp 0x100189f1
mov dword [ebp - 0x41c], 0x200
xor ebx, ebx
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp - 0x410]
je 0x10018bf6
or word [eax + 0x13], 0x20
mov edx, dword [ebp - 0x41c]
lea edi, [eax + 0x116]
mov ecx, 0x80
lea esi, [ebp - 0x20c]
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x13
lea esi, [ebp - 0x5c]
lea edi, [ebp - 0x25c]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x428]
mov eax, ebx
shrd edx, eax, 9
shr eax, 9
movsw word es:[edi], word [esi]
mov dword [ebp - 0x3fa], eax
mov dword [ebp - 0x3fe], edx
mov eax, ecx
cdq
and edx, 0x1ff
add eax, edx
mov edx, dword [ebp - 0x41c]
push ebx
sar eax, 9
push edx
push ecx
mov ecx, dword [ebp - 0x420]
mov word [ebp - 0x404], ax
mov eax, dword [ebp - 0x424]
push eax
push ecx
call sym.dcapi.dll_dc_disk_write
mov esi, eax
add esp, 0x14
test esi, esi
jne 0x100189f1
push eax
push eax
mov eax, dword [ebp - 0x420]
push 0x200
lea edx, [ebp - 0x40c]
push edx
push eax
call sym.dcapi.dll_dc_disk_write
add esp, 0x14
mov esi, eax
jmp 0x100189f1
mov eax, dword [ebp - 0x428]
mov ebx, dword [ebp - 0x430]
cdq
mov edi, eax
mov eax, dword [ebp - 0x434]
sub eax, edi
push ecx
mov ecx, dword [ebp - 0x420]
sbb ebx, edx
add eax, 0xfffff000
push esi
mov dword [ebp - 0x41c], eax
mov eax, dword [ecx + 8]
push 0
push eax
adc ebx, 0xffffffff
call fcn.1000de70
cmp edx, ebx
jb 0x10018be5
ja 0x10018cee
cmp eax, dword [ebp - 0x41c]
jbe 0x10018be5
mov esi, 0x14
jmp 0x100189f1
mov esi, 0x13
jmp 0x100189f1
mov esi, 0x12
jmp 0x100189f1