Function at 0x4a3bba
Capabilities:
Extract resource via kernel32 functions
Get file size
Read file on windows

Disassembly:
push 0xc2c
mov eax, 0x550d54
call fcn.00514880
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0xc0c], eax
mov dword [ebp - 0xc34], ebx
mov dword [ebp - 0xc30], ebx
mov dword [ebp - 0xc2c], ebx
push 0x66
pop ecx
mov esi, str.PopuNT10apT0AEQpmEMff6xQeJ42FoATDheW6adaj57fMEtCbjUyB0BOexdCSqVLNFI1g44DL0sZu61d1MWZdbe0mPmIEqu9whZvRVpJMn2Dfg0JPopJNqhOLpG7UmcRCt5Sb2ilZmQN0Vwq1hlAoFHa915vHjMP8rm8dtenyNoH11FQfXJOfevHnDX6DdddThY0rEzY2GO5hM3L1s2nZlF7IfbgZ0gPHXcoVFxtRjXyns4E157y84m08BB8h3pUJYEsmz63n1x49TWfXLzIRZlyOKZKJatoKWpd1GPkhM6sjY8g8qEiLLgwp1usVVllpBCBsxZOIk04pRehmKWYPAAWcNVTVaReIAFc0jFPIOLid2tcgixrU8kQ4OFlxVW1IUVOsnvFxwIpNQaKPMmgiYF
mov dword [ebp - 4], ebx
lea edi, [ebp - 0x6a4]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x6a4]
push eax
lea ecx, [ebp - 0x880]
call fcn.004057d0
xor eax, eax
lea ecx, [ebp - 0xc34]
inc eax
mov byte [ebp - 4], al
lea eax, [ebp - 0x880]
push eax
call fcn.00407f90
push ebx
push 1
lea ecx, [ebp - 0x880]
mov byte [ebp - 4], bl
call fcn.00479e2e
mov esi, dword [ebp - 0xc0c]
mov dword [ebp - 0xc04], ebx
mov dword [ebp - 0xc14], ebx
test esi, esi
jne 0x4a3ea5
call fcn.00483845
push eax
lea ecx, [ebp - 0x948]
call fcn.00480ed9
mov byte [ebp - 4], 2
call fcn.004838ca
mov ecx, eax
call fcn.004816cb
test al, al
je 0x4a3d25
push dword [ebp + 8]
lea ecx, [ebp - 0x948]
call fcn.00481127
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
lea ecx, [ebp - 0x948]
call fcn.00481560
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc10], eax
cmp eax, 0xffffffff
jne 0x4a3cc5
lea ecx, [ebp - 0x948]
mov byte [ebp - 4], bl
call fcn.00481015
jmp 0x4a411b
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
mov dword [ebp - 0xc14], eax
test esi, esi
je 0x4a3cb2
push esi
mov dword [ebp - 0xc18], ebx
call fcn.00474ddd
pop ecx
mov edi, eax
lea eax, [ebp - 0xc18]
push ebx
push eax
push esi
push edi
push dword [ebp - 0xc10]
mov dword [ebp - 0xc04], edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0xc10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xc18], esi
je 0x4a3e8c
push edi
call fcn.00474de6
pop ecx
jmp 0x4a3cb2
call fcn.00402160
call fcn.004838ca
push eax
lea ecx, [ebp - 0x948]
call fcn.0048110a
call fcn.00483c05
test al, al
je 0x4a3d4b
call fcn.004838d0
jmp 0x4a3d62
push 2
push ebx
lea ecx, [ebp - 0x948]
call fcn.00481560
push eax
call fcn.004a7e50
add esp, 0xc
mov dword [ebp - 0xc10], eax
test eax, eax
je 0x4a3cb2
mov dword [ebp - 0x85c], ebx
mov dword [ebp - 0x858], ebx
mov dword [ebp - 0x854], ebx
push 0x53
pop ecx
mov esi, str.LAjzB3ZNr73fCBEWxPwYItOQjfgCIB0upAI1o8QO4NqzNo4cDqjerlHaC33GTI0yPrEitvRB8eneuDrqDpzyTIAuy4gquIm65lEUYk3RtySwHWzzGJibK5ZarqNqVtCP8zw4EZn0OzDTcd9SW6S6NqfELZo45N0yB373xnxFrDplWYcR2Wtk9knZdFClHcvuoOaJBSODlVfHCGvytXLoUoVD2F3HFb9usbpXIzDU9MtS1hTC4RZCtT0grrpgiglYBTO7c4YIPcQjo9ABOmqupZlZ8lHKBywcv4M6ICM08rD5SqTE1XmnVcBSwsC7b6mwKQDzkSz2TlN
mov byte [ebp - 4], 3
lea edi, [ebp - 0x25c]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x25c]
push eax
lea ecx, [ebp - 0x880]
call fcn.004057d0
lea eax, [ebp - 0x880]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x85c]
call fcn.00407f90
push ebx
push 1
lea ecx, [ebp - 0x880]
mov byte [ebp - 4], 3
call fcn.00479e2e
lea eax, [ebp - 0xbfc]
push eax
lea eax, [ebp - 0xc1c]
push eax
push 1
push dword [ebp + 8]
push dword [ebp - 0xc10]
call fcn.004a7891
add esp, 0x14
test eax, eax
je 0x4a3e05
lea ecx, [ebp - 0x85c]
call fcn.00479e80
jmp 0x4a3cb2
mov esi, dword [ebp - 0x9d0]
mov dword [ebp - 0xc14], esi
test esi, esi
je 0x4a3df5
push esi
call fcn.00474ddd
push 3
push esi
mov esi, dword [ebp - 0xc10]
mov edi, eax
push edi
push dword [ebp - 0xc1c]
mov dword [ebp - 0xc04], eax
push esi
call fcn.004a8210
add esp, 0x18
mov dword [ebp - 0xc0c], eax
call fcn.00402160
mov eax, dword [ebp - 0xc0c]
test eax, eax
je 0x4a3e71
cmp eax, 0x600
je 0x4a3e71
push edi
call fcn.00474de6
pop ecx
call fcn.00483c05
test al, al
jne 0x4a3df5
push esi
call fcn.004a76eb
pop ecx
jmp 0x4a3df5
call fcn.00483c05
test al, al
jne 0x4a3e81
push esi
call fcn.004a76eb
pop ecx
lea ecx, [ebp - 0x85c]
call fcn.00479e80
lea ecx, [ebp - 0x948]
mov byte [ebp - 4], bl
call fcn.00481015
mov esi, dword [ebp - 0xc04]
jmp 0x4a4113
push str.fullpath
push esi
call fcn.00501747
pop ecx
pop ecx
test eax, eax
jne 0x4a3f7f
push 0xffffffffffffffff
push dword [ebp + 8]
lea ecx, [ebp - 0x9cc]
call fcn.00480efe
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
lea ecx, [ebp - 0x9cc]
mov byte [ebp - 4], 5
call fcn.00481560
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc18], eax
cmp eax, 0xffffffff
jne 0x4a3f06
lea ecx, [ebp - 0x9cc]
jmp 0x4a3cb8
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
mov dword [ebp - 0xc14], edi
test edi, edi
je 0x4a3efb
push edi
mov dword [ebp - 0xc10], ebx
call fcn.00474ddd
mov esi, eax
pop ecx
mov dword [ebp - 0xc04], esi
call fcn.0047c558
push ebx
lea eax, [ebp - 0xc10]
push eax
push edi
push esi
push dword [ebp - 0xc18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0xc18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0047ae0b
cmp dword [ebp - 0xc10], edi
je 0x4a3f6c
push esi
call fcn.00474de6
pop ecx
jmp 0x4a3efb
lea ecx, [ebp - 0x9cc]
mov byte [ebp - 4], bl
call fcn.00481015
jmp 0x4a4113
push str.respath
push esi
call fcn.00501747
pop ecx
pop ecx
test eax, eax
jne 0x4a4088
call fcn.00402160
call fcn.004837b6
push 0x617eec
push dword [ebp + 8]
mov dword [ebp - 0xc1c], eax
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0xc18], eax
test eax, eax
je 0x4a4545
mov dword [ebp - 0x85c], ebx
mov dword [ebp - 0x858], ebx
mov dword [ebp - 0x854], ebx
push 0x54
pop ecx
mov esi, str.agv40bBMTw4uGFrpVf7a0C81dzFDFmTkXBpx1Ih0IsQxkEJkCt7JhUxbcMbzmetsJvrqDAjSeBgvjAQMgj8HtUl87LjbKbN7IHH6KFhHDHB4YDk3g7hQxVLy7S788StRKgSDx9Cy2lINXDD2zYsAPWLisyddztiQ0ftOuWwsco8NgSOlgymC1mPe8vFEDr0MQkaSOcIt7CzMQrDHwNCI6OSo3VC7vLlMyYXTT3iRyiMDjM0ew4Zn22IRjEp8vbmgLIo635oVxN3ZaaOaxVg59lVLxX4OMOpLMh8WefzON2WyqotuJxy5HitBnCXjF515gZsaYFQqVzX6qwN7e
mov byte [ebp - 4], 6
lea edi, [ebp - 0x3b0]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x3b0]
push eax
lea ecx, [ebp - 0x880]
movsw word es:[edi], word [esi]
call fcn.004057d0
lea eax, [ebp - 0x880]
mov byte [ebp - 4], 7
push eax
lea ecx, [ebp - 0x85c]
call fcn.00407f90
push ebx
push 1
lea ecx, [ebp - 0x880]
mov byte [ebp - 4], 6
call fcn.00479e2e
push dword [ebp - 0xc18]
mov edi, dword [ebp - 0xc1c]
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4a4073
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push dword [ebp - 0xc18]
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
push edi
mov dword [ebp - 0xc14], edi
call fcn.00474ddd
push edi
push esi
mov esi, eax
mov dword [ebp - 0xc04], eax
push esi
call fcn.004f0f60
add esp, 0x10
jmp 0x4a4075
mov esi, ebx
lea ecx, [ebp - 0x85c]
mov byte [ebp - 4], bl
call fcn.00479e80
jmp 0x4a4113
call fcn.004801a7
push esi
push dword [ebp + 8]
call fcn.004837b6
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
mov dword [ebp - 0xc0c], esi
test esi, esi
je 0x4a411b
push esi
call fcn.004837b6
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc1c], eax
push esi
test eax, eax
jne 0x4a40c9
call dword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x4a411b
call fcn.004837b6
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0xc14], edi
test edi, edi
je 0x4a411b
push edi
call fcn.00474ddd
pop ecx
push edi
push dword [ebp - 0xc1c]
mov esi, eax
mov dword [ebp - 0xc04], esi
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push esi
call fcn.004f0f60
add esp, 0xc
push dword [ebp - 0xc0c]
call dword [sym.imp.KERNEL32.dll_FreeResource]
test esi, esi
jne 0x4a4229
call fcn.00402160
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc24], eax
cmp eax, 0xffffffff
je 0x4a4545
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0xc14], eax
test eax, eax
je 0x4a4545
push eax
mov dword [ebp - 0xc0c], ebx
call fcn.00474ddd
pop ecx
mov dword [ebp - 0xc04], eax
mov dword [ebp - 0x85c], ebx
mov dword [ebp - 0x858], ebx
mov dword [ebp - 0x854], ebx
push 0x56
pop ecx
mov esi, str.adDhzNUPkmeIrOtsqyrXlswtWL4eHBLwxfVCQ3USAJHYNHBEGJMHZbGXPwoOllwIQAaJ15dl5icikr21DuiDr2T0VD0gEHAkf8JyLEtqsyUuvqc9Fd6FoK6AukvE0eUfDl6aPEZ3QWJIprQ0V6dA5lgv5K2AkSQe3YqgAt887ievjhrI7t1nOd5z9DsTHvhpv9KX5hbCmF2ja5UtvM5hM867p9ZmuSCULYMxrEWBiBYaozSLXJIsKco4gN0fqh8WrvFDMTQtcluUmzJDNUb0rQlQ42m8PqINz7OvNY4hfx72x80Xq02VBgYLS4tCab1rFE07yVWBnTwMFlzxu5sFDESZ
mov byte [ebp - 4], 8
lea edi, [ebp - 0x50c]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x50c]
push eax
lea ecx, [ebp - 0x880]
movsb byte es:[edi], byte [esi]
call fcn.004057d0
lea eax, [ebp - 0x880]
mov byte [ebp - 4], 9
push eax
lea ecx, [ebp - 0x85c]
call fcn.00407f90
push ebx
push 1
lea ecx, [ebp - 0x880]
call fcn.00479e2e
mov esi, dword [ebp - 0xc14]
lea eax, [ebp - 0xc0c]
mov edi, dword [ebp - 0xc04]
push ebx
push eax
push esi
push edi
push dword [ebp - 0xc24]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0xc24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xc0c], esi
je 0x4a4213
push edi
call fcn.00474de6
mov edi, ebx
pop ecx
mov dword [ebp - 0xc04], edi
lea ecx, [ebp - 0x85c]
mov byte [ebp - 4], bl
call fcn.00479e80
test edi, edi
je 0x4a4545
mov dword [ebp - 0x874], ebx
mov dword [ebp - 0x870], ebx
mov dword [ebp - 0x86c], ebx
push 0x40
pop ecx
mov esi, str.q0jMs4P2ktjR7OnPPMwfYpnRRjlbInOCaIhHn1KFsPibF3itPOn2sz5mAqcBZjP3g9AUiueFRueJ9JFGrbyodq9ZpqOx7ouSt13GOyIx6Z7TGYfkeRxL0aZrdm61jUiTSsGir6w7aTgIIKjPi9fUeNwtZzx7onre6lMYa5hgZcz92IyTIdzlUkdNQk3TGddPxUgF8dc1KlWCzcSKy7fOMgENuYJwrbkpExgc0mkDzl9C9SBBplNZ9xE7MUiKyNH
mov byte [ebp - 4], 0xa
lea edi, [ebp - 0x110]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x868]
call fcn.004057d0
lea eax, [ebp - 0x868]
mov byte [ebp - 4], 0xb
push eax
lea ecx, [ebp - 0x874]
call fcn.00407f90
push ebx
push 1
lea ecx, [ebp - 0x868]
mov byte [ebp - 4], 0xa
call fcn.00479e2e
mov esi, dword [ebp - 0xc04]
lea eax, [ebp - 0xc38]
push 4
push eax
lea eax, [ebp - 0xc20]
push eax
lea eax, [ebp - 0xc28]
push eax
push dword [ebp - 0xc14]
push esi
call fcn.004cc8dd
mov edi, eax
push esi
mov dword [ebp - 0xc24], edi
call fcn.00474de6
add esp, 0x1c
test edi, edi
je 0x4a453a
push 0x2c
lea eax, [ebp - 0x8ac]
push ebx
push eax
call fcn.004f14e0
add esp, 0xc
mov dword [ebp - 0x85c], ebx
mov dword [ebp - 0x858], ebx
mov dword [ebp - 0x854], ebx
push 0x6b
pop ecx
mov esi, str.4WxAAMDwucuXVjpjh6e4UIHoDhYAGUu9hCcU3Gt5jmy3XiRaLdn7DXlfIGiQL7ogo4wPlvAKKRRqf9NHAky2y7C4RHZxlC0ooFnBFzpWJVTphKqgtT4gP25qrdQVk0B7Uve94cstp1tPBkN9HFSt5yf0pa35FyM76K0bXHijSi9dhRY8HwvjEEJE4ePNb01xngXFrYKO4zivYdcG56LGvj7GECPxrSJ16tKzadU8KBKmUoSp0zeD3zeHiNSZOW190auTVfnMMc450EolXMbEZNhnHDBZo2SXH5IKFAskeP0E5WBr642bN14MjyYgcAVJ8wgrtg44UzawXkzdlIfS4S26RMASrSozwxH68t6vWoTuNG8jdadbFEG2qm27bkAHjpECYp8nnd4b4LF6oZAyiS4UCdSbykguuWSu8XPAJN8
mov byte [ebp - 4], 0xc
lea edi, [ebp - 0x850]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x850]
push eax
lea ecx, [ebp - 0x8c4]
call fcn.004057d0
lea eax, [ebp - 0x8c4]
mov byte [ebp - 4], 0xd
push eax
lea ecx, [ebp - 0x85c]
call fcn.00407f90
xor esi, esi
mov byte [ebp - 4], 0xc
push ebx
inc esi
lea ecx, [ebp - 0x8c4]
push esi
call fcn.00479e2e
mov ecx, dword [ebp - 0xc28]
mov eax, dword [ebp - 0xc20]
mov dword [ebp - 0x8a8], ecx
neg eax
imul ecx, dword [ebp - 0xc20]
mov dword [ebp - 0x8a4], eax
push 0x20
pop eax
mov dword [ebp - 0x8ac], 0x28
shl ecx, 2
mov word [ebp - 0x8a0], si
mov word [ebp - 0x89e], ax
mov dword [ebp - 0x89c], ebx
mov dword [ebp - 0x898], ecx
mov byte [ebp - 0xbfd], bl
mov dword [ebp - 0xc08], ebx
call fcn.00402160
push ebx
push ebx
lea eax, [ebp - 0xc08]
push eax
push ebx
lea eax, [ebp - 0x8ac]
push eax
push ebx
call dword [sym.imp.GDI32.dll_CreateDIBSection]
mov dword [ebp - 0xc0c], eax
test eax, eax
je 0x4a452f
call fcn.00402160
mov eax, dword [ebp - 0xc28]
mov esi, ebx
imul eax, dword [ebp - 0xc20]
mov edi, dword [ebp - 0xc24]
test eax, eax
jle 0x4a44e0
mov edx, 0xff
mov eax, dword [ebp - 0xc08]
mov cl, byte [edi + esi*4 + 3]
mov byte [eax + esi*4 + 3], cl
mov ecx, dword [ebp - 0xc08]
cmp byte [ecx + esi*4 + 3], dl
jae 0x4a446b
movzx ecx, byte [edi + esi*4 + 3]
xor edx, edx
movzx eax, byte [edi + esi*4 + 2]
imul eax, ecx
mov ecx, 0xff
div ecx
mov ecx, dword [ebp - 0xc08]
xor edx, edx
mov byte [ecx + esi*4], al
movzx ecx, byte [edi + esi*4 + 3]
movzx eax, byte [edi + esi*4 + 1]
imul eax, ecx
mov ecx, 0xff
div ecx
mov ecx, dword [ebp - 0xc08]
xor edx, edx
mov byte [ecx + esi*4 + 1], al
movzx ecx, byte [edi + esi*4 + 3]
movzx eax, byte [edi + esi*4]
imul eax, ecx
mov ecx, 0xff
div ecx
mov ecx, dword [ebp - 0xc08]
xor edx, edx
inc edx
mov byte [ebp - 0xbfd], dl
mov byte [ecx + esi*4 + 2], al
jmp 0x4a4490
mov al, byte [edi + esi*4 + 2]
xor edx, edx
mov byte [ecx + esi*4], al
inc edx
mov eax, dword [ebp - 0xc08]
mov cl, byte [edi + esi*4 + 1]
mov byte [eax + esi*4 + 1], cl
mov eax, dword [ebp - 0xc08]
mov cl, byte [edi + esi*4]
mov byte [eax + esi*4 + 2], cl
mov eax, dword [ebp - 0xc08]
mov ecx, dword [ebp + 0x10]
cmp dword [eax + esi*4], ecx
jne 0x4a44c5
mov byte [eax + esi*4], bl
mov eax, dword [ebp - 0xc08]
mov byte [ebp - 0xbfd], dl
mov byte [eax + esi*4 + 1], bl
mov eax, dword [ebp - 0xc08]
mov byte [eax + esi*4 + 2], bl
mov eax, dword [ebp - 0xc08]
mov byte [eax + esi*4 + 3], bl
mov eax, dword [ebp - 0xc28]
inc esi
imul eax, dword [ebp - 0xc20]
mov edx, 0xff
cmp esi, eax
jl 0x4a43e8
push edi
call fcn.004cc83f
push 0x9c
call fcn.00474d5d
pop ecx
mov esi, eax
pop ecx
mov dword [ebp - 0xc1c], esi
mov byte [ebp - 4], 0xe
test esi, esi
je 0x4a450c
lea ecx, [esi + 0x14]
call fcn.00480f22
mov ebx, esi
mov eax, dword [ebp - 0xc0c]
mov dword [ebx], eax
mov eax, dword [ebp - 0xc28]
mov dword [ebx + 4], eax
mov eax, dword [ebp - 0xc20]
mov dword [ebx + 8], eax
mov al, byte [ebp - 0xbfd]
mov byte [ebx + 0x10], al
lea ecx, [ebp - 0x85c]
call fcn.00479e80
lea ecx, [ebp - 0x874]
call fcn.00479e80
lea ecx, [ebp - 0xc34]
call fcn.00479e80
mov eax, ebx
call fcn.0051483b
ret