Function at 0x497f20
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00405a64
xor eax, eax
push ebp
push 0x498221
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00497f14
test al, al
je 0x497f7e
lea edx, [ebp - 0x28]
xor eax, eax
call fcn.004037b4
mov edx, dword [ebp - 0x28]
mov eax, ebx
mov ecx, dword [ebp - 4]
call fcn.004058fc
jmp 0x4981f6
push 0xa
push 0x498234
mov eax, dword [0x58c7f8]
push eax
call sub.kernel32.dll_FindResourceA
mov esi, eax
push esi
mov eax, dword [0x58c7f8]
push eax
call sub.kernel32.dll_LoadResource
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_LockResource
mov edi, eax
push esi
mov eax, dword [0x58c7f8]
push eax
call sub.kernel32.dll_SizeofResource
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
call fcn.0040320c
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
mov eax, edi
mov ecx, dword [ebp - 0x14]
call fcn.004035b8
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_FreeResource
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x3c]
add eax, dword [ebp - 0x18]
mov edx, eax
add edx, 0xf8
mov dword [ebp - 0x1c], edx
mov edx, dword [ebp - 8]
mov dword [eax + 0x34], edx
mov edx, dword [eax + 0x50]
cmp edx, dword [ebp - 0xc]
jae 0x498016
mov ecx, dword [ebp - 0xc]
sub ecx, edx
mov edx, ecx
add dword [eax + 0x50], edx
movzx eax, word [eax + 6]
lea eax, [eax + eax*4]
mov ecx, dword [ebp - 0x1c]
add dword [ecx + eax*8 - 0x20], edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ebx
xor eax, eax
call fcn.004037b4
mov eax, dword [ebx]
mov dword [ebp - 0x2c], eax
mov esi, dword [ebp - 0x2c]
test esi, esi
je 0x498086
sub esi, 4
mov esi, dword [esi]
lea eax, [ebp - 0x30]
push eax
mov ecx, esi
sub ecx, 4
mov eax, dword [ebx]
mov edx, 1
call fcn.00405adc
mov edx, dword [ebp - 0x30]
mov eax, ebx
mov ecx, 0x498248
call fcn.004058fc
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp esi, 0xa
jae 0x4981e4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebx]
call fcn.00405a74
push eax
call sub.kernel32.dll_CreateFileA_1
mov edi, eax
test edi, edi
jge 0x4981bf
mov eax, dword [ebx]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x498182
mov eax, dword [ebp - 0x24]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x34]
push eax
mov ecx, dword [ebp - 0x24]
sub ecx, 3
mov eax, dword [ebx]
mov edx, 1
call fcn.00405adc
push dword [ebp - 0x34]
push 0x498258
lea eax, [ebp - 0x38]
mov edx, esi
add dl, 0x30
call fcn.004057cc
push dword [ebp - 0x38]
mov eax, ebx
mov edx, 3
call fcn.00405978
inc esi
jmp 0x4981db
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push edi
call sub.kernel32.dll_WriteFile_1
push edi
call sub.kernel32.dll_CloseHandle_1
jmp 0x4981e4
cmp esi, 0xa
jb 0x498114
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.004058b0
mov eax, dword [ebp - 0x18]
call fcn.00403228
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x498228
lea eax, [ebp - 0x38]
mov edx, 3
call fcn.00405608
lea eax, [ebp - 0x28]
call fcn.004055e4
lea eax, [ebp - 4]
call fcn.004055e4
ret