Function at 0x48faf0
Capabilities:
Extract resource via kernel32 functions
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7ab045
mov eax, dword fs:[0]
push eax
sub esp, 0x2a8
mov eax, dword [0x8a0204]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x23c], 0
cmp dword [ebp + 0xc], 0
jne 0x48ff20
call fcn.00462c30
push eax
lea ecx, [ebp - 0x80]
call fcn.0046f460
mov dword [ebp - 4], 0
call fcn.00462c50
mov ecx, eax
call fcn.00470490
movzx eax, al
test eax, eax
je 0x48fc90
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x80]
call fcn.0046fa00
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
lea ecx, [ebp - 0x80]
call fcn.00402b70
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
jne 0x48fbb6
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x80]
call fcn.0046f680
jmp 0x490020
push 0
mov edx, dword [ebp - 0x25c]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0
jne 0x48fbe8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x80]
call fcn.0046f680
jmp 0x490020
mov dword [ebp - 0x288], 0
mov eax, dword [ebp - 0x23c]
push eax
call fcn.0075c1c9
add esp, 4
mov dword [ebp - 0x290], eax
mov ecx, dword [ebp - 0x290]
mov dword [ebp - 0x240], ecx
push 0
lea edx, [ebp - 0x288]
push edx
mov eax, dword [ebp - 0x23c]
push eax
mov ecx, dword [ebp - 0x240]
push ecx
mov edx, dword [ebp - 0x25c]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 0x25c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x288]
cmp ecx, dword [ebp - 0x23c]
je 0x48fc8b
mov edx, dword [ebp - 0x240]
mov dword [ebp - 0x294], edx
mov eax, dword [ebp - 0x294]
push eax
call fcn.0075c181
add esp, 4
mov dword [ebp - 0x240], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x80]
call fcn.0046f680
jmp 0x490020
jmp 0x48ff0c
call fcn.00462c50
push eax
lea ecx, [ebp - 0x80]
call fcn.0046f9a0
call fcn.00462c70
push eax
lea ecx, [ebp - 0xc4]
call fcn.0046f460
mov byte [ebp - 4], 1
mov dword [ebp - 0x250], 0
call fcn.00463020
movzx ecx, al
test ecx, ecx
je 0x48fcd6
call fcn.00462c60
mov dword [ebp - 0x250], eax
jmp 0x48fcf9
lea ecx, [ebp - 0xc4]
call fcn.00402b70
push eax
lea ecx, [ebp - 0x80]
call fcn.00402b70
push eax
call fcn.004741f0
add esp, 8
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 0
jne 0x48fd25
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc4]
call fcn.0046f680
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x80]
call fcn.0046f680
jmp 0x490020
mov dword [ebp - 0x284], 0
push 0xffffffffffffffff
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x108]
call fcn.0046f4e0
mov byte [ebp - 4], 2
push 0x7b9244
push 0x7b9248
lea ecx, [ebp - 0x108]
call fcn.00470830
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x284]
push ecx
push 1
lea ecx, [ebp - 0x108]
call fcn.00402b70
push eax
mov edx, dword [ebp - 0x250]
push edx
call fcn.004734f0
add esp, 0x14
test eax, eax
je 0x48fdba
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x108]
call fcn.0046f680
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc4]
call fcn.0046f680
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x80]
call fcn.0046f680
jmp 0x490020
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0
jne 0x48fe01
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x108]
call fcn.0046f680
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc4]
call fcn.0046f680
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x80]
call fcn.0046f680
jmp 0x490020
mov ecx, dword [ebp - 0x23c]
push ecx
call fcn.0075c1c9
add esp, 4
mov dword [ebp - 0x298], eax
mov edx, dword [ebp - 0x298]
mov dword [ebp - 0x240], edx
mov eax, dword [ebp - 0x23c]
push eax
mov ecx, dword [ebp - 0x240]
push ecx
mov edx, dword [ebp - 0x284]
push edx
mov eax, dword [ebp - 0x250]
push eax
call fcn.00474a60
add esp, 0x10
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0
je 0x48fed3
cmp dword [ebp - 0x28c], 0x600
je 0x48fed3
mov ecx, dword [ebp - 0x240]
mov dword [ebp - 0x29c], ecx
mov edx, dword [ebp - 0x29c]
push edx
call fcn.0075c181
add esp, 4
mov dword [ebp - 0x240], 0
call fcn.00463020
movzx eax, al
test eax, eax
jne 0x48fea1
mov ecx, dword [ebp - 0x250]
push ecx
call fcn.00473130
add esp, 4
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x108]
call fcn.0046f680
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc4]
call fcn.0046f680
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x80]
call fcn.0046f680
jmp 0x490020
call fcn.00463020
movzx edx, al
test edx, edx
jne 0x48feee
mov eax, dword [ebp - 0x250]
push eax
call fcn.00473130
add esp, 4
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x108]
call fcn.0046f680
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc4]
call fcn.0046f680
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x80]
call fcn.0046f680
jmp 0x490018
mov dword [ebp - 0x258], 0
cmp dword [ebp + 0x14], 0
je 0x48ff3b
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x258], ecx
jmp 0x48ff46
call fcn.00462c10
mov dword [ebp - 0x258], eax
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x258]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 0
jne 0x48ff6f
jmp 0x490020
mov edx, dword [ebp - 0x260]
push edx
mov eax, dword [ebp - 0x258]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 0
jne 0x48ffa1
mov ecx, dword [ebp - 0x260]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x490020
mov edx, dword [ebp - 0x260]
push edx
mov eax, dword [ebp - 0x258]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0
jne 0x48ffc6
jmp 0x490020
mov ecx, dword [ebp - 0x23c]
push ecx
call fcn.0075c1c9
add esp, 4
mov dword [ebp - 0x2a0], eax
mov edx, dword [ebp - 0x2a0]
mov dword [ebp - 0x240], edx
mov eax, dword [ebp - 0x23c]
push eax
mov ecx, dword [ebp - 0x274]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
mov edx, dword [ebp - 0x240]
push edx
call fcn.00774520
add esp, 0xc
mov eax, dword [ebp - 0x274]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor ecx, ecx
jne 0x48fb30
cmp dword [ebp - 0x240], 0
jne 0x490116
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 0xffffffff
jne 0x49005d
jmp 0x490116
push 0
mov eax, dword [ebp - 0x264]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0
jne 0x490080
jmp 0x490116
mov dword [ebp - 0x278], 0
mov ecx, dword [ebp - 0x23c]
push ecx
call fcn.0075c1c9
add esp, 4
mov dword [ebp - 0x2a4], eax
mov edx, dword [ebp - 0x2a4]
mov dword [ebp - 0x240], edx
push 0
lea eax, [ebp - 0x278]
push eax
mov ecx, dword [ebp - 0x23c]
push ecx
mov edx, dword [ebp - 0x240]
push edx
mov eax, dword [ebp - 0x264]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 0x264]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x278]
cmp edx, dword [ebp - 0x23c]
je 0x49010f
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x2a8], eax
mov ecx, dword [ebp - 0x2a8]
push ecx
call fcn.0075c181
add esp, 4
mov dword [ebp - 0x240], 0
jmp 0x490116
cmp dword [ebp - 0x240], 0
jne 0x490126
xor eax, eax
jmp 0x4904e6
mov dword [ebp - 0x24c], 0
push 4
lea edx, [ebp - 0x2b4]
push edx
lea eax, [ebp - 0x26c]
push eax
lea ecx, [ebp - 0x268]
push ecx
mov edx, dword [ebp - 0x23c]
push edx
mov eax, dword [ebp - 0x240]
push eax
call fcn.004a8eb0
add esp, 0x18
mov dword [ebp - 0x24c], eax
mov ecx, dword [ebp - 0x240]
mov dword [ebp - 0x2ac], ecx
mov edx, dword [ebp - 0x2ac]
push edx
call fcn.0075c181
add esp, 4
cmp dword [ebp - 0x24c], 0
jne 0x49018e
xor eax, eax
jmp 0x4904e6
push 0x2c
push 0
lea eax, [ebp - 0x3c]
push eax
call fcn.00774aa0
add esp, 0xc
mov dword [ebp - 0x3c], 0x28
mov ecx, dword [ebp - 0x268]
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 0x26c]
neg edx
mov dword [ebp - 0x34], edx
mov eax, 1
mov word [ebp - 0x30], ax
mov ecx, 0x20
mov word [ebp - 0x2e], cx
mov dword [ebp - 0x2c], 0
mov edx, dword [ebp - 0x268]
imul edx, dword [ebp - 0x26c]
shl edx, 2
mov dword [ebp - 0x28], edx
mov byte [ebp - 0x241], 0
mov dword [ebp - 0x248], 0
push 0
push 0
lea eax, [ebp - 0x248]
push eax
push 0
lea ecx, [ebp - 0x3c]
push ecx
push 0
call dword [sym.imp.GDI32.dll_CreateDIBSection]
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 0
jne 0x490225
xor eax, eax
jmp 0x4904e6
mov dword [ebp - 0x238], 0
jmp 0x490240
mov edx, dword [ebp - 0x238]
add edx, 1
mov dword [ebp - 0x238], edx
mov eax, dword [ebp - 0x268]
imul eax, dword [ebp - 0x26c]
cmp dword [ebp - 0x238], eax
jge 0x490417
mov ecx, dword [ebp - 0x238]
mov edx, dword [ebp - 0x248]
mov eax, dword [ebp - 0x238]
mov esi, dword [ebp - 0x24c]
mov al, byte [esi + eax*4 + 3]
mov byte [edx + ecx*4 + 3], al
mov ecx, dword [ebp - 0x238]
mov edx, dword [ebp - 0x248]
movzx eax, byte [edx + ecx*4 + 3]
cmp eax, 0xff
jge 0x490356
mov ecx, dword [ebp - 0x238]
mov edx, dword [ebp - 0x24c]
movzx eax, byte [edx + ecx*4 + 2]
mov ecx, dword [ebp - 0x238]
mov edx, dword [ebp - 0x24c]
movzx ecx, byte [edx + ecx*4 + 3]
imul eax, ecx
xor edx, edx
mov ecx, 0xff
div ecx
mov edx, dword [ebp - 0x238]
mov ecx, dword [ebp - 0x248]
mov byte [ecx + edx*4], al
mov edx, dword [ebp - 0x238]
mov eax, dword [ebp - 0x24c]
movzx eax, byte [eax + edx*4 + 1]
mov ecx, dword [ebp - 0x238]
mov edx, dword [ebp - 0x24c]
movzx ecx, byte [edx + ecx*4 + 3]
imul eax, ecx
xor edx, edx
mov ecx, 0xff
div ecx
mov edx, dword [ebp - 0x238]
mov ecx, dword [ebp - 0x248]
mov byte [ecx + edx*4 + 1], al
mov edx, dword [ebp - 0x238]
mov eax, dword [ebp - 0x24c]
movzx eax, byte [eax + edx*4]
mov ecx, dword [ebp - 0x238]
mov edx, dword [ebp - 0x24c]
movzx ecx, byte [edx + ecx*4 + 3]
imul eax, ecx
xor edx, edx
mov ecx, 0xff
div ecx
mov edx, dword [ebp - 0x238]
mov ecx, dword [ebp - 0x248]
mov byte [ecx + edx*4 + 2], al
mov byte [ebp - 0x241], 1
jmp 0x4903b4
mov edx, dword [ebp - 0x238]
mov eax, dword [ebp - 0x248]
mov ecx, dword [ebp - 0x238]
mov esi, dword [ebp - 0x24c]
mov cl, byte [esi + ecx*4 + 2]
mov byte [eax + edx*4], cl
mov edx, dword [ebp - 0x238]
mov eax, dword [ebp - 0x248]
mov ecx, dword [ebp - 0x238]
mov esi, dword [ebp - 0x24c]
mov cl, byte [esi + ecx*4 + 1]
mov byte [eax + edx*4 + 1], cl
mov edx, dword [ebp - 0x238]
mov eax, dword [ebp - 0x248]
mov ecx, dword [ebp - 0x238]
mov esi, dword [ebp - 0x24c]
mov cl, byte [esi + ecx*4]
mov byte [eax + edx*4 + 2], cl
mov edx, dword [ebp - 0x238]
mov eax, dword [ebp - 0x248]
mov ecx, dword [eax + edx*4]
cmp ecx, dword [ebp + 0x10]
jne 0x490412
mov edx, dword [ebp - 0x238]
mov eax, dword [ebp - 0x248]
mov byte [eax + edx*4], 0
mov ecx, dword [ebp - 0x238]
mov edx, dword [ebp - 0x248]
mov byte [edx + ecx*4 + 1], 0
mov eax, dword [ebp - 0x238]
mov ecx, dword [ebp - 0x248]
mov byte [ecx + eax*4 + 2], 0
mov edx, dword [ebp - 0x238]
mov eax, dword [ebp - 0x248]
mov byte [eax + edx*4 + 3], 0
mov byte [ebp - 0x241], 1
jmp 0x490231
mov ecx, dword [ebp - 0x24c]
push ecx
call fcn.004a8e90
add esp, 4
push 0x60
call fcn.0075c186
add esp, 4
mov dword [ebp - 0x270], eax
mov dword [ebp - 4], 3
cmp dword [ebp - 0x270], 0
je 0x490462
mov ecx, dword [ebp - 0x270]
add ecx, 0x18
call fcn.0046f520
mov edx, dword [ebp - 0x270]
mov dword [ebp - 0x27c], edx
jmp 0x49046c
mov dword [ebp - 0x27c], 0
mov eax, dword [ebp - 0x27c]
mov dword [ebp - 0x2b0], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x2b0]
mov dword [ebp - 0x254], ecx
mov edx, dword [ebp - 0x254]
mov dword [edx + 4], 0
mov eax, dword [ebp - 0x254]
mov dword [eax + 8], 0
mov ecx, dword [ebp - 0x254]
mov edx, dword [ebp - 0x280]
mov dword [ecx], edx
mov eax, dword [ebp - 0x254]
mov ecx, dword [ebp - 0x268]
mov dword [eax + 0xc], ecx
mov edx, dword [ebp - 0x254]
mov eax, dword [ebp - 0x26c]
mov dword [edx + 0x10], eax
mov ecx, dword [ebp - 0x254]
mov dl, byte [ebp - 0x241]
mov byte [ecx + 0x14], dl
mov eax, dword [ebp - 0x254]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0075c173
mov esp, ebp
pop ebp
ret