Function at 0x4044c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0xa
mov ebx, eax
push 0x6a
push ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x404602
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x404602
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x4045f8
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x78]
mov edx, dword [eax + 0x74]
push ecx
push edx
push edi
mov eax, ebx
call fcn.00404470
mov edi, eax
add esp, 0xc
mov dword [ebp - 4], 0
test edi, edi
je 0x404575
cmp word [edi], 0
mov edx, 1
je 0x404550
mov dword [ebp - 4], edx
lea ebx, [ebx]
movzx ecx, word [eax]
test cx, cx
je 0x404575
cmp cx, 0x20
jne 0x404569
cmp word [eax + 2], 0
jne 0x4046de
movzx ecx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x404558
push ebx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push ebx
mov esi, eax
push edi
push esi
call fcn.004058b0
add esp, 0xc
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 4]
lea ecx, [eax*4 + 4]
push ecx
push 8
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, dword [ebp + 8]
mov dword [edi + 0x5c], eax
mov dword [eax], esi
mov eax, esi
test esi, esi
je 0x4045f5
mov edx, 4
lea ecx, [ecx]
movzx ecx, word [eax]
test cx, cx
je 0x4045f5
cmp cx, 0x20
jne 0x4045e9
cmp word [eax + 2], 0
jne 0x4046ef
movzx ecx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x4045d8
mov ebx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_FreeResource]
push 0xa
push 0x6f
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x404690
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x404690
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x404686
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x78]
mov edx, dword [eax + 0x74]
push ecx
push edx
push edi
mov eax, esi
call fcn.00404470
add esp, 0xc
mov edi, eax
lea eax, [esi + esi + 2]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp + 8]
push esi
push edi
push eax
mov dword [ecx + 0x6c], eax
call fcn.004058b0
add esp, 0xc
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_FreeResource]
push 0xa
push 0x72
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x4046d7
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4046d7
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x4046d0
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
mov dword [edx + 0x58], ecx
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
add eax, 2
je 0x404575
add dword [ebp - 4], edx
jmp 0x404550
add eax, 2
je 0x4045f5
xor ecx, ecx
mov word [eax - 2], cx
mov ecx, dword [edi + 0x5c]
mov dword [edx + ecx], eax
add edx, 4
jmp 0x4045d0