Function at 0x10009970
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x4c
mov eax, dword [0x10290680]
xor eax, ebp
mov dword [ebp - 8], eax
mov ecx, dword [0x1027f654]
or ecx, dword [0x1027f658]
xor ecx, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x942606d3
mov eax, 0xffffffff
xor eax, 0xd3f6dec8
or ecx, edx
or eax, 0xd3f6dec8
xor ecx, 0xffffffff
and ecx, eax
mov eax, ecx
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x550e3c8b
and eax, edx
or ecx, 0x550e3c8b
xor ecx, 0xffffffff
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
add eax, 0x8b5c0c57
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0xa8ce3c54
lea eax, [ebp - 0xc]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x3c], eax
sub eax, 0x8a43f948
je 0x1000a12d
jmp 0x100099ff
mov eax, dword [ebp - 0x3c]
sub eax, 0x8ba3b1cb
je 0x10009d89
jmp 0x10009a12
mov eax, dword [ebp - 0x3c]
sub eax, 0x95a7687f
je 0x10009fee
jmp 0x10009a25
mov eax, dword [ebp - 0x3c]
sub eax, 0x9a6e8e76
je 0x1000a037
jmp 0x10009a38
mov eax, dword [ebp - 0x3c]
sub eax, 0xa8ce3c54
je 0x10009bb9
jmp 0x10009a4b
mov eax, dword [ebp - 0x3c]
sub eax, 0xac6d9125
je 0x1000a1c9
jmp 0x10009a5e
mov eax, dword [ebp - 0x3c]
sub eax, 0xbb9828b7
je 0x1000a0a5
jmp 0x10009a71
mov eax, dword [ebp - 0x3c]
sub eax, 0xc2859168
je 0x10009c98
jmp 0x10009a84
mov eax, dword [ebp - 0x3c]
sub eax, 0xdb2cea47
je 0x1000a0c1
jmp 0x10009a97
mov eax, dword [ebp - 0x3c]
sub eax, 0xddc7cbc9
je 0x1000a1aa
jmp 0x10009aaa
mov eax, dword [ebp - 0x3c]
sub eax, 0xddfba77e
je 0x10009ecd
jmp 0x10009abd
mov eax, dword [ebp - 0x3c]
sub eax, 0xe82830b7
je 0x10009f45
jmp 0x10009ad0
mov eax, dword [ebp - 0x3c]
sub eax, 0xf789cb9b
je 0x1000a0b3
jmp 0x10009ae3
mov eax, dword [ebp - 0x3c]
sub eax, 0xfe7b004c
je 0x10009f37
jmp 0x10009af6
mov eax, dword [ebp - 0x3c]
sub eax, 0x105e5d7
je 0x10009e74
jmp 0x10009b09
mov eax, dword [ebp - 0x3c]
sub eax, 0x5cbfa0f
je 0x1000a1d7
jmp 0x10009b1c
mov eax, dword [ebp - 0x3c]
sub eax, 0x6875de4
je 0x10009cb3
jmp 0x10009b2f
mov eax, dword [ebp - 0x3c]
sub eax, 0x1010010c
je 0x1000a0d1
jmp 0x10009b42
mov eax, dword [ebp - 0x3c]
sub eax, 0x16bfc17b
je 0x10009d2a
jmp 0x10009b55
mov eax, dword [ebp - 0x3c]
sub eax, 0x2ac94693
je 0x10009e59
jmp 0x10009b68
mov eax, dword [ebp - 0x3c]
sub eax, 0x3402f7ff
je 0x10009fe0
jmp 0x10009b7b
mov eax, dword [ebp - 0x3c]
sub eax, 0x4a870d28
je 0x10009f8c
jmp 0x10009b8e
mov eax, dword [ebp - 0x3c]
sub eax, 0x5749903f
je 0x10009bd7
jmp 0x10009ba1
mov eax, dword [ebp - 0x3c]
sub eax, 0x59b97239
je 0x10009ffc
jmp 0x10009bb4
jmp 0x1000a1e0
mov ecx, 0x1010010c
mov eax, 0x5749903f
cmp dword [ebp - 0x10], 0x74713df3
cmovae ecx, eax
mov eax, dword [ebp - 0x38]
mov dword [eax], ecx
jmp 0x1000a1e0
mov eax, dword [0x1027f65c]
mov edx, dword [0x1027f660]
mov ecx, eax
and ecx, edx
add ecx, ecx
add eax, edx
sub eax, ecx
mov ecx, 0xa2a88d1
mul ecx
xor eax, eax
bt edx, 0x19
adc eax, 0xdd183701
mov dword [ebp - 0x40], eax
push eax
mov eax, esp
mov dword [ebp - 0x14], eax
push eax
mov eax, esp
mov dword [ebp - 0x18], eax
push eax
mov eax, esp
mov dword [ebp - 0x1c], eax
push eax
mov eax, esp
mov dword [ebp - 0x20], eax
push eax
mov eax, esp
mov dword [ebp - 0x24], eax
push eax
mov eax, esp
mov dword [ebp - 0x28], eax
lea eax, [0x1025db7a]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0x14]
mov dword [eax], ecx
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
lea ecx, str.CONFIG2
lea eax, [0x1025e12a]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edx, dword [ebp - 0x40]
mov ecx, eax
mov eax, dword [ebp - 0x18]
mov dword [eax], ecx
mov eax, dword [ebp - 0x18]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x29], al
mov ecx, 0x1010010c
mov eax, 0xc2859168
cmp edx, 0x305ccd73
cmovne ecx, eax
mov eax, dword [ebp - 0x38]
mov dword [eax], ecx
jmp 0x1000a1e0
mov ecx, 0xf789cb9b
mov eax, 0x6875de4
test byte [ebp - 0x29], 1
cmovne ecx, eax
mov eax, dword [ebp - 0x38]
mov dword [eax], ecx
jmp 0x1000a1e0
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ecx, eax
mov eax, dword [ebp - 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
mov eax, dword [ebp - 0x20]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, eax
mov eax, dword [ebp - 0x24]
mov dword [eax], ecx
mov edx, dword [ebp - 0x24]
mov ecx, 0x95a7687f
mov eax, 0x16bfc17b
cmp dword [edx], 0
cmovne ecx, eax
mov eax, dword [ebp - 0x38]
mov dword [eax], ecx
jmp 0x1000a1e0
mov eax, dword [0x1027f664]
xor edx, edx
div dword [0x1027f668]
add eax, 0xf41d8c2
mov edx, eax
or edx, 0xc25844e0
xor edx, 0xffffffff
xor eax, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0xc25844e0
and eax, ecx
or edx, eax
xor edx, 0xffffffff
mov eax, edx
add eax, 1
xor edx, 0xffffffff
or edx, 0xc293e41
add edx, eax
mov ecx, 0x8ba3b1cb
mov eax, 0x8a43f948
cmp edx, 0x456433d3
cmovae ecx, eax
mov eax, dword [ebp - 0x38]
mov dword [eax], ecx
jmp 0x1000a1e0
mov eax, dword [0x1027f66c]
mov ecx, dword [0x1027f670]
xor ecx, 0xffffffff
xor edx, edx
sub edx, 1
sub ecx, edx
sub eax, ecx
mov ecx, 0x2a535359
xor edx, edx
div ecx
sub eax, 0x4a0c9c39
xor eax, 0xc39b5349
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 1
add ecx, eax
xor eax, eax
sub eax, ecx
sub esp, 4
mov dword [esp], eax
call fcn.100b5a74
add esp, 4
mov ecx, eax
mov eax, dword [ebp - 0x28]
mov dword [eax], ecx
mov eax, dword [ebp - 0x28]
mov edx, dword [eax]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.101f4710
add esp, 0xc
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ecx]
mov byte [eax + ecx], 0
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.10009720
mov edx, dword [ebp - 0x44]
add esp, 4
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
sete al
and al, 1
mov byte [ebp - 0x31], al
mov ecx, 0x8ba3b1cb
mov eax, 0x2ac94693
cmp edx, 0x6e0a29b5
cmovae ecx, eax
mov eax, dword [ebp - 0x38]
mov dword [eax], ecx
jmp 0x1000a1e0
mov ecx, 0x105e5d7
mov eax, 0xe82830b7
test byte [ebp - 0x31], 1
cmovne ecx, eax
mov eax, dword [ebp - 0x38]
mov dword [eax], ecx
jmp 0x1000a1e0
mov eax, dword [0x1027f674]
imul eax, dword [0x1027f678]
mov ecx, 0x25443590
xor edx, edx
div ecx
xor eax, 0xd755bdff
mov edx, eax
xor edx, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0xea743488
and edx, ecx
or eax, 0xea743488
xor eax, 0xffffffff
xor edx, 0xffffffff
xor eax, 0xffffffff
and edx, eax
mov ecx, 0xddc7cbc9
mov eax, 0xddfba77e
cmp edx, 0x97b44f0a
cmovae ecx, eax
mov eax, dword [ebp - 0x38]
mov dword [eax], ecx
jmp 0x1000a1e0
mov eax, dword [0x1027f67c]
xor edx, edx
div dword [0x1027f680]
and eax, 0x7ab34d47
mov ecx, eax
and ecx, 0xcb14da21
xor ecx, 0xffffffff
add eax, 0xcb14da21
add eax, 1
add eax, ecx
sub eax, 0x2ffaeeaf
sub eax, 0x550c1e91
add eax, 0x2ffaeeaf
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x30]
sub esp, 4
mov dword [esp], eax
call fcn.100b5a7d
mov edx, dword [ebp - 0x48]
add esp, 4
mov ecx, 0xddfba77e
mov eax, 0xfe7b004c
cmp edx, 0x1127ae38
cmovne ecx, eax
mov eax, dword [ebp - 0x38]
mov dword [eax], ecx
jmp 0x1000a1e0
mov eax, dword [ebp - 0x38]
mov dword [eax], 0xe82830b7
jmp 0x1000a1e0
mov edx, dword [0x1027f684]
sub edx, dword [0x1027f688]
or edx, 0xb992ee01
sub edx, 0x382c6311
mov eax, edx
xor eax, 0xfbda46e1
xor eax, 0xffffffff
or edx, 0xfbda46e1
and edx, eax
mov ecx, 0x4a870d28
mov eax, 0xac6d9125
cmp edx, 0x3f41eb6f
cmovbe ecx, eax
mov eax, dword [ebp - 0x38]
mov dword [eax], ecx
jmp 0x1000a1e0
mov eax, dword [0x1027f68c]
mov edx, dword [0x1027f690]
mov esi, eax
xor esi, edx
xor esi, 0xffffffff
mov ecx, edx
and ecx, esi
shl ecx, 1
sub ecx, edx
sub eax, ecx
xor eax, 0x83257959
mov ecx, 0xffffffff
xor ecx, 0x9b685282
add eax, ecx
add eax, 1
imul edx, eax, 0x4ab97092
mov ecx, 0xac6d9125
mov eax, 0x3402f7ff
cmp edx, 0x14e55fe4
cmova ecx, eax
mov eax, dword [ebp - 0x38]
mov dword [eax], ecx
jmp 0x1000a1e0
mov eax, dword [ebp - 0x38]
mov dword [eax], 0x59b97239
jmp 0x1000a1e0
mov eax, dword [ebp - 0x38]
mov dword [eax], 0x59b97239
jmp 0x1000a1e0
mov eax, dword [0x1027f694]
xor edx, edx
div dword [0x1027f698]
add eax, 0xfd1cc78f
imul eax, eax, 0x33c25b14
imul edx, eax, 0xeede89a5
mov ecx, 0x5cbfa0f
mov eax, 0x9a6e8e76
cmp edx, 0xec0aaae2
cmovb ecx, eax
mov eax, dword [ebp - 0x38]
mov dword [eax], ecx
jmp 0x1000a1e0
mov eax, dword [0x1027f69c]
xor edx, edx
div dword [0x1027f6a0]
mov ecx, eax
xor ecx, 0xbd5af5b8
xor ecx, 0xffffffff
or eax, 0xbd5af5b8
and eax, ecx
add eax, 0x306dbb2c
add eax, 0x557a41c
sub eax, 0x306dbb2c
mov edx, eax
and edx, 0xa85ae613
xor edx, 0xffffffff
xor eax, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0xa85ae613
or eax, ecx
xor edx, 0xffffffff
xor eax, 0xffffffff
or edx, eax
mov ecx, 0x5cbfa0f
mov eax, 0xbb9828b7
cmp edx, 0xf3ba6183
cmovbe ecx, eax
mov eax, dword [ebp - 0x38]
mov dword [eax], ecx
jmp 0x1000a1e0
mov eax, dword [ebp - 0x38]
mov dword [eax], 0xdb2cea47
jmp 0x1000a1e0
mov eax, dword [ebp - 0x38]
mov dword [eax], 0xdb2cea47
jmp 0x1000a1e0
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.100b5a82
lea esp, [ebp - 4]
pop esi
pop ebp
ret
push eax
mov eax, esp
mov dword [ebp - 0x50], eax
push eax
mov eax, esp
mov dword [ebp - 0x4c], eax
lea eax, [0x1025db7a]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0x50]
mov dword [eax], ecx
mov edx, dword [eax]
lea ecx, str.CONFIG2
lea eax, [0x1025e12a]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ecx, eax
mov eax, dword [ebp - 0x4c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x38]
mov dword [eax], 0x5749903f
jmp 0x1000a1e0
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 1
add ecx, eax
xor eax, eax
sub eax, ecx
sub esp, 4
mov dword [esp], eax
call fcn.100b5a74
add esp, 4
mov ecx, eax
mov eax, dword [ebp - 0x28]
mov dword [eax], ecx
mov eax, dword [ebp - 0x28]
mov edx, dword [eax]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.101f4710
add esp, 0xc
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ecx]
mov byte [eax + ecx], 0
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.10009720
add esp, 4
mov eax, dword [ebp - 0x38]
mov dword [eax], 0x8ba3b1cb
jmp 0x1000a1e0
mov eax, dword [ebp - 0x30]
sub esp, 4
mov dword [esp], eax
call fcn.100b5a7d
add esp, 4
mov eax, dword [ebp - 0x38]
mov dword [eax], 0xddfba77e
jmp 0x1000a1e0
mov eax, dword [ebp - 0x38]
mov dword [eax], 0x4a870d28
jmp 0x1000a1e0
mov eax, dword [ebp - 0x38]
mov dword [eax], 0x9a6e8e76
jmp 0x100099e9