Function at 0x470a70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4a3a2b
mov eax, dword fs:[0]
push eax
sub esp, 0x80
push ebx
push esi
push edi
mov eax, dword [0x4c97a0]
xor eax, esp
push eax
lea eax, [esp + 0x90]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor esi, esi
cmp dword [edi + 8], esi
jne 0x470d3d
cmp byte [edi + 0x17], 1
jne 0x470bb3
mov eax, dword [edi + 4]
cmp eax, 0xffff
jae 0x470ad9
mov ecx, dword [0x4ce640]
push 0x2000
push esi
push esi
movzx eax, ax
push esi
push eax
push ecx
jmp 0x470ae3
push 0x2010
push esi
push esi
push esi
push eax
push esi
call dword [sym.imp.USER32.dll_LoadImageW]
mov dword [edi + 8], eax
cmp eax, esi
je 0x470cb3
lea edx, [esp + 0x34]
push edx
push 0x54
push eax
call dword [sym.imp.GDI32.dll_GetObjectW]
cmp word [esp + 0x46], 0x20
jne 0x470cb3
xor edx, edx
cmp dword [esp + 0x3c], esi
mov dword [esp + 0x10], edx
jle 0x470cb3
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x40]
imul ecx, edx
add ecx, dword [esp + 0x48]
xor ebx, ebx
test eax, eax
jle 0x470b9f
movzx edi, byte [ecx + 3]
movzx esi, byte [ecx]
imul esi, edi
mov eax, 0x80808081
imul esi
add edx, esi
movzx esi, byte [ecx + 1]
sar edx, 7
imul esi, edi
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [ecx], al
mov eax, 0x80808081
imul esi
add edx, esi
movzx esi, byte [ecx + 2]
sar edx, 7
imul esi, edi
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [ecx + 1], al
mov eax, 0x80808081
imul esi
add edx, esi
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [ecx + 2], al
mov eax, dword [esp + 0x38]
inc ebx
add ecx, 4
cmp ebx, eax
jl 0x470b33
mov edi, dword [ebp + 8]
mov edx, dword [esp + 0x10]
inc edx
cmp edx, dword [esp + 0x3c]
mov dword [esp + 0x10], edx
jl 0x470b22
jmp 0x470cb3
mov eax, dword [0x4d1fbc]
cmp eax, esi
jne 0x470bea
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
push str.MiniUI.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.CreateMiniUIBitmap
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, esi
je 0x470be5
push 0x4d1fbc
call eax
mov eax, dword [0x4d1fbc]
mov ecx, dword [edi + 4]
cmp ecx, 0xffff
jae 0x470c91
cmp eax, esi
je 0x470cb3
cmp byte [edi + 0x17], 2
jne 0x470cb3
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
push ecx
movzx ecx, cx
mov eax, esp
mov dword [esp + 0x9c], esi
mov dword [esp + 0x14], esp
push ecx
mov dword [eax], ecx
mov eax, esp
lea esi, [esp + 0x1c]
mov dword [esp + 0x18], esp
mov dword [eax], 0x4b43f8
call fcn.00470a30
mov ebx, dword [esp + 0x14]
test al, al
je 0x470c84
mov edx, dword [esp + 0x18]
mov eax, dword [0x4ce640]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [0x4d1fbc]
mov edx, dword [ecx]
push 0
push esi
push eax
mov eax, dword [edx + 0x10]
push ecx
call eax
test eax, eax
jl 0x470c84
mov eax, dword [0x4d1fbc]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x20]
push eax
call edx
mov dword [edi + 8], eax
test ebx, ebx
je 0x470cb3
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x470cb3
cmp eax, esi
je 0x470cb3
mov edx, dword [eax]
push esi
push ecx
push eax
mov eax, dword [edx + 0xc]
call eax
test eax, eax
jl 0x470cb3
mov eax, dword [0x4d1fbc]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x20]
push eax
call edx
mov dword [edi + 8], eax
mov eax, dword [edi + 8]
xor ecx, ecx
cmp eax, ecx
jne 0x470ce3
xor eax, eax
mov word [edi + 0x14], ax
mov dword [edi + 0xc], ecx
mov dword [edi + 0x10], ecx
mov byte [edi + 0x16], al
mov ecx, dword [esp + 0x90]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea ecx, [esp + 0x1c]
push ecx
push 0x18
push eax
call dword [sym.imp.GDI32.dll_GetObjectW]
cmp word [esp + 0x2e], 0x20
mov eax, dword [esp + 0x20]
movzx ecx, word [edi + 0x14]
sete dl
cmp byte [edi + 0x18], 0
mov byte [edi + 0x16], dl
je 0x470d30
mov dword [edi + 0xc], eax
mov eax, dword [esp + 0x24]
cdq
idiv ecx
mov dword [edi + 0x10], eax
mov ecx, dword [esp + 0x90]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cdq
idiv ecx
mov edx, dword [esp + 0x24]
mov dword [edi + 0x10], edx
mov dword [edi + 0xc], eax
mov ecx, dword [esp + 0x90]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4