Function at 0x401677
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov dword [edx + 0x10], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x4c], 0x703666d0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.dbghelp.dll_ImageNtHeader]
mov edx, dword [ebp - 4]
mov dword [edx + 0x26c], eax
add byte [ebx - 0x7f3803bb], cl
les eax, [ebx]
add byte [eax], al
add byte [eax], al
add byte [eax], al
mov eax, dword [ebp - 4]
mov ecx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [eax + 0x3cc], ecx
jmp 0x4016dd
mov eax, dword [ebp - 4]
mov ecx, dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [eax + 0x5c], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
inc eax
add byte [ebx + 0x4189fc4d], cl
or byte [ebx + 0x488bfc45], cl
adc byte [ecx - 0x75], dl
push ebp
cld
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
insb byte es:[edi], dx
add byte [eax], 0x8b
dec ebp
cld
mov dword [ecx + 0x58], eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x3bc], 0
mov eax, dword [ebp - 4]
mov ecx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [eax + 0x60], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x58]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edx, dword [ebp - 4]
mov dword [edx + 0x290], eax
push 4
push 0x1000
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, dword [ebp - 4]
mov dword [edx + 0x20], eax
inc edx
and byte [ebx + 0x7883fc45], cl
and byte [eax], al
je 0x40197e
mov eax, dword [ebp - 4]
mov dword [eax + 0x3c0], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0x28c], 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, dword [eax + 0x28c]
cmp edx, dword [ecx + 8]
jae 0x4018fc
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x4017d1
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
add ecx, 1
mov edx, dword [ebp - 4]
mov dword [edx], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x28c]
add ecx, 1
mov edx, dword [ebp - 4]
mov dword [edx + 0x28c], ecx
mov eax, dword [ebp - 4]
cmp dword [eax], 4
jae 0x401835
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, dword [eax + 0x28c]
cmp edx, dword [ecx + 8]
jae 0x401835
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x290]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x28c]
movzx ecx, byte [ecx + eax]
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov edx, dword [ebp - 4]
movzx eax, byte [edx + eax + 0x4c]
xor ecx, eax
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x20]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x28c]
mov byte [eax + edx], cl
mov eax, dword [ebp - 4]
cmp dword [eax + 0x28c], 2
jne 0x401830
push dword [ebp - 4]
jmp 0x4017af
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x401862
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
add ecx, 1
mov edx, dword [ebp - 4]
mov dword [edx], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x28c]
add ecx, 1
mov edx, dword [ebp - 4]
mov dword [edx + 0x28c], ecx
mov eax, dword [ebp - 4]
cmp dword [eax], 4
jae 0x4018b7
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, dword [eax + 0x28c]
cmp edx, dword [ecx + 8]
jae 0x4018b7
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x290]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x28c]
movzx ecx, byte [ecx + eax]
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov edx, dword [ebp - 4]
movzx eax, byte [edx + eax + 0x3c8]
xor ecx, eax
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x20]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x28c]
mov byte [eax + edx], cl
jmp 0x401840
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
add ecx, 0x64
mov edx, dword [ebp - 4]
cmp dword [edx + 0x28c], ecx
jne 0x4018f7
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
mov eax, dword [ebp - 4]
push eax
call dword [0x400000]
push 0x8000
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x40178f
push 0x1c
mov eax, dword [ebp - 4]
add eax, 0x270
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov ecx, dword [ebp - 4]
mov eax, 0x1b6b
push esi
call fcn.004034df
push esi
call fcn.004032cd
push esi
call fcn.00401b93
push esi
call fcn.00402ca1
push fcn.0040192d
call fcn.00402314
add esp, 0x24
mov dword [fcn.0040192d], eax
pop esi
ret