Function at 0x41a670
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x10
push 1
push 0
mov dword [ebp - 0x10], ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x41a8ac
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41a8ac
push ebx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edx, eax
test edx, edx
je 0x41a841
lea ecx, [edx + 6]
lea esi, [ecx + 2]
jmp 0x41a6c0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41a6c0
movzx eax, word [edx + 2]
sub ecx, esi
sar ecx, 1
add eax, 3
and eax, 0xfffffffc
add eax, edx
lea edi, [ecx*2 + 0xb]
and edi, 0xfffffffc
add edi, eax
movzx eax, word [edx]
add eax, edx
mov dword [ebp - 4], edi
mov dword [ebp - 0xc], eax
cmp edi, eax
jae 0x41a841
lea ebx, [ebx]
lea ecx, [edi + 6]
mov edx, 0x4566cc
mov eax, ecx
lea ebx, [ebx]
mov si, word [eax]
cmp si, word [edx]
jne 0x41a736
test si, si
je 0x41a732
mov si, word [eax + 2]
cmp si, word [edx + 2]
jne 0x41a736
add eax, 4
add edx, 4
test si, si
jne 0x41a710
xor eax, eax
jmp 0x41a73b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x41a82a
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41a746
movzx eax, word [edi]
sub ecx, edx
sar ecx, 1
add eax, edi
mov dword [ebp - 8], eax
lea ebx, [ecx*2 + 0xb]
and ebx, 0xfffffffc
add ebx, edi
cmp ebx, eax
jae 0x41a82a
lea ecx, [ebx + 6]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41a777
movzx eax, word [ebx]
sub ecx, edx
sar ecx, 1
add eax, ebx
lea esi, [ecx*2 + 0xb]
and esi, 0xfffffffc
add esi, ebx
cmp esi, eax
jae 0x41a813
jmp 0x41a7a0
lea ecx, [esi + 6]
mov edx, ecx
lea edi, [edx + 2]
jmp 0x41a7b0
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x41a7b0
sub edx, edi
mov eax, 0x4566ec
sar edx, 1
lea edi, [edx*2 + 0xb]
and edi, 0xfffffffc
add edi, esi
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x41a7f6
test dx, dx
je 0x41a7f2
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x41a7f6
add ecx, 4
add eax, 4
test dx, dx
jne 0x41a7d0
xor eax, eax
jmp 0x41a7fb
sbb eax, eax
or eax, 1
test eax, eax
je 0x41a856
movzx eax, word [esi]
add eax, 3
and eax, 0xfffffffc
add esi, eax
movzx eax, word [ebx]
add eax, ebx
cmp esi, eax
jb 0x41a7a0
movzx eax, word [ebx]
add eax, 3
and eax, 0xfffffffc
add ebx, eax
cmp ebx, dword [ebp - 8]
jb 0x41a771
mov edi, dword [ebp - 4]
movzx eax, word [edi]
add eax, 3
and eax, 0xfffffffc
add edi, eax
mov dword [ebp - 4], edi
cmp edi, dword [ebp - 0xc]
jb 0x41a700
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
pop esi
mov eax, 0x8000004c
pop ebx
mov esp, ebp
pop ebp
ret
xor esi, esi
test edi, edi
je 0x41a86d
mov eax, edi
cmp word [edi], si
je 0x41a86d
lea eax, [eax + 2]
inc esi
cmp word [eax], 0
jne 0x41a863
mov ebx, dword [ebp - 0x10]
mov ecx, dword [ebx + 4]
cmp esi, ecx
jbe 0x41a88a
push ecx
push 0
mov eax, esi
sub eax, ecx
mov ecx, ebx
push eax
push 0
call fcn.0040eabb
jmp 0x41a88d
mov dword [ebx + 4], esi
add esi, esi
push esi
push edi
push dword [ebx]
call fcn.00420dd0
mov eax, dword [ebx]
add esp, 0xc
xor ecx, ecx
pop edi
mov word [esi + eax], cx
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x8000004c
mov esp, ebp
pop ebp
ret