Function at 0x1000e78e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x154
mov eax, 0x101cd2ba
call fcn.100998a8
mov dword [ebp - 0x128], ecx
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
push 0x3c8
xor edi, edi
push edi
push ebx
call fcn.10099920
add esp, 0xc
mov dword [ebp - 0x130], 1
mov dword [ebp - 0x120], edi
mov dword [ebp - 0x138], edi
mov dword [ebp - 4], edi
mov eax, dword [ebp - 0x128]
cmp dword [eax + 4], edi
je 0x1000e7ea
push 2
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x1000e84b
mov byte [ebp - 0x118], 0
push 0x103
push edi
lea eax, [ebp - 0x117]
push eax
call fcn.10099920
push 0x104
lea eax, [ebp - 0x118]
push eax
push 0xffffffffffffffff
push esi
call fcn.1001c4a2
add esp, 0x1c
test eax, eax
jne 0x1000e83b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x158], eax
push 0x10226d14
lea eax, [ebp - 0x158]
push eax
call fcn.1009bac7
push 2
push edi
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov dword [ebp - 0x120], eax
cmp eax, edi
jne 0x1000e86e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x13c], eax
push 0x10226d14
lea eax, [ebp - 0x13c]
jmp 0x1000e835
mov dword [ebp - 0x134], edi
lea eax, [ebp - 0x134]
push eax
push 0x1000ddda
push 1
push 0x10
push dword [ebp - 0x120]
call dword [sym.imp.KERNEL32.dll_EnumResourceLanguagesW]
push dword [ebp - 0x134]
push 1
push 0x10
push dword [ebp - 0x120]
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov esi, eax
cmp esi, edi
jne 0x1000e8ea
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x714
je 0x1000e8d6
cmp eax, 0x715
je 0x1000e8d6
mov dword [ebp - 0x144], eax
push 0x10226d14
lea eax, [ebp - 0x144]
jmp 0x1000e835
push dword [ebp - 0x120]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
inc eax
jmp 0x1000ec54
push esi
push dword [ebp - 0x120]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x124], eax
push esi
push dword [ebp - 0x120]
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x1000e92a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x154], eax
push 0x10226d14
lea eax, [ebp - 0x154]
jmp 0x1000e835
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
cmp esi, edi
jne 0x1000e953
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14c], eax
push 0x10226d14
lea eax, [ebp - 0x14c]
jmp 0x1000e835
mov eax, dword [ebp - 0x124]
lea edi, [esi + eax]
mov dword [ebp - 0x11c], edi
push edi
mov eax, esi
call fcn.1000de86
test eax, eax
jne 0x1000e985
or dword [ebp - 0x15c], 0xffffffff
push 0x10226d04
lea eax, [ebp - 0x15c]
jmp 0x1000e835
push edi
mov eax, esi
call fcn.1000de48
push 0xc
pop ecx
cmp cx, word [esi + 2]
ja 0x1000e99b
mov ecx, dword [eax + 8]
mov dword [ebx], ecx
push 0x10
pop ecx
cmp cx, word [esi + 2]
ja 0x1000e9aa
mov eax, dword [eax + 0xc]
mov dword [ebx + 4], eax
push edi
call fcn.1000de6a
mov esi, eax
push edi
mov ecx, esi
call fcn.1000deec
test eax, eax
jne 0x1000e9d5
or dword [ebp - 0x140], 0xffffffff
push 0x10226d04
lea eax, [ebp - 0x140]
jmp 0x1000e835
push 0x101ea448
mov eax, esi
call fcn.1000dec6
push eax
call fcn.1009a0c9
pop ecx
pop ecx
test eax, eax
jne 0x1000ec20
push dword [ebp - 0x11c]
mov eax, esi
call fcn.1000deca
mov edi, eax
push dword [ebp - 0x11c]
mov ecx, edi
call fcn.1000df50
test eax, eax
jne 0x1000ea28
or dword [ebp - 0x148], 0xffffffff
push 0x10226d04
lea eax, [ebp - 0x148]
jmp 0x1000e835
push dword [ebp - 0x11c]
mov eax, edi
call fcn.1000df2e
mov esi, eax
push dword [ebp - 0x11c]
mov ecx, esi
call fcn.1000dfe0
test eax, eax
jne 0x1000ea5f
or dword [ebp - 0x150], 0xffffffff
push 0x10226d04
lea eax, [ebp - 0x150]
jmp 0x1000e835
movzx eax, word [edi]
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
jle 0x1000ec20
push dword [ebp - 0x11c]
mov ecx, esi
call fcn.1000dfe0
test eax, eax
je 0x1000ec20
push dword [ebp - 0x11c]
call fcn.1000dfb4
movzx edi, ax
mov eax, esi
call fcn.1000df8e
mov dword [ebp - 0x124], eax
push 0x101ea430
push eax
call fcn.1009a0c9
pop ecx
pop ecx
test eax, eax
jne 0x1000eadc
test edi, edi
jbe 0x1000eadc
cmp edi, 0x50
jb 0x1000eac2
push 0x4f
pop edi
push edi
push dword [ebp - 0x11c]
mov eax, esi
call fcn.1000df92
push eax
lea eax, [ebx + 0x288]
jmp 0x1000ebfa
push 0x101ea410
push dword [ebp - 0x124]
call fcn.1009a0c9
pop ecx
pop ecx
test eax, eax
jne 0x1000eb15
test edi, edi
jbe 0x1000eb15
cmp edi, 0x50
jb 0x1000eafe
push 0x4f
pop edi
push edi
push dword [ebp - 0x11c]
mov eax, esi
call fcn.1000df92
push eax
lea eax, [ebx + 8]
jmp 0x1000ebfa
push 0x101ea3f4
push dword [ebp - 0x124]
call fcn.1009a0c9
pop ecx
pop ecx
test eax, eax
jne 0x1000eb51
test edi, edi
jbe 0x1000eb51
cmp edi, 0x50
jb 0x1000eb37
push 0x4f
pop edi
push edi
push dword [ebp - 0x11c]
mov eax, esi
call fcn.1000df92
push eax
lea eax, [ebx + 0x148]
jmp 0x1000ebfa
push 0x101ea3d4
push dword [ebp - 0x124]
call fcn.1009a0c9
pop ecx
pop ecx
test eax, eax
jne 0x1000eb8a
test edi, edi
jbe 0x1000eb8a
cmp edi, 0x50
jb 0x1000eb73
push 0x4f
pop edi
push edi
push dword [ebp - 0x11c]
mov eax, esi
call fcn.1000df92
push eax
lea eax, [ebx + 0x328]
jmp 0x1000ebfa
push 0x101ea3b0
push dword [ebp - 0x124]
call fcn.1009a0c9
pop ecx
pop ecx
test eax, eax
jne 0x1000ebc3
test edi, edi
jbe 0x1000ebc3
cmp edi, 0x50
jb 0x1000ebac
push 0x4f
pop edi
push edi
push dword [ebp - 0x11c]
mov eax, esi
call fcn.1000df92
push eax
lea eax, [ebx + 0xa8]
jmp 0x1000ebfa
push 0x101ea398
push dword [ebp - 0x124]
call fcn.1009a0c9
pop ecx
pop ecx
test eax, eax
jne 0x1000ec03
test edi, edi
jbe 0x1000ec03
cmp edi, 0x50
jb 0x1000ebe5
push 0x4f
pop edi
push edi
push dword [ebp - 0x11c]
mov eax, esi
call fcn.1000df92
push eax
lea eax, [ebx + 0x1e8]
push eax
call fcn.10099ebc
add esp, 0xc
movzx eax, word [esi]
add eax, 3
and eax, 0xfffffffc
sub dword [ebp - 0x12c], eax
mov eax, esi
call fcn.1000dfd5
mov esi, eax
jmp 0x1000ea68
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x138], 0
je 0x1000ec39
push dword [ebp - 0x138]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [ebp - 0x120], 0
je 0x1000ec4e
push dword [ebp - 0x120]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x130]
call fcn.10099904
ret 8