Function at 0x409c6b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xd8
mov eax, 0x4337ae
call fcn.004150b9
mov ebx, edx
mov dword [ebp - 0xbc], ebx
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x9c], eax
test eax, eax
je 0x409c9e
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov eax, dword [ebp - 0x9c]
and dword [ebp - 4], 0
test eax, eax
je 0x40a68f
mov ecx, dword [eax]
push eax
call dword [ecx + 0x28]
mov edi, eax
test edi, edi
jns 0x409da5
push str._could_not_be_started.
lea ecx, [ebp - 0xa8]
call fcn.00403276
push 4
lea eax, [ebp - 0xa0]
mov byte [ebp - 4], 1
push eax
lea ecx, [esi + 4]
call fcn.00406f36
push eax
mov edx, str.The_CLR
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xa4]
call fcn.00406d44
pop ecx
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 3
push ecx
lea ecx, [ebp - 0xb4]
push ecx
mov ecx, eax
call fcn.00402fba
mov byte [ebp - 4], 4
mov esi, dword [eax]
test esi, esi
je 0x409d1c
mov esi, dword [esi]
jmp 0x409d1e
xor esi, esi
push ecx
lea eax, [ebp - 0x9c]
mov ecx, esp
push eax
call fcn.0040e7af
mov edx, esi
mov ecx, edi
call fcn.0040bd0f
pop ecx
mov ecx, dword [ebp - 0xb4]
mov esi, eax
test ecx, ecx
je 0x409d4f
call fcn.004031e4
and dword [ebp - 0xb4], 0
mov ecx, dword [ebp - 0xa4]
test ecx, ecx
je 0x409d65
call fcn.004031e4
and dword [ebp - 0xa4], 0
mov ecx, dword [ebp - 0xa0]
test ecx, ecx
je 0x409d7b
call fcn.004031e4
and dword [ebp - 0xa0], 0
mov ecx, dword [ebp - 0xa8]
test ecx, ecx
je 0x409d8a
call fcn.004031e4
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x9c]
test ecx, ecx
je 0x409d9e
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
mov eax, esi
jmp 0x40a689
lea eax, [ebp - 0x9c]
mov dword [ebp - 0x80], vtable.std::_Func_impl_no_alloc_class__lambda_551145e8430a79c5f900a93531049c0f___void___.0
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x80]
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x58]
xor edi, edi
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0x34], edi
push eax
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 6
call fcn.0040f0d9
mov dword [ebp - 0x34], eax
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x5c]
test ecx, ecx
je 0x409df8
mov edx, dword [ecx]
lea eax, [ebp - 0x80]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0xb0], edi
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0x9c]
test eax, eax
je 0x40a68f
mov dword [ebp - 0xb0], edi
lea edx, [ebp - 0xb0]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x34]
mov edi, eax
test edi, edi
jns 0x409e68
push ecx
lea eax, [ebp - 0x9c]
mov ecx, esp
push eax
call fcn.0040e7af
mov edx, str.Could_not_get_the_default_application_domain.
mov ecx, edi
call fcn.0040bd0f
mov esi, eax
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0xb0]
pop ecx
test eax, eax
je 0x409e5b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [ebp - 0x58]
call fcn.00401100
jmp 0x409d8a
lea eax, [ebp - 0xb0]
push eax
lea ecx, [ebp - 0xac]
call fcn.00406604
lea eax, [esi + 4]
mov byte [ebp - 4], 0xb
cmp dword [eax], 4
mov dword [ebp - 0xcc], eax
jl 0x40a06d
sub esp, 0x10
mov ecx, ebx
mov eax, esp
and dword [eax + 8], 0
and dword [eax + 0xc], 0
mov dword [eax], 4
mov dword [eax + 4], 5
call fcn.00407070
test al, al
je 0x40a06d
lea ecx, [ebp - 0x24]
call fcn.004077c1
mov esi, ebx
lea edi, [ebp - 0xe0]
sub esp, 0x10
lea ecx, [ebp - 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, esp
lea esi, [ebp - 0xe0]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.00407070
test al, al
jne 0x409ffa
push str._is_not_installed.
lea ecx, [ebp - 0xa8]
call fcn.00403276
lea eax, [ebp - 0xa0]
mov byte [ebp - 4], 0xc
push eax
mov ecx, ebx
call fcn.004071ce
push eax
mov edx, str..NET_Framework
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xa4]
call fcn.00406d44
pop ecx
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 0xe
push ecx
lea ecx, [ebp - 0xb4]
push ecx
mov ecx, eax
call fcn.00402fba
mov edx, dword [ebp - 0xcc]
push ecx
push eax
mov ecx, ebx
mov byte [ebp - 4], 0xf
call fcn.0040b518
pop ecx
pop ecx
mov ecx, dword [ebp - 0xb4]
mov esi, eax
test ecx, ecx
je 0x409f6a
call fcn.004031e4
and dword [ebp - 0xb4], 0
mov ecx, dword [ebp - 0xa4]
test ecx, ecx
je 0x409f80
call fcn.004031e4
and dword [ebp - 0xa4], 0
mov ecx, dword [ebp - 0xa0]
test ecx, ecx
je 0x409f96
call fcn.004031e4
and dword [ebp - 0xa0], 0
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0xa8]
test ecx, ecx
je 0x409fa9
call fcn.004031e4
test esi, esi
jns 0x409ffa
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0xac]
test eax, eax
je 0x409fc1
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0xb0]
test eax, eax
je 0x409fd5
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [ebp - 0x58]
call fcn.00401100
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x9c]
test eax, eax
je 0x409d9e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x409d9e
push 0xa
push 0x309
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x40a05e
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40a05e
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x40a05e
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x40a05e
lea ecx, [ebp - 0xac]
call fcn.0040ac85
mov byte [ebp - 4], 0xa
mov esi, eax
mov ecx, dword [ebp - 0xac]
test ecx, ecx
je 0x409fc1
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
jmp 0x409fc1
mov edx, str.Loading
mov ecx, str.This_native_launcher_executable_has_not_been_assembled_correctly_and_cannot_perform_the_native_to_managed_transition_because_the_managed_core_resource_has_not_been_assembled_with_the_launcher._Would_fall_back_to_running_natively__but_this_would_not_support_all_of_the_features.
call fcn.0041115d
xor esi, esi
mov dword [ebp - 0xb4], esi
mov byte [ebp - 4], 0x28
call fcn.00405e68
push eax
lea ecx, [ebp - 0xdc]
call fcn.0040c197
push str.AppDomainBaseDir
push ecx
lea eax, [ebp - 0xa8]
mov byte [ebp - 4], 0x29
push eax
lea ecx, [ebp - 0xdc]
call fcn.004012b6
mov byte [ebp - 4], 0x2a
mov edi, dword [ebp - 0xa8]
mov ebx, dword [sym.imp.OLEAUT32.dll_VariantInit]
test edi, edi
je 0x40a0c4
cmp dword [edi], esi
je 0x40a0c4
push dword [edi]
call ebx
jmp 0x40a0c6
xor eax, eax
test eax, eax
je 0x40a0f1
lea eax, [ebp - 0xa8]
push eax
lea ecx, [ebp - 0xb4]
call fcn.00406dcc
mov esi, dword [ebp - 0xb4]
test esi, esi
je 0x40a0f1
cmp dword [esi], 0
je 0x40a0f1
push dword [esi]
call ebx
jmp 0x40a0f3
xor eax, eax
test eax, eax
jne 0x40a1fc
push str.AssemblyFile
push ecx
lea eax, [ebp - 0xa4]
push eax
lea ecx, [ebp - 0xdc]
call fcn.004012b6
mov byte [ebp - 4], 0x2b
mov eax, dword [ebp - 0xa4]
test eax, eax
je 0x40a134
mov ecx, dword [eax]
test ecx, ecx
je 0x40a134
push ecx
call ebx
mov ecx, eax
mov eax, dword [ebp - 0xa4]
jmp 0x40a136
xor ecx, ecx
test ecx, ecx
je 0x40a1e9
test eax, eax
je 0x40a146
mov eax, dword [eax]
jmp 0x40a148
xor eax, eax
push eax
lea ecx, [ebp - 0x2c]
call fcn.004027e8
push 0x4443c0
mov byte [ebp - 4], 0x2c
call fcn.0041e0a7
cmp dword [ebp - 0x18], 8
mov edx, dword [ebp - 0x1c]
pop ecx
push dword [ebp - 0xbc]
lea ecx, [ebp - 0x2c]
cmovae ecx, dword [ebp - 0x2c]
push eax
push ecx
push ecx
call fcn.0040e99d
add esp, 0x10
cmp eax, 0xffffffff
je 0x40a1e1
push eax
push 0
lea eax, [ebp - 0x98]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040267a
mov byte [ebp - 4], 0x2d
cmp dword [eax + 0x14], 8
jb 0x40a1a2
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0xa0]
call fcn.00403276
push eax
lea ecx, [ebp - 0xb4]
call fcn.00406dcc
mov ecx, dword [ebp - 0xa0]
test ecx, ecx
je 0x40a1d0
call fcn.004031e4
and dword [ebp - 0xa0], 0
lea ecx, [ebp - 0x98]
call fcn.00402f5c
mov esi, dword [ebp - 0xb4]
lea ecx, [ebp - 0x2c]
call fcn.00402f5c
mov byte [ebp - 4], 0x2a
mov ecx, dword [ebp - 0xa4]
test ecx, ecx
je 0x40a1fc
call fcn.004031e4
test esi, esi
je 0x40a20b
cmp dword [esi], 0
je 0x40a20b
push dword [esi]
call ebx
jmp 0x40a20d
xor eax, eax
test eax, eax
je 0x40a552
and dword [ebp - 0xb8], 0
mov byte [ebp - 4], 0x2e
mov eax, dword [ebp - 0x9c]
test eax, eax
je 0x40a68f
and dword [ebp - 0xb8], 0
lea edx, [ebp - 0xb8]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x48]
mov ebx, eax
test ebx, ebx
jns 0x40a2ea
push ecx
lea eax, [ebp - 0x9c]
mov ecx, esp
push eax
call fcn.0040e7af
mov edx, str.Could_not_create_the_appdomain_setup_object.
mov ecx, ebx
call fcn.0040bd0f
mov ebx, eax
mov byte [ebp - 4], 0x2a
mov eax, dword [ebp - 0xb8]
pop ecx
test eax, eax
je 0x40a27e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
test edi, edi
je 0x40a289
mov ecx, edi
call fcn.004031e4
lea ecx, [ebp - 0xdc]
call fcn.00406439
test esi, esi
je 0x40a29f
mov ecx, esi
call fcn.004031e4
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0xac]
test eax, eax
je 0x40a2b3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0xb0]
test eax, eax
je 0x40a2c7
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [ebp - 0x58]
call fcn.00401100
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x9c]
test ecx, ecx
je 0x40a2e3
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
mov eax, ebx
jmp 0x40a689
lea eax, [ebp - 0xb8]
push eax
lea ecx, [ebp - 0xc8]
call fcn.0040e8a9
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov dword [ebp - 0xc4], esi
test esi, esi
je 0x40a312
lea eax, [esi + 8]
push eax
call ebx
mov byte [ebp - 4], 0x30
mov edi, dword [ebp - 0xc8]
test edi, edi
je 0x40a68f
mov byte [ebp - 4], 0x31
test esi, esi
je 0x40a330
mov ecx, dword [esi]
jmp 0x40a332
xor ecx, ecx
mov eax, dword [edi]
push ecx
push edi
call dword [eax + 0x10]
test eax, eax
jns 0x40a349
push 0x44548c
push edi
push eax
call fcn.00414450
test esi, esi
je 0x40a354
mov ecx, esi
call fcn.004031e4
mov eax, dword [0x44f3e8]
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc0], eax
test eax, eax
je 0x40a375
add eax, 8
push eax
call ebx
mov eax, dword [ebp - 0xc4]
mov byte [ebp - 4], 0x33
test eax, eax
je 0x40a381
mov ecx, dword [eax]
jmp 0x40a383
xor ecx, ecx
mov eax, dword [edi]
push ecx
push edi
call dword [eax + 0x18]
test eax, eax
jns 0x40a39a
push 0x44548c
push edi
push eax
call fcn.00414450
mov ecx, dword [ebp - 0xc4]
test ecx, ecx
je 0x40a3a9
call fcn.004031e4
and dword [ebp - 0xa0], 0
mov byte [ebp - 4], 0x34
mov eax, dword [ebp - 0xac]
test eax, eax
je 0x40a68f
and dword [ebp - 0xa0], 0
lea edx, [ebp - 0xa0]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x34]
mov ebx, eax
test ebx, ebx
jns 0x40a464
push ecx
lea eax, [ebp - 0xac]
mov ecx, esp
push eax
call fcn.0040e7af
mov edx, str.Could_not_get_the_evidence_from_the_default_appdomain.
mov ecx, ebx
call fcn.0040bd0f
pop ecx
mov ebx, eax
mov byte [ebp - 4], 0x2f
mov eax, dword [ebp - 0xa0]
test eax, eax
je 0x40a412
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x2e
mov eax, dword [edi]
push edi
call dword [eax + 8]
mov byte [ebp - 4], 0x2a
mov eax, dword [ebp - 0xb8]
test eax, eax
je 0x40a430
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0xa8]
test ecx, ecx
je 0x40a43f
call fcn.004031e4
lea ecx, [ebp - 0xdc]
call fcn.00406439
test esi, esi
je 0x40a455
mov ecx, esi
call fcn.004031e4
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0xac]
jmp 0x40a2ad
and dword [ebp - 0xa4], 0
mov byte [ebp - 4], 0x35
mov eax, dword [ebp - 0x9c]
test eax, eax
je 0x40a68f
and dword [ebp - 0xa4], 0
lea edx, [ebp - 0xa4]
mov ecx, dword [eax]
push edx
push dword [ebp - 0xa0]
push edi
push str.Entryway
push eax
call dword [ecx + 0x44]
mov ebx, eax
push ecx
mov ecx, esp
test ebx, ebx
jns 0x40a4de
lea eax, [ebp - 0x9c]
push eax
call fcn.0040e7af
mov edx, str.Could_not_create_the_primary_appdomain.
mov ecx, ebx
call fcn.0040bd0f
mov ebx, eax
mov byte [ebp - 4], 0x34
mov eax, dword [ebp - 0xa4]
pop ecx
test eax, eax
je 0x40a3fe
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x40a3fe
mov eax, dword [ebp - 0xa4]
mov dword [ecx], eax
test eax, eax
je 0x40a4f0
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
lea ecx, [ebp - 0xac]
call fcn.004067fe
test eax, eax
jns 0x40a50c
cmp eax, 0x80004002
je 0x40a50c
push eax
jmp 0x40a694
mov byte [ebp - 4], 0x34
mov eax, dword [ebp - 0xa4]
test eax, eax
je 0x40a520
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x2f
mov eax, dword [ebp - 0xa0]
test eax, eax
je 0x40a534
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x2e
mov eax, dword [edi]
push edi
call dword [eax + 8]
mov byte [ebp - 4], 0x2a
mov eax, dword [ebp - 0xb8]
test eax, eax
je 0x40a552
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [ebp - 0xcc]
mov edi, dword [ebp - 0xac]
push ecx
mov eax, esp
mov dword [eax], edi
test edi, edi
je 0x40a56d
mov eax, dword [edi]
push edi
call dword [eax + 4]
mov edx, dword [ebp - 0xbc]
call fcn.0040aed7
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
jns 0x40a5bc
mov ecx, dword [ebp - 0xa8]
test ecx, ecx
je 0x40a58f
call fcn.004031e4
lea ecx, [ebp - 0xdc]
call fcn.00406439
test esi, esi
je 0x40a5a5
mov ecx, esi
call fcn.004031e4
mov byte [ebp - 4], 0xa
test edi, edi
je 0x40a2b3
mov eax, dword [edi]
push edi
call dword [eax + 8]
jmp 0x40a2b3
lea ecx, [ebp - 0xac]
call fcn.0040ab46
mov byte [ebp - 4], 0x36
push ecx
mov eax, esp
mov dword [eax], edi
test edi, edi
je 0x40a5da
mov eax, dword [edi]
push edi
call dword [eax + 4]
call fcn.0040a69a
pop ecx
mov ebx, eax
mov dword [ebp - 4], 0x2a
jmp 0x40a580
call fcn.00415006
ret
push 0x80004003
call fcn.00414430
int3