Function at 0x402fe0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x42bb57
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x388
mov eax, dword [0x43a15c]
mov edx, dword [0x42e254]
xor eax, ebp
mov dword [esp + 0x380], eax
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [esp + 0x135], eax
push esi
mov esi, ecx
mov ecx, dword [str.WaTeRbOxR5]
mov dword [esp + 0x13d], eax
mov dword [esp + 0x141], eax
mov dword [esp + 0x138], ecx
mov cl, byte [0x42e25a]
push edi
xor edi, edi
mov byte [esp + 0x146], cl
mov ecx, dword [esi + 0x9d08]
cmp ecx, edi
mov dword [esp + 0x149], eax
mov ax, word [0x42e258]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x140], edx
mov word [esp + 0x144], ax
je 0x4034e1
lea edx, [esp + 0x13c]
push edx
call fcn.004040c0
test eax, eax
je 0x4034e1
push edi
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [esi + 0x9d08]
push 0x4e20
call fcn.00404670
test eax, eax
jne 0x4032bb
cmp dword [esp + 0x18], edi
je 0x4032f4
cmp dword [esp + 0x1c], edi
jne 0x4032f4
push edi
lea ecx, [esp + 0x9c]
call fcn.00401840
xor edx, edx
mov dword [esp + 0x162], edx
mov word [esp + 0x178], di
mov dword [esp + 0x166], edx
xor eax, eax
mov dword [esp + 0x16a], edx
mov ecx, 0x82
lea edi, [esp + 0x17a]
rep stosd dword es:[edi], eax
push str.RT_PACKETTYPE
xor edi, edi
mov dword [esp + 0x172], edx
mov dword [esp + 0x156], eax
push 0x4e1f
mov dword [esp + 0x17a], edx
mov dword [esp + 0x15e], eax
mov ebx, 2
push edi
mov dword [esp + 0x3a8], ebx
mov word [esp + 0x16c], di
mov word [esp + 0x182], dx
mov word [esp + 0x15c], di
mov dword [esp + 0x166], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
cmp eax, edi
jne 0x40318a
mov dword [esp + 0x39c], 0xffffffff
lea ecx, [esp + 0x98]
call fcn.00401570
xor eax, eax
jmp 0x403484
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
je 0x40316c
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
lea ecx, [esp + 0x150]
push ecx
lea edx, [esp + 0x164]
push edx
lea ecx, [esp + 0x180]
push ecx
push str._s_r_s_r_s
push eax
call fcn.00410e37
add esp, 0x14
push edi
lea edx, [esp + 0x154]
push edx
lea eax, [esp + 0x168]
push eax
lea ecx, [esp + 0xa4]
call fcn.004012d0
lea ecx, [esp + 0x98]
call fcn.0041f082
cmp eax, 1
jne 0x40316c
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x9c]
call fcn.00401770
lea edi, [esi + 0x9d04]
push eax
mov ecx, edi
mov byte [esp + 0x3a0], 3
call fcn.00402fc0
lea ecx, [esp + 0x14]
mov byte [esp + 0x39c], bl
call fcn.00401420
mov ebx, dword [edi]
xor edx, edx
mov dword [esp + 0x13c], edx
mov dword [esp + 0x140], edx
mov dword [esp + 0x144], edx
mov dword [esp + 0x148], edx
push edx
push edx
push 0x10
lea eax, [esp + 0x148]
push eax
push ebx
mov byte [esp + 0x160], dl
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [esp + 0x13c]
push ecx
mov ecx, dword [esi + 0x9d08]
mov byte [esp + eax + 0x140], 0
call fcn.004040c0
test eax, eax
lea ecx, [esp + 0x98]
mov dword [esp + 0x39c], 0xffffffff
je 0x40317e
call fcn.00401570
mov ebx, dword [esp + 0x10]
xor edi, edi
mov ecx, dword [esi + 0x9d08]
push edi
push edi
lea eax, [esp + 0x20]
push eax
push 0x4e20
call fcn.00404670
test eax, eax
mov ecx, esi
jne 0x4033ea
push 0x30
push 0x42e218
push 0x42e200
call fcn.00420ae5
xor eax, eax
jmp 0x403484
push edi
lea ecx, [esp + 0x24]
call fcn.00401f10
lea ecx, [esp + 0x20]
mov dword [esp + 0x39c], edi
call fcn.0041f082
cmp eax, 1
lea ecx, [esp + 0x20]
jne 0x4033d3
lea edx, [esp + 0x14]
push edx
call fcn.00401de0
lea edi, [esi + 0x9d04]
push eax
mov ecx, edi
mov byte [esp + 0x3a0], 1
call fcn.00402f50
lea ecx, [esp + 0x14]
mov byte [esp + 0x39c], 0
call fcn.00401420
mov ebx, dword [edi]
xor eax, eax
mov dword [esp + 0x13c], eax
mov dword [esp + 0x140], eax
mov dword [esp + 0x144], eax
mov dword [esp + 0x148], eax
push eax
push eax
push 0x10
lea ecx, [esp + 0x148]
push ecx
push ebx
mov byte [esp + 0x160], al
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [esi + 0x9d08]
lea edx, [esp + 0x13c]
push edx
mov byte [esp + eax + 0x140], 0
call fcn.004040c0
test eax, eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x39c], 0xffffffff
je 0x4033de
call fcn.00401fb0
jmp 0x4032b5
mov dword [esp + 0x39c], 0xffffffff
call fcn.00401fb0
xor eax, eax
jmp 0x403484
push 6
call fcn.0041f4f5
mov ecx, dword [esi + 0x9d08]
push edi
push ebx
push 0x5208
call fcn.00404f40
push 0xa
mov ecx, esi
mov edi, eax
call fcn.0041f4f5
call fcn.004233ae
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x10], eax
cmp edi, 5
mov dword [esp + 0x39c], 4
ja case.0x403431.5
jmp dword [edi*4 + 0x4034e8]
test ebx, ebx
je 0x403451
push ebx
lea eax, [esp + 0x14]
push 0x42e1e4
push eax
call fcn.00402f30
add esp, 0xc
jmp 0x403463
lea ecx, [esp + 0x10]
push 0x42e1c4
push ecx
call fcn.00402f30
add esp, 8
mov edx, dword [esp + 0x10]
push 0x40
push 0x42e218
push edx
mov ecx, esi
call fcn.00420ae5
lea ecx, [esp + 0x10]
call fcn.00401420
mov eax, 1
mov ecx, dword [esp + 0x394]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x38c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004100eb
mov esp, ebp
pop ebp
ret 4
push 0x10
push 0x42e218
push str.gL
jmp 0x4034d1
push 0x10
push 0x42e218
push 0x42e194
jmp 0x4034d1
push 0x10
push 0x42e218
push 0x42e098
mov ecx, esi
call fcn.00420ae5
lea ecx, [esp + 0x10]
call fcn.00401420
xor eax, eax
jmp 0x403484