Function at 0x653a172b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x2c
push ebx
push ebp
push esi
xor esi, esi
push edi
xor edi, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x10], esi
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov ebp, dword [esp + 0x44]
mov ecx, eax
shr ecx, 0x10
test ecx, 0x8000000
jne 0x653a1763
xor edx, edx
mov dh, al
mov dl, ah
cmp edx, 0x334
jb 0x653a17ad
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
push esi
push 0xe
call ebx
push eax
push 0xd
call ebx
push eax
push 2
push ebp
call dword [sym.imp.USER32.dll_CopyImage]
test eax, eax
jne 0x653a19d6
push ebp
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x653a179c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 8
mov al, byte [ebx + 0x14]
cmp al, 1
mov byte [esp + 0x1c], al
jne 0x653a17be
cmp byte [ebx + 0x15], 1
jne 0x653a17be
push ebp
call dword [sym.imp.USER32.dll_CopyIcon]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 8
push 0
call dword [sym.imp.USER32.dll_GetDC]
test eax, eax
mov dword [esp + 0x44], eax
je 0x653a199c
mov ecx, dword [ebx + 0xc]
mov ebp, dword [ebx + 8]
push ecx
push ebp
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov edi, eax
test edi, edi
je 0x653a1998
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov al, byte [ebx + 0x15]
and ecx, 0xff
imul ebp, eax
mov eax, dword [ebx + 0xc]
add ebp, 0xf
sar ebp, 3
and ebp, 0xfffffffe
imul ebp, eax
imul ebp, ecx
mov ecx, dword [ebx + 0x10]
imul ecx, eax
lea edx, [ecx + ebx + 0x18]
push edx
push ebp
push edi
call dword [sym.imp.GDI32.dll_SetBitmapBits]
movzx ax, byte [ebx + 0x14]
movzx cx, byte [ebx + 0x15]
imul eax, ecx
cmp ax, 8
mov dword [esp + 0x14], eax
jbe 0x653a19e0
mov dword [esp + 0x14], 0x18
mov dword [esp + 0x18], 0
mov eax, dword [esp + 0x14]
mov ecx, dword [ebx + 8]
and eax, 0xffff
imul eax, ecx
add eax, 0x1f
mov ebp, dword [ebx + 0xc]
cdq
and edx, 0x1f
mov dword [esp + 0x1c], ecx
add eax, edx
mov edx, dword [esp + 0x18]
sar eax, 5
imul eax, ebp
lea eax, [edx + eax*4 + 0x28]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
mov dword [esp + 0x10], eax
je 0x653a1998
mov ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
mov ax, word [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov word [esi + 0xe], ax
xor eax, eax
lea ecx, [ecx + esi + 0x28]
push eax
push esi
push ecx
mov dword [esi + 4], edx
mov edx, dword [esp + 0x50]
push ebp
push eax
push edi
push edx
mov dword [esi], 0x28
mov dword [esi + 8], ebp
mov word [esi + 0xc], 1
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esp + 0x34], ecx
call dword [sym.imp.GDI32.dll_GetDIBits]
push edi
call dword [sym.imp.GDI32.dll_DeleteObject]
push 0
push 1
mov eax, dword [esp + 0x24]
push 1
push ebp
push eax
call dword [sym.imp.GDI32.dll_CreateBitmap]
mov edi, eax
test edi, edi
je 0x653a1998
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x44]
push 0
push esi
push ecx
push ebp
push 0
push edi
push edx
call dword [sym.imp.GDI32.dll_SetDIBits]
lea eax, [esp + 0x24]
push eax
push 0x18
push edi
call dword [sym.imp.GDI32.dll_GetObjectA]
mov esi, dword [esp + 0x2c]
imul esi, dword [esp + 0x30]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x20], esi
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0
push esi
mov esi, dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalReAlloc]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
mov edx, dword [esp + 0x20]
push esi
push edx
push edi
call dword [sym.imp.GDI32.dll_GetBitmapBits]
mov eax, ebp
add ebx, 0x18
mov ecx, dword [esp + 0x1c]
push esi
cdq
sub eax, edx
push ebx
push ebp
push ecx
sar eax, 1
push eax
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
push eax
mov eax, dword [esp + 0x58]
push eax
call dword [sym.imp.USER32.dll_CreateCursor]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x44]
test edi, edi
je 0x653a19ab
push edi
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [esp + 0x44]
test eax, eax
je 0x653a19b8
push eax
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
test esi, esi
mov esi, dword [esp + 0x10]
je 0x653a19c7
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
test esi, esi
je 0x653a19d2
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 8
mov edx, 1
mov cl, al
shl edx, cl
shl edx, 2
mov dword [esp + 0x18], edx
jmp 0x653a1851