Function at 0x401394
Capabilities:
Extract resource via kernel32 functions
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov esi, dword [esp + 0x8c]
and esi, 0xffff0000
mov eax, esi
cmp word [eax], 0x5a4d
jne 0x4013b3
add eax, dword [eax + 0x3c]
sub esi, 0x10000
cmp word [eax], 0x4550
jne 0x4013a7
add esi, 0x10000
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
mov eax, 0x403030
pop dword [eax]
push eax
call fcn.00401268
mov dword [0x40302c], eax
push 0x403015
push 0x3e8
push 0
call sub.kernel32.dll_FindResourceA
or eax, eax
jne 0x4013f8
leave
ret 8
push eax
push eax
push 0
call sub.kernel32.dll_SizeofResource
or eax, eax
jne 0x401409
leave
ret 8
mov dword [ebp - 8], eax
pop eax
push eax
push 0
call sub.kernel32.dll_LoadResource
or eax, eax
jne 0x40141d
leave
ret 8
push eax
call sub.kernel32.dll_LockResource
or eax, eax
jne 0x40142b
leave
ret 8
mov dword [ebp - 0xc], eax
push 4
push 0x3000
push dword [ebp - 8]
push 0
mov eax, dword [ebp + 0xc]
add eax, dword [eax + 0x3c]
add eax, 0x14
add eax, 4
mov eax, dword [eax + 0x18]
add eax, str.VirtualAlloc
sub eax, 0x2000
add eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
add eax, dword [eax + 0x3c]
add eax, 0x14
add eax, 4
mov eax, dword [eax + 0x18]
add eax, 0x403030
sub eax, 0x2000
add eax, dword [ebp + 8]
push dword [eax]
mov eax, dword [ebp + 0xc]
add eax, dword [eax + 0x3c]
add eax, 0x14
add eax, 4
mov eax, dword [eax + 0x18]
add eax, 0x40302c
sub eax, 0x2000
add eax, dword [ebp + 8]
call dword [eax]
call eax
or eax, eax
jne 0x40149d
leave
ret 8
push eax
mov esi, dword [ebp - 0xc]
mov edi, eax
mov ecx, dword [ebp - 8]
rep movsb byte es:[edi], byte [esi]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 8]
push dword [esp + 0xc]
call fcn.0040115e
mov ebx, dword [esp]
add ebx, dword [ebx + 0x3c]
lea eax, [ebx + 0x18]
mov ebx, dword [eax + 0x38]
pop eax
push ebx
push 0x8000
push 0
push eax
mov eax, dword [ebp + 0xc]
add eax, dword [eax + 0x3c]
add eax, 0x14
add eax, 4
mov eax, dword [eax + 0x18]
add eax, str.VirtualFree
sub eax, 0x2000
add eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
add eax, dword [eax + 0x3c]
add eax, 0x14
add eax, 4
mov eax, dword [eax + 0x18]
add eax, 0x403030
sub eax, 0x2000
add eax, dword [ebp + 8]
push dword [eax]
mov eax, dword [ebp + 0xc]
add eax, dword [eax + 0x3c]
add eax, 0x14
add eax, 4
mov eax, dword [eax + 0x18]
add eax, 0x40302c
sub eax, 0x2000
add eax, dword [ebp + 8]
call dword [eax]
call eax
mov ebx, dword [ebp + 0xc]
add ebx, dword [ebx + 0x3c]
lea eax, [ebx + 0x18]
mov ebx, dword [eax + 0x38]
mov dword [ebp - 4], ebx
mov ebx, dword [esp]
add ebx, dword [ebp + 0xc]
and ebx, 0xffff0000
add ebx, 0x10000
push 0x40
push 0x3000
push dword [ebp - 4]
push ebx
mov eax, dword [ebp + 0xc]
add eax, dword [eax + 0x3c]
add eax, 0x14
add eax, 4
mov eax, dword [eax + 0x18]
add eax, str.VirtualAlloc
sub eax, 0x2000
add eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
add eax, dword [eax + 0x3c]
add eax, 0x14
add eax, 4
mov eax, dword [eax + 0x18]
add eax, 0x403030
sub eax, 0x2000
add eax, dword [ebp + 8]
push dword [eax]
mov eax, dword [ebp + 0xc]
add eax, dword [eax + 0x3c]
add eax, 0x14
add eax, 4
mov eax, dword [eax + 0x18]
add eax, 0x40302c
sub eax, 0x2000
add eax, dword [ebp + 8]
call dword [eax]
call eax
or eax, eax
je 0x401546
mov edi, eax
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
rep movsb byte es:[edi], byte [esi]
push eax
sub eax, dword [ebp + 0xc]
add dword [ebp + 8], eax
mov ebx, 0x401612
add ebx, dword [ebp + 8]
mov dword [ebp - 0x14], ebx
mov ebx, 0x401b2f
add ebx, dword [ebp + 8]
sub ebx, dword [ebp - 0x14]
mov dword [ebp - 0x10], ebx
lea ebx, [ebp - 0x14]
push ebx
push 0x40135f
push dword [ebp + 0xc]
call fcn.0040132d
pop eax
pop ebx
push eax
push ebx
push dword [ebp + 8]
push dword [ebp - 8]
mov eax, dword [ebp + 8]
add dword [ebp - 0xc], eax
push dword [ebp - 0xc]
mov eax, 0x40170e
add eax, dword [ebp + 8]
call eax
leave
ret 8