Function at 0x100e8900
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi + 0x30]
lea ebx, [esi + 0x30]
mov dword [esp + 0x10], ebx
push edi
test eax, eax
je 0x100e8b3f
push 0xe
push dword [esp + 0x34]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [esp + 0x24], eax
call eax
test eax, eax
je 0x100e8b3f
push eax
push dword [ebx]
mov eax, dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [esp + 0x24], eax
call eax
test eax, eax
je 0x100e8b3f
push eax
mov eax, dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [esp + 0x2c], eax
call eax
mov edi, eax
test edi, edi
je 0x100e8b3f
movzx eax, word [edi + 4]
test ax, ax
je 0x100e8b3f
lea ecx, [eax - 1]
mov eax, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
shl ecx, 5
add ecx, 0x438
mov dword [esp + 0x24], eax
push ecx
call eax
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x100e8b3f
movzx ecx, word [edi + 4]
mov dword [ebp + 0x414], ecx
cmp dword [esi + 0x14], 8
jb 0x100e89a5
mov esi, dword [esi]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp + 0x20c]
push eax
call esi
push 0x10255fec
lea eax, [ebp + 4]
push eax
call esi
cmp dword [ebp + 0x414], 0
mov dword [esp + 0x30], 0
jbe 0x100e8b4b
mov eax, dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [edi + 0x12]
lea esi, [ebp + 0x428]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x20], eax
nop dword [eax + eax]
movzx eax, word [ecx]
push 3
push eax
push dword [ebx]
call dword [esp + 0x24]
mov edi, eax
test edi, edi
je 0x100e8b35
push edi
push dword [ebx]
call dword [esp + 0x24]
mov ebx, eax
test ebx, ebx
je 0x100e8b35
mov eax, dword [esp + 0x14]
push edi
push dword [eax]
call dword [esp + 0x28]
push eax
mov dword [esi], eax
call dword [esp + 0x28]
add esp, 4
mov dword [esi - 4], eax
push dword [esi]
push ebx
call dword [esp + 0x30]
push eax
push dword [esi - 4]
call sub.VCRUNTIME140.dll_memcpy
lea eax, [esi - 0x10]
add esp, 0xc
test eax, eax
je 0x100e8b35
cmp dword [esi], 4
jbe 0x100e8a83
mov eax, dword [esi - 4]
cmp dword [eax], 0x474e5089
jne 0x100e8a83
mov dword [esi + 4], eax
xor edx, edx
mov dword [esi - 0x10], 0
mov dword [esi - 0xc], 0
mov dword [esi - 8], 0x20
mov dword [esi + 8], 0
jmp 0x100e8b0a
mov edi, dword [esi - 4]
mov dword [esi + 4], edi
mov eax, dword [edi + 4]
mov dword [esi - 0x10], eax
mov eax, dword [edi + 8]
cdq
sub eax, edx
mov ebx, eax
sar ebx, 1
mov dword [esi - 0xc], ebx
movzx ecx, word [edi + 0xc]
movzx edx, word [edi + 0xe]
imul edx, ecx
mov dword [esi - 8], edx
mov ecx, dword [edi + 0x20]
test ecx, ecx
je 0x100e8ab6
movzx eax, cx
jmp 0x100e8ae0
movzx eax, word [edi + 0xe]
sub eax, 1
je 0x100e8adb
sub eax, 3
je 0x100e8ad4
sub eax, 4
je 0x100e8acd
xor eax, eax
jmp 0x100e8ae0
mov eax, 0x100
jmp 0x100e8ae0
mov eax, 0x10
jmp 0x100e8ae0
mov eax, 2
shl eax, 2
movzx ecx, ax
add ecx, dword [edi]
add ecx, edi
mov dword [esi + 8], ecx
movzx edx, word [edi + 0xe]
movzx eax, word [edi + 0xc]
imul edx, eax
imul edx, dword [edi + 4]
add edx, 0x1f
sar edx, 3
and edx, 0xfffffffc
imul edx, ebx
add edx, ecx
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x10]
inc eax
mov dword [esi + 0xc], edx
add ecx, 0xe
add esi, 0x20
mov dword [esp + 0x30], eax
mov dword [esp + 0x10], ecx
cmp eax, dword [ebp + 0x414]
jae 0x100e8b4b
mov ebx, dword [esp + 0x14]
jmp 0x100e89f0
push ebp
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c
ret 4
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x1c
ret 4