Function at 0x43df71
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x61965c
call fcn.0044c384
sub esp, 0x44
mov eax, dword [0x679548]
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], eax
xor ebx, ebx
push ebx
push 0xe7
mov dword [ebp - 4], ebx
call fcn.005f965e
mov ecx, eax
call fcn.005f98af
push ebx
push 0xe1
mov ecx, edi
call fcn.005f965e
mov ecx, eax
call fcn.005f98af
push ebx
push 0xe2
mov ecx, edi
call fcn.005f965e
mov ecx, eax
call fcn.005f98af
push ebx
push 0xe3
mov ecx, edi
call fcn.005f965e
mov ecx, eax
call fcn.005f98af
mov esi, 0x6b4f90
mov ecx, edi
push esi
push 0xe1
call fcn.005f96b6
push esi
push 0xe2
mov ecx, edi
call fcn.005f96b6
push esi
push 0xe3
mov ecx, edi
call fcn.005f96b6
push esi
push 0xe9
mov ecx, edi
call fcn.005f96b6
push esi
push 0xfe
mov ecx, edi
call fcn.005f96b6
push esi
push 0x193
mov ecx, edi
call fcn.005f96b6
mov eax, dword [0x6b5470]
push 0xe7
mov ecx, edi
lea esi, [eax + 0x1f4]
call fcn.005f965e
cmp esi, ebx
jne 0x43e050
xor esi, esi
jmp 0x43e053
mov esi, dword [esi + 4]
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 0x30
push dword [eax + 0x1c]
call esi
mov eax, dword [0x6b5470]
push 0xe1
add eax, 0x1f4
mov ecx, edi
mov dword [ebp - 0x20], eax
call fcn.005f965e
mov ecx, dword [ebp - 0x20]
cmp ecx, ebx
jne 0x43e086
xor ecx, ecx
jmp 0x43e089
mov ecx, dword [ecx + 4]
push ebx
push ecx
push 0x30
push dword [eax + 0x1c]
call esi
mov eax, dword [0x6b5470]
push 0xe2
add eax, 0x1f4
mov ecx, edi
mov dword [ebp - 0x20], eax
call fcn.005f965e
mov ecx, dword [ebp - 0x20]
cmp ecx, ebx
jne 0x43e0b6
xor ecx, ecx
jmp 0x43e0b9
mov ecx, dword [ecx + 4]
push ebx
push ecx
push 0x30
push dword [eax + 0x1c]
call esi
mov eax, dword [0x6b5470]
push 0xe3
add eax, 0x1f4
mov ecx, edi
mov dword [ebp - 0x20], eax
call fcn.005f965e
mov ecx, dword [ebp - 0x20]
cmp ecx, ebx
jne 0x43e0e6
xor ecx, ecx
jmp 0x43e0e9
mov ecx, dword [ecx + 4]
push ebx
push ecx
push 0x30
push dword [eax + 0x1c]
call esi
mov eax, dword [0x6b5470]
push 0xfe
add eax, 0x1f4
mov ecx, edi
mov dword [ebp - 0x20], eax
call fcn.005f965e
mov ecx, dword [ebp - 0x20]
cmp ecx, ebx
jne 0x43e116
xor ecx, ecx
jmp 0x43e119
mov ecx, dword [ecx + 4]
push ebx
push ecx
push 0x30
push dword [eax + 0x1c]
call esi
mov eax, dword [0x6b5470]
push 0xe9
add eax, 0x1f4
mov ecx, edi
mov dword [ebp - 0x20], eax
call fcn.005f965e
mov ecx, dword [ebp - 0x20]
cmp ecx, ebx
jne 0x43e146
xor ecx, ecx
jmp 0x43e149
mov ecx, dword [ecx + 4]
push ebx
push ecx
push 0x30
push dword [eax + 0x1c]
call esi
push 0x30
lea ecx, [ebp - 0x28]
call fcn.005f5ab9
push 0x31
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 1
call fcn.005f5ab9
push dword [ebp - 0x24]
mov byte [ebp - 4], 2
call fcn.0044c9b3
pop ecx
mov dword [ebp - 0x20], eax
push dword [ebp - 0x28]
neg eax
push ebx
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.GDI32.dll_CreateFontA]
push eax
lea ecx, [edi + 0x194]
call fcn.005fd8cc
push 0x193
mov ecx, edi
call fcn.005f965e
lea ecx, [edi + 0x194]
cmp ecx, ebx
jne 0x43e1b9
xor ecx, ecx
jmp 0x43e1bc
mov ecx, dword [ecx + 4]
push ebx
push ecx
push 0x30
push dword [eax + 0x1c]
call esi
push ebx
push 0x177
push 0x1f4
push ebx
mov esi, 0x227
push ebx
push esi
mov ecx, edi
call fcn.005f965e
mov ecx, eax
call fcn.005f981f
push ebx
push 0x20
push 0x20
push 0xb
push 0xe
push 0x6b7170
push 0xf0
mov ecx, edi
call fcn.005f965e
mov ecx, eax
call fcn.005f9860
push 0x40
push 0x10
push 0xb4
push 0x2b
push 0x40
push esi
mov ecx, edi
call fcn.005f965e
push eax
push 0xfe
mov ecx, edi
call fcn.005f965e
mov ecx, eax
call fcn.005f9860
push ebx
push 0x10
push 0x5a
push 5
push 0x9e
push esi
mov ecx, edi
call fcn.005f965e
push eax
push 0xe7
mov ecx, edi
call fcn.005f965e
mov ecx, eax
call fcn.005f9860
mov eax, dword [ebp + 8]
push ebx
add eax, 0xfffffefc
push 0x10
push eax
push 5
push 0xf8
push esi
mov ecx, edi
mov dword [ebp + 0xc], eax
call fcn.005f965e
push eax
push 0xe1
mov ecx, edi
call fcn.005f965e
mov ecx, eax
call fcn.005f9860
push ebx
push 0x10
push dword [ebp + 0xc]
mov ecx, edi
push 0x15
push 0xf8
push esi
call fcn.005f965e
push eax
push 0xe2
mov ecx, edi
call fcn.005f965e
mov ecx, eax
call fcn.005f9860
push ebx
push 0x10
push dword [ebp + 0xc]
mov ecx, edi
push 0x25
push 0xf8
push esi
call fcn.005f965e
push eax
push 0xe3
mov ecx, edi
call fcn.005f965e
mov ecx, eax
call fcn.005f9860
push ebx
push 0x10
push 0x140
push 0x10d
push 0xe
push esi
mov ecx, edi
call fcn.005f965e
push eax
push 0xe9
mov ecx, edi
call fcn.005f965e
mov ecx, eax
call fcn.005f9860
push ebx
push 0x50
pop eax
mov ecx, edi
cdq
idiv dword [ebp - 0x20]
imul eax, dword [ebp - 0x20]
push eax
push 0x140
push 0x122
push 0xe
push esi
call fcn.005f965e
push eax
push 0x193
mov ecx, edi
call fcn.005f965e
mov ecx, eax
call fcn.005f9860
call fcn.006092e4
mov eax, dword [eax + 0xc]
push str.RT_RCDATA
push 0x12e
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
call fcn.006092e4
mov eax, dword [eax + 0xc]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x20], eax
call fcn.006092e4
mov eax, dword [eax + 0xc]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 8]
push eax
call fcn.005a084f
mov dword [ebp + 0xc], eax
add eax, esi
push 8
push eax
call fcn.005a0047
add esp, 0xc
push esi
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push dword [ebp + 0xc]
call fcn.005a00cb
add esp, 0xc
mov ecx, edi
push dword [ebp + 0xc]
push 0x193
call fcn.005f96b6
push dword [ebp + 0xc]
call fcn.005989b0
pop ecx
mov ecx, dword [0x6b5470]
push 1
call fcn.00411cfb
push 0x1c
lea ecx, [ebp - 0x10]
mov esi, eax
call fcn.005fa867
push dword [ebp - 0x10]
mov ecx, edi
push 0xe1
call fcn.005f96b6
push 0x1d
lea ecx, [ebp - 0x10]
call fcn.005fa867
push dword [ebp - 0x10]
mov ecx, edi
push 0xe2
call fcn.005f96b6
push 0x1e
lea ecx, [ebp - 0x10]
call fcn.005fa867
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx - 8]
cmp eax, 4
jle 0x43e447
mov ecx, eax
lea eax, [ebp + 0xc]
add ecx, 0xfffffffc
push ecx
push eax
lea ecx, [ebp - 0x10]
call fcn.005f2e39
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.005f5b84
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 2
call fcn.005f5a4b
mov ecx, dword [ebp - 0x10]
push ecx
push 0xe3
mov ecx, edi
call fcn.005f96b6
mov eax, dword [0x679548]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
push 4
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 5
call fcn.005fa867
push 5
lea ecx, [ebp - 0x18]
call fcn.005fa867
mov eax, dword [0x679548]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 6
push eax
call fcn.0046974e
pop ecx
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x34]
push str.SoftwareAdobeAdobe_Acrobat5.0_
push eax
call fcn.005f5d54
push 0x67434c
push eax
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 7
push eax
call fcn.005f5ce0
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 8
push ecx
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.005f5ce0
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 9
call fcn.005f5b84
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 8
call fcn.005f5a4b
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 7
call fcn.005f5a4b
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 6
call fcn.005f5a4b
lea eax, [ebp - 0x38]
push eax
push 0x20019
push ebx
push dword [ebp - 0x14]
push reloc.CoolType.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x43e53d
mov dword [ebp + 0xc], 1
push dword [ebp + 0xc]
lea eax, [ebp - 0x50]
push dword [ebp - 0x18]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
inc dword [ebp + 0xc]
cmp dword [ebp + 0xc], 4
jl 0x43e518
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [0x6b5470]
push esi
call fcn.00411cfb
mov ecx, edi
call fcn.0043e6dd
push 0x1388
lea ecx, [edi + 0x118]
call fcn.0043ee0c
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 5
call fcn.005f5a4b
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 4
call fcn.005f5a4b
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.005f5a4b
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 1
call fcn.005f5a4b
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.005f5a4b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.005f5a4b
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8