Function at 0x407930
Capabilities:
Access peb ldr_data
Extract resource via kernel32 functions
Get kernel32 base address
Write file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x40abb0
push eax
mov eax, dword [esp + 0x10]
mov dword fs:[0], esp
sub esp, 0x18
and eax, 0xffff
push ebp
push esi
push edi
push 0x40d4c0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x40797e
pop edi
pop esi
xor al, al
pop ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret 0x10
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
jne 0x4079a3
pop edi
pop esi
xor al, al
pop ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret 0x10
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4079c6
pop edi
pop esi
xor al, al
pop ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret 0x10
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x4079e9
pop edi
pop esi
xor al, al
pop ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret 0x10
xor eax, eax
test edi, edi
jbe 0x4079fd
mov cl, byte [eax + esi]
inc eax
not cl
mov byte [eax + esi - 1], cl
cmp eax, edi
jb 0x4079ef
push 0x40d4bc
push str.tmp.bmp
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x407a51
push ebp
push edi
push 1
push esi
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
cmp edi, eax
push ebp
je 0x407a48
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
xor al, al
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret 0x10
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
push 0x2050
push 0
push 0
push 0
push str.tmp.bmp
push 0
call dword [sym.imp.USER32.dll_LoadImageA]
test eax, eax
jne 0x407a83
pop edi
pop esi
xor al, al
pop ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret 0x10
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x40b70c
push eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x30], 0
call sub.MFC42.DLL_CGdiObject::Attach
test eax, eax
jne 0x407ad8
mov dword [esp + 0xc], 0x40b6f8
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 1
call sub.MFC42.DLL_CGdiObject::DeleteObject
pop edi
pop esi
xor al, al
pop ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret 0x10
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CDC::CDC
push 0
mov byte [esp + 0x30], 2
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CDC::Attach
mov edx, dword [esp + 0x10]
lea eax, [esp + 0xc]
neg eax
sbb eax, eax
and eax, edx
mov edx, dword [esp + 0x18]
push eax
push edx
call sub.MFC42.DLL_CDC::SelectGdiObject
mov esi, dword [esp + 0x40]
lea ecx, [esp + 0x34]
push ecx
push esi
mov eax, dword [esi]
call dword [eax + 0x44]
mov ebp, dword [esp + 0x18]
lea eax, [esp + 0x14]
mov edx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x34]
neg eax
sbb eax, eax
push 0xcc0020
and eax, ebp
push 0
push 0
push eax
mov eax, dword [esp + 0x48]
push edx
push eax
push 0
push 0
push ecx
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esp + 0x34]
mov edx, dword [esi]
push eax
push esi
call dword [edx + 0x68]
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CDC::DeleteDC
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CGdiObject::Detach
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CGdiObject::DeleteObject
push str.tmp.bmp
call sub.MFC42.DLL_CFile::Remove
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 0
call fcn.0040a5fc
mov dword [esp + 0xc], 0x40b6f8
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 3
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, dword [esp + 0x24]
pop edi
pop esi
mov al, 1
pop ebp
mov dword fs:[0], ecx
add esp, 0x24
ret 0x10