Function at 0x1000e609
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x154
mov eax, 0x101cab54
call fcn.10096fd0
mov dword [ebp - 0x128], ecx
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
push 0x3c8
xor edi, edi
push edi
push ebx
call fcn.10097040
add esp, 0xc
mov dword [ebp - 0x130], 1
mov dword [ebp - 0x120], edi
mov dword [ebp - 0x138], edi
mov dword [ebp - 4], edi
mov eax, dword [ebp - 0x128]
cmp dword [eax + 4], edi
je 0x1000e665
push 2
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x1000e6c6
mov byte [ebp - 0x118], 0
push 0x103
push edi
lea eax, [ebp - 0x117]
push eax
call fcn.10097040
push 0x104
lea eax, [ebp - 0x118]
push eax
push 0xffffffffffffffff
push esi
call fcn.1001c1d4
add esp, 0x1c
test eax, eax
jne 0x1000e6b6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x158], eax
push 0x10223794
lea eax, [ebp - 0x158]
push eax
call fcn.100991e7
push 2
push edi
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov dword [ebp - 0x120], eax
cmp eax, edi
jne 0x1000e6e9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x13c], eax
push 0x10223794
lea eax, [ebp - 0x13c]
jmp 0x1000e6b0
mov dword [ebp - 0x134], edi
lea eax, [ebp - 0x134]
push eax
push 0x1000dc55
push 1
push 0x10
push dword [ebp - 0x120]
call dword [sym.imp.KERNEL32.dll_EnumResourceLanguagesW]
push dword [ebp - 0x134]
push 1
push 0x10
push dword [ebp - 0x120]
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov esi, eax
cmp esi, edi
jne 0x1000e765
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x714
je 0x1000e751
cmp eax, 0x715
je 0x1000e751
mov dword [ebp - 0x144], eax
push 0x10223794
lea eax, [ebp - 0x144]
jmp 0x1000e6b0
push dword [ebp - 0x120]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
inc eax
jmp 0x1000eacf
push esi
push dword [ebp - 0x120]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x124], eax
push esi
push dword [ebp - 0x120]
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x1000e7a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x154], eax
push 0x10223794
lea eax, [ebp - 0x154]
jmp 0x1000e6b0
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
cmp esi, edi
jne 0x1000e7ce
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14c], eax
push 0x10223794
lea eax, [ebp - 0x14c]
jmp 0x1000e6b0
mov eax, dword [ebp - 0x124]
lea edi, [esi + eax]
mov dword [ebp - 0x11c], edi
push edi
mov eax, esi
call fcn.1000dd01
test eax, eax
jne 0x1000e800
or dword [ebp - 0x15c], 0xffffffff
push 0x10223784
lea eax, [ebp - 0x15c]
jmp 0x1000e6b0
push edi
mov eax, esi
call fcn.1000dcc3
push 0xc
pop ecx
cmp cx, word [esi + 2]
ja 0x1000e816
mov ecx, dword [eax + 8]
mov dword [ebx], ecx
push 0x10
pop ecx
cmp cx, word [esi + 2]
ja 0x1000e825
mov eax, dword [eax + 0xc]
mov dword [ebx + 4], eax
push edi
call fcn.1000dce5
mov esi, eax
push edi
mov ecx, esi
call fcn.1000dd67
test eax, eax
jne 0x1000e850
or dword [ebp - 0x140], 0xffffffff
push 0x10223784
lea eax, [ebp - 0x140]
jmp 0x1000e6b0
push 0x101e7448
mov eax, esi
call fcn.1000dd41
push eax
call fcn.100977e9
pop ecx
pop ecx
test eax, eax
jne 0x1000ea9b
push dword [ebp - 0x11c]
mov eax, esi
call fcn.1000dd45
mov edi, eax
push dword [ebp - 0x11c]
mov ecx, edi
call fcn.1000ddcb
test eax, eax
jne 0x1000e8a3
or dword [ebp - 0x148], 0xffffffff
push 0x10223784
lea eax, [ebp - 0x148]
jmp 0x1000e6b0
push dword [ebp - 0x11c]
mov eax, edi
call fcn.1000dda9
mov esi, eax
push dword [ebp - 0x11c]
mov ecx, esi
call fcn.1000de5b
test eax, eax
jne 0x1000e8da
or dword [ebp - 0x150], 0xffffffff
push 0x10223784
lea eax, [ebp - 0x150]
jmp 0x1000e6b0
movzx eax, word [edi]
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
jle 0x1000ea9b
push dword [ebp - 0x11c]
mov ecx, esi
call fcn.1000de5b
test eax, eax
je 0x1000ea9b
push dword [ebp - 0x11c]
call fcn.1000de2f
movzx edi, ax
mov eax, esi
call fcn.1000de09
mov dword [ebp - 0x124], eax
push 0x101e7430
push eax
call fcn.100977e9
pop ecx
pop ecx
test eax, eax
jne 0x1000e957
test edi, edi
jbe 0x1000e957
cmp edi, 0x50
jb 0x1000e93d
push 0x4f
pop edi
push edi
push dword [ebp - 0x11c]
mov eax, esi
call fcn.1000de0d
push eax
lea eax, [ebx + 0x288]
jmp 0x1000ea75
push 0x101e7410
push dword [ebp - 0x124]
call fcn.100977e9
pop ecx
pop ecx
test eax, eax
jne 0x1000e990
test edi, edi
jbe 0x1000e990
cmp edi, 0x50
jb 0x1000e979
push 0x4f
pop edi
push edi
push dword [ebp - 0x11c]
mov eax, esi
call fcn.1000de0d
push eax
lea eax, [ebx + 8]
jmp 0x1000ea75
push 0x101e73f4
push dword [ebp - 0x124]
call fcn.100977e9
pop ecx
pop ecx
test eax, eax
jne 0x1000e9cc
test edi, edi
jbe 0x1000e9cc
cmp edi, 0x50
jb 0x1000e9b2
push 0x4f
pop edi
push edi
push dword [ebp - 0x11c]
mov eax, esi
call fcn.1000de0d
push eax
lea eax, [ebx + 0x148]
jmp 0x1000ea75
push 0x101e73d4
push dword [ebp - 0x124]
call fcn.100977e9
pop ecx
pop ecx
test eax, eax
jne 0x1000ea05
test edi, edi
jbe 0x1000ea05
cmp edi, 0x50
jb 0x1000e9ee
push 0x4f
pop edi
push edi
push dword [ebp - 0x11c]
mov eax, esi
call fcn.1000de0d
push eax
lea eax, [ebx + 0x328]
jmp 0x1000ea75
push 0x101e73b0
push dword [ebp - 0x124]
call fcn.100977e9
pop ecx
pop ecx
test eax, eax
jne 0x1000ea3e
test edi, edi
jbe 0x1000ea3e
cmp edi, 0x50
jb 0x1000ea27
push 0x4f
pop edi
push edi
push dword [ebp - 0x11c]
mov eax, esi
call fcn.1000de0d
push eax
lea eax, [ebx + 0xa8]
jmp 0x1000ea75
push 0x101e7398
push dword [ebp - 0x124]
call fcn.100977e9
pop ecx
pop ecx
test eax, eax
jne 0x1000ea7e
test edi, edi
jbe 0x1000ea7e
cmp edi, 0x50
jb 0x1000ea60
push 0x4f
pop edi
push edi
push dword [ebp - 0x11c]
mov eax, esi
call fcn.1000de0d
push eax
lea eax, [ebx + 0x1e8]
push eax
call fcn.100975dc
add esp, 0xc
movzx eax, word [esi]
add eax, 3
and eax, 0xfffffffc
sub dword [ebp - 0x12c], eax
mov eax, esi
call fcn.1000de50
mov esi, eax
jmp 0x1000e8e3
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x138], 0
je 0x1000eab4
push dword [ebp - 0x138]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [ebp - 0x120], 0
je 0x1000eac9
push dword [ebp - 0x120]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x130]
call fcn.1009702c
ret 8