Function at 0x401413
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4b31f7
mov eax, dword fs:[0]
push eax
sub esp, 0x160
mov eax, dword [0x4d897c]
xor eax, esp
mov dword [esp + 0x158], eax
push ebx
push esi
push edi
mov eax, dword [0x4d897c]
xor eax, esp
push eax
lea eax, [esp + 0x170]
mov dword fs:[0], eax
mov esi, dword [sym.imp.KERNEL32.dll_FindResourceW]
xor ebx, ebx
cmp dword [0x4dee64], 0x19
mov edi, 0x4be4dc
jne 0x40146f
push edi
push 0x78
push ebx
call esi
cmp dword [0x4dee64], 0x13
push edi
jne 0x40147d
push 0x79
jmp 0x40147f
push 0x71
push ebx
call esi
mov esi, eax
cmp esi, ebx
jne 0x40148f
xor al, al
jmp 0x4016b9
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
cmp edi, ebx
je 0x401488
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
cmp esi, ebx
je 0x401488
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp eax, ebx
je 0x401488
push edi
push eax
lea ecx, [esp + 0x50]
mov dword [esp + 0x64], 0xf
mov dword [esp + 0x60], ebx
mov byte [esp + 0x50], bl
call fcn.00401905
push esi
mov dword [esp + 0x17c], ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
mov dword [esp + 0x40], 7
mov dword [esp + 0x3c], ebx
mov word [esp + 0x2c], ax
mov byte [esp + 0x178], 1
cmp dword [esp + 0x5c], 0x10
mov eax, dword [esp + 0x48]
jae 0x401509
lea eax, [esp + 0x48]
push eax
lea esi, [esp + 0x30]
call fcn.00403610
pop ecx
lea eax, [esp + 0x9c]
mov dword [esp + 0x9c], ebx
mov dword [esp + 0xa0], ebx
call fcn.00406eac
mov byte [esp + 0x178], 2
cmp dword [esp + 0x40], 8
mov eax, dword [esp + 0x2c]
jae 0x401543
mov eax, esi
mov dword [esp + 0x10], eax
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40154a
sub eax, edx
sar eax, 1
lea esi, [esp + 0x9c]
mov edi, eax
call fcn.00406f15
mov eax, esi
call fcn.00406eac
lea eax, [esp + 0xa0]
push eax
push dword [esp + 0x14]
lea eax, [esp + 0x28]
push dword [esp + 0xa4]
lea edx, [edi + edi]
push dword [esp + 0xa8]
push eax
call fcn.00406b74
add esp, 0x14
cmp dword [esp + 0x20], ebx
jne 0x40168b
push str.String
push str.StringBundle
lea edi, [esp + 0x1c]
mov eax, esi
call fcn.00406cc9
lea edi, [esp + 0x14]
call fcn.00406cc9
mov esi, dword [esp + 0x10]
jmp 0x401683
lea edi, [esp + 0x18]
lea eax, [esp + 0x10]
call fcn.00406d03
mov eax, dword [eax]
cmp eax, ebx
je 0x4015e3
mov eax, dword [eax + 8]
cmp eax, ebx
jne 0x4015e8
mov eax, 0x4be374
push eax
lea ecx, [esp + 0x84]
call fcn.0040170f
mov byte [esp + 0x178], 3
lea eax, [esp + 0x14]
mov dword [esp + 0x14], esi
call fcn.00406e6b
cmp eax, ebx
je 0x401615
mov eax, dword [eax + 8]
cmp eax, ebx
jne 0x40161a
mov eax, 0x4be374
push eax
lea ecx, [esp + 0x68]
call fcn.0040170f
lea eax, [esp + 0x80]
push eax
mov ecx, 0x4dee68
mov byte [esp + 0x17c], 4
call fcn.00401830
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x6c]
push ecx
mov ecx, eax
call fcn.00401a1a
push ebx
push 1
lea ecx, [esp + 0x6c]
call fcn.00401adc
push ebx
push 1
lea ecx, [esp + 0x88]
mov byte [esp + 0x180], 2
call fcn.00401adc
lea edi, [esp + 0x1c]
lea eax, [esp + 0x10]
call fcn.00406d39
mov esi, dword [eax]
mov dword [esp + 0x10], esi
cmp esi, ebx
jne 0x4015c9
lea esi, [esp + 0x9c]
mov byte [esp + 0x178], 1
call fcn.00406f15
push ebx
push 1
lea ecx, [esp + 0x34]
call fcn.00401adc
push ebx
push 1
lea ecx, [esp + 0x50]
call fcn.0040197a
mov al, 1
mov ecx, dword [esp + 0x170]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x158]
xor ecx, esp
call fcn.00494bb0
mov esp, ebp
pop ebp
ret