Function at 0x42eeb0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c98ad
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x640844]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x38], ecx
movzx eax, word [ebp + 8]
push 0xf0
push eax
push dword [0x647e58]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, dword [sym.imp.KERNEL32.dll_LockResource]
xor ecx, ecx
mov edi, dword [sym.imp.KERNEL32.dll_LoadResource]
xor ebx, ebx
mov dword [ebp - 0x50], ecx
test eax, eax
je 0x42ef1e
push eax
push dword [0x647e58]
call edi
test eax, eax
je 0x42ef1e
push eax
call esi
mov dword [ebp - 0x50], eax
movzx ecx, word [ebp + 8]
push 5
push ecx
push dword [0x647e58]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x42f40d
push eax
push dword [0x647e58]
call edi
test eax, eax
je 0x42f406
push eax
call esi
mov edx, eax
test edx, edx
je 0x42f406
movzx ecx, word [edx + 2]
mov esi, 0xffff
mov eax, ecx
mov dword [ebp - 0x44], eax
movzx eax, ax
mov dword [ebp - 0x64], eax
xor eax, eax
cmp cx, si
push edx
sete al
mov dword [ebp - 0x68], eax
xor eax, eax
cmp cx, si
sete al
lea eax, [eax*8 + 8]
movzx eax, word [eax + edx]
mov dword [ebp - 0x60], eax
call fcn.00420c50
add esp, 4
mov esi, eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x30], esi
push 5
push dword [eax + 4]
call dword [sym.imp.USER32.dll_GetWindow]
mov edi, eax
xor ecx, ecx
xor eax, eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x40], ecx
cmp ax, word [ebp - 0x60]
jae 0x42f40d
nop
mov edx, 0xffff
cmp word [ebp - 0x44], dx
jne 0x42efd6
mov ecx, dword [esi + 0x14]
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x40]
jmp 0x42efdd
movzx eax, word [esi + 0x10]
mov dword [ebp - 0x24], eax
cmp word [ebp - 0x64], dx
mov eax, 0x18
mov edx, 0x12
cmovne eax, edx
cmp word [eax + esi], 0x7b
jne 0x42f3b9
mov ecx, dword [ebp - 0x50]
mov eax, ecx
test ecx, ecx
je 0x42f01d
mov ebx, dword [ebp - 0x24]
movzx ecx, word [eax]
lea edi, [eax + 2]
movzx esi, word [eax + 2]
mov edx, dword [eax + 4]
add eax, 8
cmp ecx, ebx
je 0x42f062
add eax, edx
jne 0x42f005
xor esi, esi
mov ebx, esi
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], eax
test esi, esi
je 0x42f0b3
push esi
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x42f3ce
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x42f07e
push esi
test ebx, ebx
je 0x42f073
push ebx
push eax
call fcn.004eecb0
add esp, 0xc
xor eax, eax
jmp 0x42f093
mov eax, 0x378
cmp si, ax
je 0x42f01d
mov ebx, edi
lea esi, [edx + 6]
jmp 0x42f021
push 0
push eax
call fcn.004ef230
add esp, 0xc
call fcn.004f24f9
mov dword [eax], 0x16
call fcn.004f241f
mov eax, 0x16
push eax
call fcn.0041a040
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea eax, [ebp - 0x28]
push eax
push 1
push edi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 1
push ecx
push eax
call fcn.004240a0
mov esi, dword [ebp - 0x24]
mov ebx, eax
add esp, 8
test ebx, ebx
js 0x42f374
call fcn.00427f00
mov ecx, dword [ebp - 0x44]
mov edx, 0xffff
cmp cx, dx
mov edi, 0x12
mov eax, 0x18
cmovne eax, edi
mov edi, dword [ebp - 0x30]
add eax, edi
mov dword [ebp - 0x58], eax
cmp cx, dx
jne 0x42f143
movzx eax, word [edi + 0xc]
movsx ecx, ax
movzx eax, word [edi + 0xe]
movsx edx, ax
movsx eax, word [edi + 0x10]
add eax, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x18], eax
movsx eax, word [edi + 0x12]
add eax, edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x38]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_MapDialogRect]
mov eax, dword [edi + 0x14]
mov ebx, dword [edi + 4]
add edi, 8
jmp 0x42f17f
movzx eax, word [edi + 8]
movsx ecx, ax
movzx eax, word [edi + 0xa]
movsx edx, ax
movsx eax, word [edi + 0xc]
add eax, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x18], eax
movsx eax, word [edi + 0xe]
add eax, edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x38]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_MapDialogRect]
movzx eax, word [edi + 0x10]
xor ebx, ebx
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
push 0
push dword [0x647e54]
mov edi, dword [edi]
push eax
mov eax, dword [ebp - 0x38]
or edi, 0x10000
push dword [eax + 4]
mov eax, dword [ebp - 0x14]
sub eax, edx
push eax
mov eax, dword [ebp - 0x18]
sub eax, ecx
push eax
push edx
push ecx
push edi
push 0
push 0x5de824
push ebx
call fcn.004281f0
mov edi, eax
test edi, edi
je 0x42f36d
mov esi, 0xffff
cmp word [ebp - 0x44], si
jne 0x42f1de
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
test eax, eax
je 0x42f1de
push eax
push edi
call dword [sym.imp.USER32.dll_SetWindowContextHelpId]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x3c], 0
push 0
push 0
push dword [0x647040]
mov byte [ebp - 4], 3
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, eax
mov ebx, 0x80004005
xor eax, eax
mov dword [ebp - 0x6c], esi
test esi, esi
cmovne ebx, eax
je 0x42f223
mov eax, dword [esi]
lea ecx, [ebp - 0x3c]
push ecx
push 0x5de074
push esi
call dword [eax]
mov ebx, eax
mov byte [ebp - 4], 2
test esi, esi
je 0x42f231
mov ecx, dword [esi]
push esi
call dword [ecx + 8]
test ebx, ebx
jns 0x42f2f8
call fcn.00427f00
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x4c], 0
push eax
push 0x5dde18
push 0
mov dword [ebp - 0x54], 0
call fcn.0041fd70
mov ebx, eax
test ebx, ebx
js 0x42f2c8
mov eax, dword [ebp - 0x4c]
lea edx, [ebp - 0x48]
push edx
mov dword [ebp - 0x48], 0
push 0x5de064
mov ecx, dword [eax]
push eax
call dword [ecx]
mov eax, dword [ebp - 0x58]
test eax, eax
jne 0x42f285
xor esi, esi
jmp 0x42f296
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
test esi, esi
je 0x42f42d
push dword [ebp - 0x24]
mov ecx, dword [ebp - 0x48]
lea edx, [ebp - 0x54]
push 0
push 0x5e5f60
push edx
push dword [ebp - 0x34]
mov eax, dword [ecx]
push edi
push esi
push ecx
call dword [eax + 0x28]
push esi
mov ebx, eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x48]
test eax, eax
je 0x42f2c8
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x54]
test eax, eax
je 0x42f2d5
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x4c]
test eax, eax
je 0x42f2e2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x3c]
mov byte [ebp - 4], 1
test eax, eax
je 0x42f2f3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov esi, dword [ebp - 0x24]
jmp 0x42f346
mov dword [ebp - 0x5c], 0
mov esi, dword [ebp - 0x24]
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 0x3c]
push esi
push 0
push 0x5e5f60
mov ecx, dword [eax]
push edx
push dword [ebp - 0x34]
mov byte [ebp - 4], 4
push edi
push dword [ebp - 0x58]
push eax
call dword [ecx + 0x28]
mov ebx, eax
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x5c]
test eax, eax
je 0x42f335
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x3c]
mov byte [ebp - 4], 1
test eax, eax
je 0x42f346
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
test ebx, ebx
js 0x42f3e9
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp word [ebp - 0x40], cx
push 0x13
push ecx
push ecx
push ecx
push ecx
cmove eax, ecx
push eax
push edi
call dword [sym.imp.USER32.dll_SetWindowPos]
mov dword [ebp - 0x2c], edi
jmp 0x42f377
call fcn.0041df60
mov ebx, eax
mov edi, dword [ebp - 0x2c]
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x42f392
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov esi, dword [ebp - 0x30]
push dword [ebp - 0x68]
push esi
call fcn.00420cf0
mov ecx, dword [ebp - 0x40]
add esp, 8
inc ecx
mov esi, eax
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x40], ecx
cmp cx, word [ebp - 0x60]
jb 0x42efc0
jmp 0x42f40d
test cx, cx
je 0x42f395
push 2
push edi
call dword [sym.imp.USER32.dll_GetWindow]
mov edi, eax
mov dword [ebp - 0x2c], edi
jmp 0x42f395
mov eax, dword [ebp - 0x28]
mov ebx, 0x8007000e
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x42f40d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x42f40d
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x42f40d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x42f40d
call fcn.0041df60
mov ebx, eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ed0cc
mov esp, ebp
pop ebp
ret 4
push 0x8007000e
call fcn.0041a0e0
int3