Function at 0x411df0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x64
mov dword [esp + 4], 1
mov dword [esp], 0x30958
call fcn.00402242
mov eax, dword [0x417154]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], 0x417120
mov dword [esp + 8], 0xe
mov dword [esp + 4], 0x65
mov dword [esp], 0x400000
mov eax, dword [sym.imp.KERNEL32.dll_FindResourceA]
call eax
sub esp, 0xc
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov dword [esp], 0x400000
mov eax, dword [sym.imp.KERNEL32.dll_SizeofResource]
call eax
sub esp, 8
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov dword [esp], 0x400000
mov eax, dword [sym.imp.KERNEL32.dll_LoadResource]
call eax
sub esp, 8
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_LockResource]
call eax
sub esp, 4
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], 0x400000
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 0x40]
add eax, edx
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
add eax, 0x18
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
add eax, 0x70
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
mov edx, 0x400000
add eax, edx
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
jmp 0x411efb
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
cmp al, 0x28
jne 0x411ef3
mov eax, dword [ebp - 0xc]
add eax, 1
mov eax, dword [eax]
cmp eax, 0x80000000
je 0x411f06
add dword [ebp - 0xc], 1
add dword [ebp - 0x10], 1
cmp dword [ebp - 0x10], 0x4e1f
jle 0x411eda
jmp 0x411f07
nop
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov dword [esp], 0x40
mov eax, dword [sym.imp.KERNEL32.dll_LocalAlloc]
call eax
sub esp, 8
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], 0
jmp 0x411f9c
mov eax, dword [ebp - 0x14]
mov edx, dword [eax + 0x14]
mov eax, dword [ebp - 0x18]
add eax, edx
mov dword [esp + 8], 2
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_LocalReAlloc]
call eax
sub esp, 0xc
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x14]
mov edx, dword [ebp - 0x14]
lea ecx, [edx + 0x28]
mov ebx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
add edx, ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x14]
add dword [ebp - 0x18], eax
add dword [ebp - 0x14], 0x80028
add dword [ebp - 0x20], 1
mov eax, dword [ebp - 0x3c]
movzx eax, word [eax + 4]
movzx eax, ax
cmp dword [ebp - 0x20], eax
jl 0x411f3a
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x18]
cmp eax, dword [ebp - 0x18]
jb 0x411fdd
mov eax, dword [ebp - 0x28]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0x1c]
add edx, eax
mov eax, dword [0x41c7c4]
mov ecx, eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp], ecx
call fcn.00414320
jmp 0x412004
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x18]
mov edx, dword [ebp - 0x28]
mov ecx, dword [edx + 4]
mov edx, dword [ebp - 0x1c]
add edx, ecx
mov ecx, dword [0x41c7c4]
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp], ecx
call fcn.00414320
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_FreeResource]
call eax
sub esp, 4
mov eax, dword [ebp - 0x28]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0x58]
add edx, eax
mov eax, dword [ebp - 0x28]
mov dword [eax], edx
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call fcn.00405931
mov eax, 1
mov ebx, dword [ebp - 4]
leave
ret 0x10