Function at 0x4018f0
Capabilities:
Allocate or change rwx memory
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
push ebx
push esi
push edi
xor esi, esi
push esi
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x3c]
push ecx
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], esi
call sub.gdiplus.dll_GdiplusStartup
call dword [sym.imp.USER32.dll_GetDesktopWindow]
lea edx, [ebp - 0x90]
push edx
push eax
mov dword [ebp - 0x24], eax
call dword [sym.imp.USER32.dll_BeginPaint]
lea ecx, [ebp - 0x18]
push ecx
push eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], esi
call sub.gdiplus.dll_GdipCreateFromHDC
mov edx, dword [0x401ff0]
push 0x402124
push 0x6a
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
mov eax, dword [0x401ff0]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ecx, dword [0x401ff0]
push edi
push ecx
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push eax
lea ecx, [ebp - 0x50]
call fcn.004011d0
push 0x10
call sub.gdiplus.dll_GdipAlloc
mov edi, eax
cmp edi, esi
je 0x4019ba
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x50]
push eax
mov dword [edi], 0x402100
mov dword [ebp - 4], esi
call sub.gdiplus.dll_GdipCreateBitmapFromStream
mov ecx, dword [ebp - 4]
mov dword [edi + 8], eax
mov dword [edi + 4], ecx
mov dword [ebp - 0x10], edi
jmp 0x4019bf
mov dword [ebp - 0x10], esi
mov edi, esi
mov eax, dword [edi + 4]
lea edx, [ebp - 0xc]
push edx
push eax
mov dword [ebp - 0xc], esi
call sub.gdiplus.dll_GdipGetImageWidth
cmp eax, esi
je 0x4019d6
mov dword [edi + 8], eax
mov edx, dword [edi + 4]
lea ecx, [ebp - 8]
push ecx
push edx
mov dword [ebp - 8], esi
call sub.gdiplus.dll_GdipGetImageHeight
cmp eax, esi
je 0x4019ed
mov dword [edi + 8], eax
mov eax, dword [ebp - 8]
imul eax, dword [ebp - 0xc]
push 0x40
add eax, eax
add eax, eax
push 0x1000
push eax
push esi
mov dword [ebp - 0x28], eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
mov ebx, 0xff000000
mov dword [ebp - 4], esi
cmp dword [ebp - 8], esi
jbe 0x401a90
lea esp, [esp]
cmp dword [ebp - 0xc], 0
mov dword [ebp - 0x14], 0
jbe 0x401a84
lea ecx, [ecx]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x10]
push ecx
mov ecx, dword [eax + 4]
push edx
push ecx
call sub.gdiplus.dll_GdipBitmapGetPixel
test eax, eax
je 0x401a54
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], eax
jmp 0x401a57
mov ebx, dword [ebp - 0x1c]
mov eax, ebx
shr eax, 0x18
mov byte [esi + edi], al
mov eax, dword [ebp - 0x14]
mov ecx, ebx
shr ecx, 0x10
mov edx, ebx
mov byte [esi + edi + 1], cl
shr edx, 8
mov byte [esi + edi + 2], dl
inc eax
mov byte [esi + edi + 3], bl
add esi, 4
mov dword [ebp - 0x14], eax
cmp eax, dword [ebp - 0xc]
jb 0x401a30
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp eax, dword [ebp - 8]
jb 0x401a20
mov esi, dword [ebp - 0x28]
mov edx, esi
mov ecx, edi
call fcn.00401700
push 0x8000
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [ebp - 0x20]
mov esi, dword [ebp - 0x24]
push eax
push esi
call dword [sym.imp.USER32.dll_ReleaseDC]
lea ecx, [ebp - 0x90]
push ecx
push esi
call dword [sym.imp.USER32.dll_EndPaint]
lea ecx, [ebp - 0x50]
call fcn.00401010
mov edx, dword [ebp - 0x18]
push edx
call sub.gdiplus.dll_GdipDeleteGraphics
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret