Function at 0x402bd0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov edx, 0x4120bb
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x37c
mov esi, dword [ebp + 0x10]
mov dword [esp + 8], edx
mov eax, dword [ebp + 0xc]
mov dword [esp], 0
mov dword [esp + 4], eax
call sub.KERNEL32.dll_FindResourceA
mov ebx, eax
sub esp, 0xc
xor eax, eax
test ebx, ebx
je 0x402ca0
mov dword [esp + 4], ebx
mov dword [esp], 0
call sub.KERNEL32.dll_SizeofResource
sub esp, 8
mov edi, eax
mov dword [esp + 4], ebx
mov dword [esp], 0
call sub.KERNEL32.dll_LoadResource
mov dword [ebp - 0x360], eax
sub esp, 8
test eax, eax
je 0x402c87
mov ebx, dword [ebp - 0x360]
mov dword [esp], ebx
call sub.KERNEL32.dll_LockResource
mov esi, eax
sub esp, 4
xor eax, eax
test esi, esi
jne 0x402c5c
jmp 0x402ca0
rol byte [eax + esi], 4
inc eax
cmp eax, edi
jb 0x402c57
movzx eax, byte [esi]
mov edx, 2
cmp al, 0x49
je switch.0x00402c80
jle 0x402ca8
cmp al, 0x4d
je 0x402e6b
cmp al, 0x52
je case.default.0x402c80
nop
jmp dword [edx*4 + 0x412138]
cmp esi, 1
je 0x402e19
cmp esi, 2
je 0x402e47
xor eax, eax
nop
lea esi, [esi]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp al, 0x30
je 0x402e61
jg switch.0x00402c80
cmp al, 0xff
je 0x402e93
test al, al
jne switch.0x00402c80
movzx eax, byte [esi + 8]
cmp al, 0x41
je 0x402ccf
cmp al, 0x57
mov edx, 5
jne switch.0x00402c80
mov edx, 3
jmp switch.0x00402c80
mov eax, 0x4120bf
mov dword [esp + 4], eax
nop
lea ebx, [ebp - 0x358]
mov dword [esp], ebx
call sub.KERNEL32.dll_lstrcpyA
sub esp, 8
mov dword [esp + 0x10], ebx
mov edx, dword [ebp + 0xc]
mov ebx, str._squizz_d._s
mov dword [esp + 0xc], edx
mov eax, dword [0x413020]
mov dword [esp + 4], ebx
lea ebx, [ebp - 0x238]
add eax, 0x68f0
mov dword [esp], ebx
mov dword [esp + 8], eax
call sub.USER32.dll_wsprintfA
mov dword [esp + 4], ebx
mov dword [esp], 0x413160
call sub.KERNEL32.dll_lstrcpyA
sub esp, 8
xor ecx, ecx
mov edx, pe_nt_image_headers32
mov dword [esp + 0x18], ecx
mov eax, 2
xor ecx, ecx
mov dword [esp + 0x14], edx
xor edx, edx
mov dword [esp + 0x10], eax
mov eax, 0x40000000
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.KERNEL32.dll_CreateFileA
sub esp, 0x1c
lea edx, [ebp - 0x35c]
xor ecx, ecx
mov dword [esp + 0x10], ecx
mov ebx, eax
mov dword [esp + 0xc], edx
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.KERNEL32.dll_WriteFile
sub esp, 0x14
mov dword [esp], ebx
call sub.KERNEL32.dll_CloseHandle
mov esi, dword [ebp - 0x360]
sub esp, 4
mov dword [esp], esi
call sub.KERNEL32.dll_FreeResource
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
lea ebx, [ebp - 0x358]
jmp 0x402cf1
mov eax, 0x4120d0
mov dword [esp + 4], eax
jmp 0x402ce0
mov ecx, 0x4120d4
mov dword [esp + 4], ecx
jmp 0x402ce0
mov eax, 0x4120d8
mov dword [esp + 4], eax
jmp 0x402ce0
mov eax, 0x4120dc
mov dword [esp + 4], eax
jmp 0x402ce0
mov eax, 0x4120e0
mov dword [esp + 4], eax
jmp 0x402ce0
mov eax, 0x4120e4
mov dword [esp + 4], eax
jmp 0x402ce0
xor edi, edi
mov esi, 0x411014
mov ebx, str.Impossible_de_charger_le_fichier_audio.
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], 0
call sub.USER32.dll_MessageBoxA
sub esp, 0x10
xor eax, eax
jmp 0x402ca0
xor edx, edx
mov eax, 0x411014
mov ecx, str.Impossible_de_charger_le_fichier_vid
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
jmp 0x402e31
mov edx, 4
jmp switch.0x00402c80
mov edx, 6
jmp switch.0x00402c80
movzx eax, byte [esi + 8]
cmp al, 0x41
je 0x402ccf
cmp al, 0x57
jne switch.0x00402c80
mov edx, 1
jmp switch.0x00402c80
movzx eax, byte [esi + 1]
cmp al, 0xf3
je 0x402ea5
jg 0x402eaf
cmp al, 0xe3
jne switch.0x00402c80
mov edx, 2
jmp switch.0x00402c80
cmp al, 0xfb
je 0x402ea5
test al, al
jne switch.0x00402c80
mov edx, 5
jmp switch.0x00402c80