Function at 0x428ee0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4d61a6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x11c
mov eax, dword [0x50ba00]
push ebx
push ebp
mov ebp, dword [esp + 0x134]
push esi
xor esi, esi
cmp ebp, esi
mov dword [esp + 0x124], eax
mov dword [esp + 0x10], esi
je 0x429176
cmp dword [esp + 0x13c], esi
je 0x429176
mov ebx, dword [esp + 0x144]
cmp ebx, esi
je 0x429176
push edi
push 0x25c
call fcn.004cab91
add esp, 4
cmp eax, esi
je 0x428f66
mov ecx, dword [esp + 0x144]
push ebx
push ecx
push ebp
mov ecx, eax
call fcn.00428df0
mov edi, eax
mov dword [esp + 0x10], edi
jmp 0x428f6c
mov dword [esp + 0x10], esi
mov edi, esi
cmp dword [esp + 0x14c], esi
je 0x428faf
mov ecx, 0x50dfc0
call fcn.0049c670
test eax, eax
jle 0x428fad
push esi
mov ecx, 0x50dfc0
call fcn.004979f0
push edi
mov ecx, eax
call fcn.00428980
test eax, eax
jne 0x42904b
mov ecx, 0x50dfc0
inc esi
call fcn.0049c670
cmp esi, eax
jl 0x428f83
xor esi, esi
push 0xffffffffffffffff
lea edx, [esp + 0x20]
push ebp
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], edx
mov dword [esp + 0xa4], esi
mov word [esp + 0x24], si
call fcn.00401550
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x138], esi
call fcn.004987a0
push eax
lea ecx, [esp + 0xa8]
push ecx
call fcn.00428e30
add esp, 0xc
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x1c]
cmp eax, edx
mov byte [esp + 0x134], 2
je 0x42900e
push eax
call fcn.00482838
add esp, 4
movzx eax, word [esp + 0x144]
mov ecx, dword [esp + 0x140]
push ebx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x42907e
mov eax, dword [esp + 0xa0]
lea edx, [esp + 0xa4]
cmp eax, edx
je 0x429047
push eax
call fcn.00482838
add esp, 4
xor eax, eax
jmp 0x429059
push edi
call fcn.004cabc1
add esp, 4
mov eax, 1
pop edi
mov ecx, dword [esp + 0x128]
pop esi
pop ebp
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x11c]
pop ebx
call fcn.00482423
add esp, 0x128
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, eax
test ebp, ebp
jne 0x42909f
mov eax, dword [esp + 0xa0]
lea ecx, [esp + 0xa4]
cmp eax, ecx
jmp 0x42903c
mov edx, dword [esp + 0x140]
push esi
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x4290c9
mov eax, dword [esp + 0xa0]
lea ecx, [esp + 0xa4]
cmp eax, ecx
jmp 0x42903c
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
mov eax, dword [esp + 0xa0]
je 0x429033
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x42911d
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [esp + 0xa0]
lea ecx, [esp + 0xa4]
cmp eax, ecx
jmp 0x42903c
push 0
lea edx, [esp + 0x18]
push edx
push ebp
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [esp + 0x14c]
test eax, eax
je 0x429155
mov eax, dword [esp + 0x10]
push eax
mov ecx, 0x50dfc0
call fcn.00497840
mov eax, dword [esp + 0xa0]
lea ecx, [esp + 0xa4]
cmp eax, ecx
je 0x429054
push eax
call fcn.00482838
jmp 0x429051
xor eax, eax
jmp 0x42905a