Function at 0x4eb610
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x18ac
call fcn.005d9b90
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x18]
not eax
test al, 1
push esi
push edi
je 0x4ec0bb
mov ecx, dword [ebx + 0x158]
mov eax, dword [ecx + 0x48]
xor esi, esi
lea edx, [esp + 0x54]
mov dword [esp + 0x10], esi
call fcn.00404050
push 1
lea edi, [esp + 0x14]
xor eax, eax
call fcn.004b0840
add esp, 4
test eax, eax
jne 0x4ec099
cmp dword [0x690cb8], 5
mov edi, dword [ebx + 0x158]
mov dword [esp + 0x18], edi
mov dword [esp + 0xc], esi
jle 0x4ec099
mov eax, dword [edi + 0x18]
cmp eax, esi
mov dword [esp + 0x30], eax
jne 0x4eb691
mov dword [esp + 0x24], esi
jmp 0x4eb697
mov edx, dword [eax]
mov dword [esp + 0x24], edx
cmp dword [0x690cac], edi
jne 0x4eb6ce
mov eax, 0x10
test byte [0x691c08], al
jne 0x4eb6ce
or dword [0x691c08], eax
cmp dword [0x691c00], esi
jne 0x4eb6ce
push 0x14
push 0x4c4f10
push 0x691be8
call fcn.00454530
add esp, 0xc
push 0
mov ebx, 0x18
call fcn.0043ace0
mov esi, eax
add esp, 4
mov dword [esp + 0x28], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi], eax
xor eax, eax
mov edx, 1
mov dword [esi + 4], 2
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x10], eax
cmp dword [edi + 0x10], edx
mov dword [0x685c04], edx
jne 0x4eb72c
mov eax, dword [edi + 0x18]
test eax, eax
je 0x4eb71c
cmp dword [eax], 0
jne 0x4eb72c
cmp dword [edi + 0x28], 0
jne 0x4eb72c
cmp dword [edi + 0x34], 0
mov dword [esp + 0x1c], edx
je 0x4eb734
mov dword [esp + 0x1c], 0
movzx ecx, word [esp + 0x24]
xor eax, eax
mov dword [esp + 0x3c], eax
mov word [esp + 0x3c], cx
movzx ecx, word [edi + 0x28]
mov word [esp + 0x3e], cx
movzx ecx, word [edi + 0x5c]
mov dword [esp + 0x48], eax
mov word [esp + 0x4a], cx
movzx ecx, word [edi + 0x5e]
mov dword [esp + 0x4c], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x40], eax
mov word [esp + 0x4c], cx
movzx ecx, word [edi + 0x58]
mov dword [esp + 0x50], eax
mov ax, word [edi + 0x10]
xor ebx, ebx
test ax, ax
mov dword [esp + 0x2c], 0x34505347
mov word [esp + 0x38], 5
mov word [esp + 0x46], 4
mov word [esp + 0x3a], ax
mov word [esp + 0x40], bx
mov word [esp + 0x44], cx
jbe 0x4eb7da
mov edi, dword [edi + 0x48]
test edi, edi
je 0x4eb7da
mov ecx, dword [edi + 0x568]
test ecx, ecx
je 0x4eb7da
mov eax, dword [ecx + 0x10]
sub eax, edx
mov ecx, dword [ecx + 0xc]
js 0x4eb7da
cmp edi, dword [ecx + eax*4]
je 0x4eb7d1
sub eax, edx
jns 0x4eb7c6
jmp 0x4eb7da
test eax, eax
jl 0x4eb7da
mov word [esp + 0x48], ax
mov eax, dword [esp + 0x3e]
mov ecx, dword [esp + 0x24]
mov edi, dword [esp + 0x10]
add eax, ecx
add eax, dword [esp + 0x3a]
push edi
add ax, dx
mov word [esp + 0x54], ax
mov eax, 4
lea ecx, [esp + 0x30]
mov word [esp + 0x52], 9
call fcn.004b0f80
add esp, 4
test eax, eax
jle 0x4eb818
cmp eax, 0x14
mov ebx, eax
jge 0x4eb836
lea edx, [esp + 0x38]
push edx
push 0x384
push edi
mov eax, 0x1c
call fcn.004b17e0
add esp, 0xc
cmp eax, ebx
jle 0x4eb836
mov ebx, eax
xor eax, eax
cmp ebx, eax
jle 0x4eb849
cmp ebx, 0x14
mov dword [esp + 0xc], ebx
jge 0x4ec041
cmp dword [esp + 0xc], eax
mov dword [0x68f320], eax
mov dword [0x68f324], eax
mov dword [0x68f328], eax
jge 0x4eb862
mov dword [esp + 0xc], eax
mov eax, 5
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov eax, 3
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
push 0x100
lea eax, [esp + 0x74]
push eax
push 0x51
xor ebx, ebx
push 9
xor esi, esi
mov dword [esp + 0x7c], 4
mov word [esp + 0x80], bx
call fcn.0051a1e0
push 0x100
lea ecx, [esp + 0x284]
push ecx
push 0x52
push 9
call fcn.0051a1e0
push 0x100
lea edx, [esp + 0x494]
push edx
push 0x53
push 9
call fcn.0051a1e0
mov edi, dword [esp + 0x40]
push 9
push edi
lea eax, [esp + 0x90]
call fcn.00434ef0
add esp, 0x38
cmp eax, ebx
jle 0x4eb8f8
cmp eax, 0x14
mov esi, eax
jge 0x4eba3a
push ebx
push 0x3ee
push edi
xor eax, eax
call fcn.004b17e0
add esp, 0xc
cmp eax, esi
jle 0x4eb90f
mov esi, eax
cmp esi, 0x14
jge 0x4eba3a
mov eax, dword [esp + 0x18]
cmp dword [eax + 0x10], ebx
mov dword [esp + 0x14], ebx
jle 0x4eb98b
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx + 0xc]
mov eax, dword [esp + 0x14]
mov ecx, dword [edx + eax*4]
mov edi, dword [ecx + 0x110]
xor ebx, ebx
test edi, edi
je 0x4eb968
nop
cmp dword [edi + 0xc], 0x10
jne 0x4eb95e
mov edx, dword [esp + 0x10]
push edx
call fcn.00489e70
add esp, 4
cmp eax, ebx
jle 0x4eb959
mov ebx, eax
cmp ebx, 0x14
jge 0x4eb968
mov edi, dword [edi + 0x84]
test edi, edi
jne 0x4eb940
cmp ebx, esi
jle 0x4eb96e
mov esi, ebx
cmp esi, 0x14
jge 0x4eba3a
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
add eax, 1
cmp eax, dword [ecx + 0x10]
mov dword [esp + 0x14], eax
jl 0x4eb925
mov edx, dword [esp + 0x18]
mov edi, dword [edx + 0x18]
test edi, edi
jne 0x4eb99a
xor edx, edx
jmp 0x4eb99c
mov edx, dword [edi]
test edx, edx
mov dword [esp + 0x20], edx
mov dword [esp + 0x14], 0
jle 0x4eba01
add edi, 0x14
mov eax, dword [edi - 8]
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, 0xffffff34
add ecx, 0xcc
jne 0x4eb9cb
add dword [edi], 1
jmp 0x4eb9d8
cmp ecx, 0x14
jge 0x4ebb0b
test ecx, ecx
jne 0x4eb9e7
mov ebx, dword [esp + 0x10]
call fcn.00415f00
mov edx, dword [esp + 0x20]
mov esi, eax
add dword [edi], 0xffffffff
cmp esi, 0x14
jge 0x4eba3a
mov eax, dword [esp + 0x14]
add eax, 1
add edi, 0x10
cmp eax, edx
mov dword [esp + 0x14], eax
jl 0x4eb9af
mov edi, dword [esp + 0x10]
push 0
push 0x3ef
push edi
xor eax, eax
call fcn.004b17e0
add esp, 0xc
cmp eax, esi
jle 0x4eba1d
mov esi, eax
cmp esi, 0x14
jge 0x4eba3a
push 0
push 0x387
push edi
xor eax, eax
call fcn.004b17e0
add esp, 0xc
cmp eax, esi
jle 0x4eba3a
mov esi, eax
mov eax, dword [esp + 0xc]
cmp esi, eax
jle 0x4eba48
mov eax, esi
mov dword [esp + 0xc], eax
cmp eax, 0x14
jge 0x4ec038
mov eax, dword [esp + 0x18]
cmp dword [eax + 0x10], 0
mov dword [esp + 0x14], 0
jle 0x4ebc2e
xor ecx, ecx
cmp dword [esp + 0x1c], ecx
mov ebx, eax
sete cl
lea ecx, [ecx + ecx + 1]
mov dword [esp + 0x1c], ecx
mov edx, dword [ebx + 0xc]
mov eax, dword [esp + 0x14]
mov esi, dword [edx + eax*4]
push 1
mov eax, esi
call fcn.00401440
mov eax, 4
xor ebx, ebx
mov dword [esp + 0xc90], eax
mov dword [esp + 0xc94], eax
mov eax, dword [esp + 0x20]
add esp, 4
cmp dword [0x6928c0], ebx
mov edi, 1
mov dword [esp + 0xc88], edi
mov dword [esp + 0xc94], eax
mov dword [esp + 0xc98], eax
mov dword [esp + 0xc9c], 2
mov word [esp + 0xca0], bx
jne 0x4ebb12
push 0xa
push 0x80
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
add eax, 2
mov dword [0x690b40], eax
mov dword [0x6928c0], edi
jmp 0x4ebb17
mov esi, ecx
jmp 0x4eba3a
mov eax, dword [0x690b40]
movzx edi, word [eax + 0x24]
add edi, 0x1f
call fcn.0057ee1a
mov eax, dword [eax + 4]
mov edx, dword [eax + 0x44]
push 0x100
lea ecx, [esp + 0xea4]
push ecx
push edi
push edx
call dword [sym.imp.USER32.dll_LoadStringW]
cmp dword [0x6928c0], 0
jne 0x4ebb7a
push 0xa
push 0x80
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
add eax, 2
mov dword [0x690b40], eax
mov dword [0x6928c0], 1
jmp 0x4ebb7f
mov eax, dword [0x690b40]
movzx edi, word [eax + 0x24]
add edi, 0x20
call fcn.0057ee1a
mov eax, dword [eax + 4]
mov edx, dword [eax + 0x44]
push 0x100
lea ecx, [esp + 0x10a4]
push ecx
push edi
push edx
call dword [sym.imp.USER32.dll_LoadStringW]
mov edi, dword [esp + 0x10]
push 9
push edi
lea eax, [esp + 0xc90]
call fcn.00434ef0
add esp, 8
test eax, eax
jle 0x4ebbc7
cmp eax, 0x14
mov ebx, eax
jge 0x4ebbff
mov eax, dword [esp + 0x28]
push eax
push 2
push 1
push 1
push esi
push edi
call fcn.004a04b0
add esp, 0x18
cmp eax, ebx
jle 0x4ebbe2
mov ebx, eax
cmp ebx, 0x14
jge 0x4ebbff
push 0
push 0x387
push edi
xor eax, eax
call fcn.004b17e0
add esp, 0xc
cmp eax, ebx
jle 0x4ebbff
mov ebx, eax
mov eax, dword [esp + 0xc]
cmp ebx, eax
jle 0x4ebc0d
mov eax, ebx
mov dword [esp + 0xc], eax
cmp eax, 0x14
jge 0x4ec038
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
add eax, 1
cmp eax, dword [ebx + 0x10]
mov dword [esp + 0x14], eax
jl 0x4eba7a
cmp dword [esp + 0x24], 0
mov esi, 1
je 0x4ebd95
mov dword [esp + 0x34], 0
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x4ebc53
mov eax, dword [eax]
cmp dword [esp + 0x34], eax
jge 0x4ebd99
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
shl ecx, 4
mov ebx, dword [ecx + edx + 0xc]
test ebx, ebx
lea edi, [ecx + edx]
je 0x4ebc76
add dword [edi + 0x14], esi
mov edx, 2
push esi
mov ecx, edx
mov dword [esp + 0x12a4], edx
call fcn.00434b80
push 0
mov ecx, edx
mov dword [esp + 0x12ac], eax
call fcn.00434b80
mov dword [esp + 0x12b0], eax
mov eax, 3
mov dword [esp + 0x12b4], eax
mov dword [esp + 0x12b8], eax
push 0x100
lea eax, [esp + 0x14c4]
push eax
push 0x21
push 9
mov dword [esp + 0x12cc], 4
mov word [esp + 0x12d0], 0
call fcn.0051a1e0
push 0x100
lea ecx, [esp + 0x16d4]
push ecx
push 0x22
push 9
call fcn.0051a1e0
mov edx, dword [esp + 0x38]
push 9
push edx
lea eax, [esp + 0x12d0]
call fcn.00434ef0
mov ecx, dword [esp + 0x3c]
add esp, 0x30
cmp eax, ecx
jle 0x4ebd19
mov ecx, eax
mov dword [esp + 0xc], ecx
cmp ecx, 0x14
jge 0x4ec038
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x10]
push eax
push 2
push 0
push 0
push ebx
push ecx
call fcn.004a04b0
mov ecx, dword [esp + 0x24]
add esp, 0x18
cmp eax, ecx
jle 0x4ebd49
mov ecx, eax
mov dword [esp + 0xc], ecx
cmp ecx, 0x14
jge 0x4ec038
mov edx, dword [esp + 0x10]
push 0
push 0x387
push edx
xor eax, eax
call fcn.004b17e0
mov ecx, dword [esp + 0x18]
add esp, 0xc
cmp eax, ecx
jle 0x4ebd76
mov ecx, eax
mov dword [esp + 0xc], ecx
cmp ecx, 0x14
jge 0x4ec038
and byte [edi + 0x18], 0xfa
add dword [edi + 0x14], 0xffffffff
mov esi, 1
add dword [esp + 0x34], esi
jmp 0x4ebc46
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx + 0x28]
test eax, eax
jle 0x4ebfd4
mov dword [esp + 0x14], 0
mov edx, dword [esp + 0x14]
mov eax, dword [ecx + 0x24]
mov ecx, dword [eax + edx*8 + 4]
mov edx, dword [eax + edx*8]
xor ebx, ebx
cmp dword [0x6928c0], ebx
mov dword [esp + 0x20], ecx
mov ecx, 3
mov eax, 4
mov dword [esp + 0x1c], edx
mov dword [esp + 0x670], ecx
mov dword [esp + 0x674], esi
mov dword [esp + 0x678], esi
mov dword [esp + 0x67c], eax
mov dword [esp + 0x680], ecx
mov dword [esp + 0x684], eax
mov word [esp + 0x688], bx
jne 0x4ebe35
push 0xa
push 0x80
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
add eax, 2
mov dword [0x690b40], eax
mov dword [0x6928c0], esi
jmp 0x4ebe3a
mov eax, dword [0x690b40]
movzx edi, word [eax + 0x24]
add edi, 0x4e
call fcn.0057ee1a
mov eax, dword [eax + 4]
mov edx, dword [eax + 0x44]
push 0x100
lea ecx, [esp + 0x68c]
push ecx
push edi
push edx
call dword [sym.imp.USER32.dll_LoadStringW]
cmp dword [0x6928c0], 0
jne 0x4ebe99
push 0xa
push 0x80
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
add eax, 2
mov dword [0x690b40], eax
mov dword [0x6928c0], esi
jmp 0x4ebe9e
mov eax, dword [0x690b40]
movzx edi, word [eax + 0x24]
add edi, 0x4f
call fcn.0057ee1a
mov eax, dword [eax + 4]
mov edx, dword [eax + 0x44]
push 0x100
lea ecx, [esp + 0x88c]
push ecx
push edi
push edx
call dword [sym.imp.USER32.dll_LoadStringW]
cmp dword [0x6928c0], 0
jne 0x4ebefd
push 0xa
push 0x80
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
add eax, 2
mov dword [0x690b40], eax
mov dword [0x6928c0], esi
jmp 0x4ebf02
mov eax, dword [0x690b40]
movzx edi, word [eax + 0x24]
add edi, 0x50
call fcn.0057ee1a
mov eax, dword [eax + 4]
mov edx, dword [eax + 0x44]
push 0x100
lea ecx, [esp + 0xa8c]
push ecx
push edi
push edx
call dword [sym.imp.USER32.dll_LoadStringW]
mov edi, dword [esp + 0x10]
push 9
push edi
lea eax, [esp + 0x678]
call fcn.00434ef0
add esp, 8
test eax, eax
jle 0x4ebf4a
cmp eax, 0x14
mov ebx, eax
jge 0x4ebfa1
mov eax, dword [esp + 0x1c]
push eax
mov eax, dword [esp + 0x24]
push 0x3ec
push edi
call fcn.004b17e0
add esp, 0xc
cmp eax, ebx
jle 0x4ebf67
mov ebx, eax
cmp ebx, 0x14
jge 0x4ebfa1
push 0
push 0x3ed
push edi
xor eax, eax
call fcn.004b17e0
add esp, 0xc
cmp eax, ebx
jle 0x4ebf84
mov ebx, eax
cmp ebx, 0x14
jge 0x4ebfa1
push 0
push 0x387
push edi
xor eax, eax
call fcn.004b17e0
add esp, 0xc
cmp eax, ebx
jle 0x4ebfa1
mov ebx, eax
mov eax, dword [esp + 0xc]
cmp ebx, eax
jle 0x4ebfaf
mov eax, ebx
mov dword [esp + 0xc], eax
cmp eax, 0x14
jge 0x4ec038
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov esi, 1
add edx, esi
cmp edx, dword [ecx + 0x28]
mov dword [esp + 0x14], edx
jl 0x4ebdb0
cmp dword [esp + 0xc], 0x14
jge 0x4ec038
mov ecx, dword [esp + 0x10]
push 0
push 0x385
push ecx
xor eax, eax
call fcn.004b17e0
add esp, 0xc
cmp dword [esp + 0xc], 0
jne 0x4ec038
mov eax, dword [esp + 0x18]
cmp dword [0x690cac], eax
mov dword [eax + 0x50], 0
jne 0x4ec038
test byte [0x691c08], 0x10
jne 0x4ec038
or dword [0x691c08], 0x10
cmp dword [0x691c00], 0
jne 0x4ec038
push 0x14
push 0x4c4f10
push 0x691be8
call fcn.00454530
add esp, 0xc
call fcn.00489dd0
mov esi, dword [esp + 0x28]
mov ebx, esi
call fcn.004d87e0
cmp dword [esp + 0xc], 9
je 0x4ec099
cmp dword [esp + 0xc], 0
jne 0x4ec099
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x2c]
push edx
push eax
call fcn.004b2860
mov edi, eax
add esp, 8
test edi, edi
je 0x4ec099
mov ecx, dword [esp + 0x2c]
push ecx
mov ecx, dword [ebp + 8]
push edi
call fcn.00587e71
push edi
call fcn.005ce619
mov eax, dword [esp + 0x58]
add esp, 4
xor edx, edx
call fcn.00404050
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esp + 0x10]
test ax, ax
je 0x4ec0a7
call fcn.004b0c50
mov eax, dword [esp + 0x54]
xor edx, edx
call fcn.00404050
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 8
add ebx, 0x134
push ebx
call fcn.005877eb
cmp eax, 8
je 0x4ec0b2
push 0
push 3
call fcn.0058845d
int3