Function at 0x4027e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
invalid
push ebp
mov ebp, esp
add esp, 0xffffffbc
mov eax, 0x48e84c
call fcn.0047eb88
push edi
push ebp
push esi
or edi, 0xffffffff
inc edi
call fcn.00402af2
dec edx
dec edx
pop edx
jp 0x4027b5
cld
sti
xchg ebp, eax
arpl dx, sp
test dword [edi + 0x4c], esp
lodsb al, byte [esi]
mov dl, dh
pop edi
sbb al, 0xd4
dec edi
shl ebx, 1
pop ds
shl byte [ecx + edx*4 - 0x55], 0xfb
dec edi
jns 0x402850
stosd dword es:[edi], eax
popfd
or bl, byte [ebp - 0xb5c174c]
invalid
push 0xffffffffffffff8d
lahf
pushal
imul ecx, dword [eax], 0x8ddf2b00
xor al, 0x1e
xor ebx, dword [esp + 0x28]
mov ebx, 0x4371d2
mov ebx, dword [esi]
and ebx, 0xff
xor esi, dword [esp + 8]
rcr esi, 0x9d
push 0x16233ea
sub esi, 0xdaa6f7ae
pop esi
lea ebx, [ebx - 0x16234d2]
lea ebx, [ebx + esi]
test ebx, ebx
je 0x4028ba
mov ebp, 0x41298a
xor ebp, dword [esp + 8]
xor esi, ebp
mov edi, 0x44755e
add edi, dword [esp + 0x18]
push dword fs:[0]
jmp 0x4028ba
pop ebx
pop esi
jmp 0x402941
mov word [ebp - 0x24], 8
lea eax, [ebp - 4]
mov edx, dword [ebp + 8]
call fcn.00488b78
inc dword [ebp - 0x18]
push dword [eax]
push 0x48e32e
mov ecx, dword [0x4947b4]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x40c72c]
call fcn.0041156c
mov dword [ebp - 0x38], eax
push 0x48e337
push dword [ebp + 8]
mov eax, dword [0x4947b4]
push dword [eax]
call sub.kernel32.dll_FindResourceA
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jne 0x4029c4
push 0x10
push dword [ebp + 8]
push 0x48e340
push 0
call sub.user32.dll_MessageBoxA
xor eax, eax
push eax
dec dword [ebp - 0x18]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00488c7c
pop eax
mov edx, dword [ebp - 0x34]
mov dword fs:[0], edx
jmp 0x402b9b
push dword [ebp - 0x3c]
mov ecx, dword [0x4947b4]
push dword [ecx]
call sub.kernel32.dll_LoadResource
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jne 0x402a11
push 0x10
push dword [ebp + 8]
push 0x48e34f
push 0
call sub.user32.dll_MessageBoxA
xor eax, eax
push eax
dec dword [ebp - 0x18]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00488c7c
pop eax
mov edx, dword [ebp - 0x34]
mov dword fs:[0], edx
jmp 0x402b9b
push dword [ebp - 0x40]
call sub.kernel32.dll_LockResource
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jne 0x402a56
push 0x10
push dword [ebp + 8]
push 0x48e35c
push 0
call sub.user32.dll_MessageBoxA
xor eax, eax
push eax
dec dword [ebp - 0x18]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00488c7c
pop eax
mov edx, dword [ebp - 0x34]
mov dword fs:[0], edx
jmp 0x402b9b
mov word [ebp - 0x24], 0x14
lea eax, [ebp - 8]
mov edx, dword [ebp + 0xc]
call fcn.00488b78
inc dword [ebp - 0x18]
mov eax, dword [eax]
call fcn.0041cb84
push eax
dec dword [ebp - 0x18]
lea eax, [ebp - 8]
mov edx, 2
call fcn.00488c7c
pop ecx
test cl, cl
je 0x402ab7
mov word [ebp - 0x24], 0x20
lea eax, [ebp - 0xc]
mov edx, dword [ebp + 0xc]
call fcn.00488b78
inc dword [ebp - 0x18]
mov eax, dword [eax]
mov edx, 0x20
call fcn.0041cb94
dec dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00488c7c
mov word [ebp - 0x24], 0x2c
lea eax, [ebp - 0x10]
mov edx, dword [ebp + 0xc]
call fcn.00488b78
inc dword [ebp - 0x18]
mov edx, dword [eax]
mov eax, dword [ebp - 0x38]
call fcn.00411368
dec dword [ebp - 0x18]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00488c7c
push dword [ebp - 0x40]
call sub.kernel32.dll_FreeResource
jmp 0x402b46
jmp 0x402b7d
mov al, 1
push eax
dec dword [ebp - 0x18]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00488c7c
pop eax
mov edx, dword [ebp - 0x34]
mov dword fs:[0], edx
mov esp, ebp
pop ebp
ret