Function at 0x491980
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4daead
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc8
push ebx
mov ebx, ecx
mov dword [ebp - 0x1c], 0
push esi
push edi
mov dword [ebp - 0x14], ebx
cmp dword [ebx + 0xe0], 0
je 0x491a52
mov edx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x24], 7
mov dword [ebp - 0x28], 0
mov word [ebp - 0x38], ax
mov edx, dword [edx + 8]
cmp word [edx], ax
jne 0x4919dd
xor ecx, ecx
jmp 0x4919f1
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4919e2
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x38]
call fcn.0049f900
mov dword [ebp - 0x1c], 1
lea ecx, [ebp - 0x38]
mov eax, dword [ebx + 0xe0]
push ecx
mov ecx, eax
mov dword [ebp - 0x48], eax
mov edi, dword [eax]
call fcn.00486cb0
mov esi, eax
mov eax, dword [ebp - 0x48]
cmp esi, dword [eax]
je 0x491a48
cmp dword [esi + 0x24], 8
lea ecx, [esi + 0x10]
jb 0x491a2c
mov ecx, dword [ecx]
cmp dword [ebp - 0x24], 8
lea eax, [ebp - 0x38]
push ecx
cmovae eax, dword [ebp - 0x38]
push eax
call fcn.004ab832
add esp, 8
test eax, eax
jns 0x491a4a
mov eax, dword [ebp - 0x48]
mov esi, dword [eax]
mov byte [ebp - 0xd], 1
cmp esi, edi
jne 0x491a56
mov byte [ebp - 0xd], 0
test byte [ebp - 0x1c], 1
je 0x491a71
mov eax, dword [ebp - 0x24]
cmp eax, 8
jb 0x491a71
inc eax
lea ecx, [ebp - 0x38]
push eax
push dword [ebp - 0x38]
call fcn.0049f780
cmp byte [ebp - 0xd], 0
je 0x491fbd
add ebx, 8
push 1
mov ecx, ebx
call fcn.00493590
mov eax, 0xf9
mov ecx, ebx
mov word [ebp - 0x1c], ax
push dword [ebp - 0x1c]
call fcn.004934e0
push str.Secure.Net.Host.Runtime.HostAssemblyStore__HostAssemblyProviderResource:_Requested_Assembly_found_in_dictionary._Trying_to_decrypt_from_Resource_Library...
mov ecx, ebx
call fcn.00493420
mov ecx, eax
call fcn.00493640
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], 7
mov dword [ebp - 0x28], 0
mov edx, dword [eax + 8]
xor eax, eax
mov word [ebp - 0x38], ax
cmp word [edx], ax
jne 0x491ad0
xor ecx, ecx
jmp 0x491ae4
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x491ad5
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x38]
call fcn.0049f900
mov dword [ebp - 4], 0
lea eax, [ebp - 0x38]
mov edi, dword [ebp - 0x14]
push eax
mov edi, dword [edi + 0xe0]
mov ecx, edi
call fcn.00486cb0
mov esi, eax
cmp esi, dword [edi]
je 0x491fb3
cmp dword [esi + 0x24], 8
lea ecx, [esi + 0x10]
jb 0x491b1e
mov ecx, dword [ecx]
cmp dword [ebp - 0x24], 8
lea eax, [ebp - 0x38]
push ecx
cmovae eax, dword [ebp - 0x38]
push eax
call fcn.004ab832
add esp, 8
test eax, eax
js 0x491fb3
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x24]
cmp eax, 8
jb 0x491b57
inc eax
lea ecx, [ebp - 0x38]
push eax
push dword [ebp - 0x38]
call fcn.0049f780
xor eax, eax
mov dword [ebp - 0x24], 7
lea edi, [esi + 0x30]
mov dword [ebp - 0x28], 0
mov word [ebp - 0x38], ax
mov byte [ebp - 0x14], al
cmp dword [edi + 0x10], eax
jbe 0x491b9a
cmp dword [edi + 0x14], 8
jb 0x491b8b
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov byte [ebp - 0x14], 1
jmp 0x491ba2
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov byte [ebp - 0x14], 1
jmp 0x491ba2
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 1
test ecx, ecx
jne 0x491c07
cmp dword [edi + 0x14], 8
jb 0x491bba
mov edi, dword [edi]
push 3
mov ecx, ebx
call fcn.00493590
mov eax, 0xf8
mov ecx, ebx
mov word [ebp + 8], ax
push dword [ebp + 8]
call fcn.004934e0
push str._not_found...
push edi
push str.Secure.Net.Host.Runtime.HostAssemblyStore__HostAssemblyProviderResource:_Resource_Library
mov ecx, ebx
call fcn.00493420
mov ecx, eax
call fcn.00493420
mov ecx, eax
call fcn.00493420
mov ecx, eax
call fcn.00493640
mov esi, 0x80070002
jmp 0x491efc
mov eax, dword [esi + 0x28]
push 0xa
movzx eax, ax
push eax
push ecx
mov dword [ebp - 0x44], 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
je 0x491c51
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x40], eax
test eax, eax
je 0x491c51
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push dword [ebp + 8]
mov dword [ebp - 0x44], eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x3c], eax
jmp 0x491c54
mov eax, dword [ebp - 0x3c]
mov byte [ebp - 4], 3
cmp dword [ebp - 0x44], 0
jne 0x491cf2
mov edx, dword [esi + 0x28]
lea ecx, [ebp - 0x5c]
call fcn.00492080
mov esi, eax
mov byte [ebp - 4], 4
cmp dword [edi + 0x14], 8
jb 0x491c7b
mov edi, dword [edi]
cmp dword [esi + 0x14], 8
jb 0x491c83
mov esi, dword [esi]
push 3
mov ecx, ebx
call fcn.00493590
mov eax, 0xf8
mov ecx, ebx
mov word [ebp + 8], ax
push dword [ebp + 8]
call fcn.004934e0
push 0x4ff6c8
push edi
push str._not_found_in_Resource_Library
push esi
push str.Secure.Net.Host.Runtime.HostAssemblyStore__HostAssemblyProviderResource:_Resource_Id
mov ecx, ebx
call fcn.00493420
mov ecx, eax
call fcn.00493420
mov ecx, eax
call fcn.00493420
mov ecx, eax
call fcn.00493420
mov ecx, eax
call fcn.00493420
mov ecx, eax
call fcn.00493640
lea ecx, [ebp - 0x5c]
call fcn.0049eeb0
mov edi, dword [sym.imp.KERNEL32.dll_FreeResource]
mov esi, 0x80070002
jmp 0x491ef7
push eax
call fcn.004a0252
add esp, 4
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x1c], 0
push eax
call fcn.0048e3e0
mov byte [ebp - 4], 6
mov edi, dword [ebp - 0x3c]
push edi
push dword [ebp - 0x44]
push dword [ebp - 0x20]
call fcn.004a4c50
add esp, 0xc
lea eax, [ebp - 0x20]
push edi
sub esp, 8
mov ecx, esp
push eax
call fcn.00491200
lea ecx, [ebp - 0xd4]
call fcn.004910d0
mov byte [ebp - 4], 7
cmp byte [ebp - 0x5f], 0
jne 0x491f2c
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0xd4]
call fcn.004914f0
mov eax, dword [esi + 0x60]
mov edi, 0xce
sub eax, 1
je 0x491dcd
sub eax, 1
je 0x491dbc
push 3
mov ecx, ebx
call fcn.00493590
mov word [ebp + 8], di
mov ecx, ebx
push dword [ebp + 8]
call fcn.004934e0
push str.Secure.Net.Host.Runtime.HostAssemblyStore__HostAssemblyProviderResource:_Unknown_Encryption_Algorithm_for_Requested_Assembly.
mov ecx, ebx
call fcn.00493420
mov ecx, eax
call fcn.00493640
push 3
mov ecx, ebx
call fcn.00493590
mov word [ebp + 8], di
mov ecx, ebx
push dword [ebp + 8]
call fcn.004934e0
push str.Secure.Net.Host.Runtime.HostAssemblyStore__HostAssemblyProviderResource:_Failed_to_decrypt_Assembly_
jmp 0x491f4d
mov edx, dword [ebp - 0x48]
lea eax, [esi + 0x48]
mov ecx, dword [ebp - 0x4c]
push eax
call fcn.00491800
jmp 0x491ddc
mov edx, dword [ebp - 0x48]
lea eax, [esi + 0x48]
mov ecx, dword [ebp - 0x4c]
push eax
call fcn.00491620
add esp, 4
test al, al
je 0x491d9b
push 1
mov ecx, ebx
call fcn.00493590
mov eax, 0xf2
mov ecx, ebx
mov word [ebp + 8], ax
push dword [ebp + 8]
call fcn.004934e0
push str.Secure.Net.Host.Runtime.HostAssemblyStore__HostAssemblyProviderResource:_Assembly_successfully_decrypted.
mov ecx, ebx
call fcn.00493420
mov ecx, eax
call fcn.00493640
mov ecx, dword [ebp + 0xc]
mov eax, dword [esi + 0x64]
mov dword [ecx], eax
mov eax, dword [ebp + 0x10]
mov dword [ecx + 4], 0
mov dword [eax], 0x4d414e4e
mov dword [eax + 4], 0x53454c4c
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x491ebd
push eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x50]
call fcn.004918f0
mov byte [ebp - 4], 8
mov ecx, ebx
mov esi, dword [ebp - 0x50]
push 1
call fcn.00493590
mov eax, 0xf8
mov ecx, ebx
mov word [ebp + 8], ax
push dword [ebp + 8]
call fcn.004934e0
mov ecx, ebx
test esi, esi
jne 0x491e90
push str.Secure.Net.Host.Runtime.HostAssemblyStore__HostAssemblyProviderResource:_Assembly_PDB_File_not_loaded.
call fcn.00493420
mov ecx, eax
call fcn.00493640
push dword [ebp - 0x4c]
mov edi, dword [sym.imp.KERNEL32.dll_FreeResource]
call edi
jmp 0x491ec3
push str.Secure.Net.Host.Runtime.HostAssemblyStore__HostAssemblyProviderResource:_Assembly_PDB_resolved.
call fcn.00493420
mov ecx, eax
call fcn.00493640
push dword [ebp - 0x48]
push esi
call dword [sym.imp.SHLWAPI.dll_SHCreateMemStream]
mov ecx, dword [ebp + 0x18]
push dword [ebp - 0x4c]
mov edi, dword [sym.imp.KERNEL32.dll_FreeResource]
mov dword [ecx], eax
call edi
jmp 0x491ec3
mov edi, dword [sym.imp.KERNEL32.dll_FreeResource]
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0xd4]
call fcn.00491960
push dword [eax + 4]
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_SHCreateMemStream]
mov ecx, dword [ebp + 0x14]
xor esi, esi
mov dword [ecx], eax
lea ecx, [ebp - 0xd4]
call fcn.004913e0
lea ecx, [ebp - 0x20]
call fcn.004912c0
push dword [ebp - 0x40]
call edi
mov dword [ebp - 4], 9
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x491f17
cmp byte [ebp - 0x14], 0
je 0x491f17
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
push 2
mov ecx, ebx
call fcn.00493590
mov eax, 0xf8
mov ecx, ebx
mov word [ebp + 8], ax
push dword [ebp + 8]
call fcn.004934e0
push str.Secure.Net.Host.Runtime.HostAssemblyStore__HostAssemblyProviderResource:_Requested_Assembly_is_not_encrypted._Skipping_Decryption.
mov ecx, ebx
call fcn.00493420
mov ecx, eax
call fcn.00493640
lea ecx, [ebp - 0xd4]
call fcn.004913e0
mov byte [ebp - 4], 0xa
mov esi, dword [ebp - 0x1c]
test esi, esi
je 0x491f92
or edi, 0xffffffff
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x491f92
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x491f92
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov dword [ebp - 4], 0xb
cmp byte [ebp - 0x14], 0
je 0x491fef
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x491fef
push str.invalid_map_K__T__key
call fcn.004a0dba
push 2
lea ecx, [ebx + 8]
call fcn.00493590
mov eax, 0xf8
lea ecx, [ebx + 8]
mov word [ebp + 8], ax
push dword [ebp + 8]
call fcn.004934e0
push str.Secure.Net.Host.Runtime.HostAssemblyStore__HostAssemblyProviderResource:_Requested_Assembly_not_found_in_dictionary.
lea ecx, [ebx + 8]
call fcn.00493420
mov ecx, eax
call fcn.00493640
mov ecx, dword [ebp - 0xc]
mov eax, 0x80070002
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x14