Function at 0x44dbcf
Capabilities:
Extract resource via kernel32 functions
Get file size
Read file on windows

Disassembly:
push 0x1e8
mov eax, 0x471b7a
call fcn.0046c277
mov esi, dword [ebp + 0xc]
xor ebx, ebx
cmp esi, ebx
je 0x44dc84
push esi
call sub.MSVCR100.dll_strlen
pop ecx
test eax, eax
je 0x44dc84
push esi
push dword [ebp + 8]
call fcn.0043b95d
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
mov dword [ebp - 0x1c8], esi
cmp esi, ebx
je 0x44de2e
push esi
call fcn.0043b95d
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x1c0], eax
push esi
cmp eax, ebx
jne 0x44dc3d
call dword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x44de2e
call fcn.0043b95d
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
cmp esi, ebx
je 0x44de2e
push esi
call fcn.0043903a
pop ecx
push esi
push dword [ebp - 0x1c0]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push edi
call sub.MSVCR100.dll_memcpy
add esp, 0xc
push dword [ebp - 0x1c8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x44de2a
call fcn.0043b96c
push eax
lea ecx, [ebp - 0x80]
call fcn.00439aec
mov dword [ebp - 4], ebx
call fcn.0043b972
mov ecx, eax
call fcn.004394d5
test al, al
je 0x44dd43
push dword [ebp + 8]
lea ecx, [ebp - 0x80]
call fcn.00439536
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
lea ecx, [ebp - 0x80]
call fcn.00439451
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x1b8], eax
cmp eax, 0xffffffff
jne 0x44dcef
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x80]
call fcn.00439431
jmp 0x44de2e
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, ebx
je 0x44dcde
push esi
mov dword [ebp - 0x1c4], ebx
call fcn.0043903a
pop ecx
push ebx
mov edi, eax
lea eax, [ebp - 0x1c4]
push eax
push esi
push edi
push dword [ebp - 0x1b8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0x1b8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x1c4], esi
je 0x44de1e
push edi
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
pop ecx
jmp 0x44dcde
call fcn.0043b972
push eax
lea ecx, [ebp - 0x80]
call fcn.00439519
call fcn.0043b978
test al, al
je 0x44dd61
call fcn.0043b97e
jmp 0x44dd75
push 2
push ebx
lea ecx, [ebp - 0x80]
call fcn.00439451
push eax
call fcn.00455c38
add esp, 0xc
mov dword [ebp - 0x1b0], eax
cmp eax, ebx
je 0x44dcde
lea eax, [ebp - 0x1ac]
push eax
lea eax, [ebp - 0x1c0]
push eax
push 1
push dword [ebp + 8]
push dword [ebp - 0x1b0]
call fcn.00454420
add esp, 0x14
test eax, eax
jne 0x44dcde
mov esi, dword [ebp - 0x84]
cmp esi, ebx
je 0x44dcde
push esi
call fcn.0043903a
push 3
push esi
mov edi, eax
push edi
push dword [ebp - 0x1c0]
push dword [ebp - 0x1b0]
call fcn.00455c96
add esp, 0x18
cmp eax, ebx
je 0x44de09
cmp eax, 0x600
je 0x44de09
push edi
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
pop ecx
call fcn.0043b978
test al, al
jne 0x44dcde
push dword [ebp - 0x1b0]
call fcn.00455cce
jmp 0x44dd40
call fcn.0043b978
test al, al
jne 0x44de1e
push dword [ebp - 0x1b0]
call fcn.00455cce
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x80]
call fcn.00439431
cmp edi, ebx
jne 0x44dead
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x1b8], eax
cmp eax, 0xffffffff
je 0x44dea6
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, ebx
je 0x44dea6
push esi
mov dword [ebp - 0x1bc], ebx
call fcn.0043903a
pop ecx
push ebx
mov edi, eax
lea eax, [ebp - 0x1bc]
push eax
push esi
push edi
push dword [ebp - 0x1b8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0x1b8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x1bc], esi
je 0x44dea2
push edi
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
pop ecx
xor edi, edi
cmp edi, ebx
jne 0x44dead
xor eax, eax
jmp 0x44e1a4
push 0x24
mov dword [ebp - 0x1d0], ebx
call sub.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0x1dc], eax
mov dword [ebp - 4], 1
cmp eax, ebx
je 0x44dedb
mov ecx, eax
call fcn.0046ba82
mov dword [ebp - 0x1cc], eax
jmp 0x44dee1
mov dword [ebp - 0x1cc], ebx
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x1d8]
push eax
push 4
lea eax, [ebp - 0x1f4]
push eax
lea eax, [ebp - 0x1d0]
push eax
push esi
push edi
mov dword [ebp - 0x1d8], ebx
call fcn.0046ba28
mov esi, eax
push edi
mov dword [ebp - 0x1dc], esi
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
mov ecx, dword [ebp - 0x1cc]
add esp, 0x1c
push dword [ebp - 0x1d8]
call fcn.0046bb1a
mov dword [ebp - 0x1b8], ebx
cmp dword [ebp - 0x1d0], ebx
jle 0x44e192
lea edi, [esi + 8]
mov dword [ebp - 0x1c0], edi
mov ecx, dword [edi]
mov eax, dword [edi - 8]
mov esi, dword [edi - 4]
mov dword [ebp - 0x1c8], ecx
mov ecx, dword [edi + 4]
mov dword [ebp - 0x1e4], ecx
mov ecx, dword [edi + 8]
mov dword [ebp - 0x1c4], eax
mov dword [ebp - 0x1e0], esi
mov dword [ebp - 0x1ec], ecx
cmp eax, ebx
jne 0x44df7c
push ebx
jmp 0x44e16b
push 0x2c
lea eax, [ebp - 0x3c]
push ebx
push eax
call sub.MSVCR100.dll_memset
mov dword [ebp - 0x38], esi
mov esi, dword [ebp - 0x1c8]
add esp, 0xc
mov eax, esi
imul esi, dword [ebp - 0x1e0]
neg eax
mov dword [ebp - 0x34], eax
xor eax, eax
inc eax
push 0x20
mov word [ebp - 0x30], ax
pop eax
mov word [ebp - 0x2e], ax
push ebx
mov eax, esi
shl eax, 2
push ebx
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x1b0]
push eax
push ebx
lea eax, [ebp - 0x3c]
push eax
push ebx
mov dword [ebp - 0x3c], 0x28
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x1d4], esi
mov byte [ebp - 0x1b1], bl
mov dword [ebp - 0x1b0], ebx
call dword [sym.imp.GDI32.dll_CreateDIBSection]
mov dword [ebp - 0x1f0], eax
cmp eax, ebx
je 0x44e165
mov dword [ebp - 0x1bc], ebx
cmp esi, ebx
jle 0x44e0f7
mov ecx, dword [ebp - 0x1bc]
mov eax, dword [ebp - 0x1c4]
mov edx, dword [ebp - 0x1b0]
shl ecx, 2
lea esi, [eax + ecx + 3]
mov al, byte [esi]
mov byte [ecx + edx + 3], al
mov eax, dword [ebp - 0x1b0]
add eax, ecx
cmp byte [eax + 3], 0xff
mov dword [ebp - 0x1e8], eax
jae 0x44e08a
movzx edx, byte [esi]
movzx eax, byte [esi - 1]
imul eax, edx
xor edx, edx
mov edi, 0xff
div edi
mov edx, dword [ebp - 0x1e8]
mov byte [ebp - 0x1b1], 1
mov byte [edx], al
movzx edx, byte [esi]
movzx eax, byte [esi - 2]
imul eax, edx
xor edx, edx
div edi
mov edx, dword [ebp - 0x1b0]
mov byte [ecx + edx + 1], al
movzx edx, byte [esi]
movzx eax, byte [esi - 3]
imul eax, edx
mov esi, edi
mov edi, dword [ebp - 0x1c0]
xor edx, edx
div esi
jmp 0x44e09f
mov dl, byte [esi - 1]
mov byte [eax], dl
mov al, byte [esi - 2]
mov edx, dword [ebp - 0x1b0]
mov byte [ecx + edx + 1], al
mov al, byte [esi - 3]
mov edx, dword [ebp - 0x1b0]
mov byte [ecx + edx + 2], al
mov eax, dword [ebp - 0x1b0]
mov edx, dword [eax + ecx]
cmp edx, dword [ebp + 0x10]
jne 0x44e0df
mov byte [eax + ecx], bl
mov eax, dword [ebp - 0x1b0]
mov byte [ecx + eax + 1], bl
mov eax, dword [ebp - 0x1b0]
mov byte [ecx + eax + 2], bl
mov eax, dword [ebp - 0x1b0]
mov byte [ecx + eax + 3], bl
mov byte [ebp - 0x1b1], 1
inc dword [ebp - 0x1bc]
mov eax, dword [ebp - 0x1bc]
cmp eax, dword [ebp - 0x1d4]
jl 0x44e005
push 0x60
call sub.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
pop ecx
mov dword [ebp - 0x1d4], esi
mov dword [ebp - 4], 2
cmp esi, ebx
je 0x44e11e
lea ecx, [esi + 0x10]
call fcn.0043940f
mov eax, esi
jmp 0x44e120
xor eax, eax
mov ecx, dword [ebp - 0x1f0]
or dword [ebp - 4], 0xffffffff
mov dword [eax], ecx
mov ecx, dword [ebp - 0x1e0]
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 0x1c8]
mov dword [eax + 8], ecx
mov ecx, dword [ebp - 0x1e4]
mov dword [eax + 0x58], ecx
mov ecx, dword [ebp - 0x1ec]
mov dword [eax + 0x5c], ecx
mov cl, byte [ebp - 0x1b1]
mov byte [eax + 0xc], cl
mov ecx, dword [ebp - 0x1cc]
push eax
call fcn.0046bb04
push dword [ebp - 0x1c4]
call fcn.0046a878
inc dword [ebp - 0x1b8]
mov eax, dword [ebp - 0x1b8]
add edi, 0x14
pop ecx
mov dword [ebp - 0x1c0], edi
cmp eax, dword [ebp - 0x1d0]
jl 0x44df46
push dword [ebp - 0x1dc]
call fcn.0046a878
mov eax, dword [ebp - 0x1cc]
pop ecx
call fcn.0046c2c1
ret