Function at 0x1000d9ce
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x154
mov eax, 0x101bf9a0
call fcn.10093249
mov dword [ebp - 0x128], ecx
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
push 0x3c8
xor edi, edi
push edi
push ebx
call fcn.100932c0
add esp, 0xc
mov dword [ebp - 0x130], 1
mov dword [ebp - 0x120], edi
mov dword [ebp - 0x138], edi
mov dword [ebp - 4], edi
mov eax, dword [ebp - 0x128]
cmp dword [eax + 4], edi
je 0x1000da2a
push 2
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x1000da8b
mov byte [ebp - 0x118], 0
push 0x103
push edi
lea eax, [ebp - 0x117]
push eax
call fcn.100932c0
push 0x104
lea eax, [ebp - 0x118]
push eax
push 0xffffffffffffffff
push esi
call fcn.1001b06c
add esp, 0x1c
test eax, eax
jne 0x1000da7b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x158], eax
push 0x102168c0
lea eax, [ebp - 0x158]
push eax
call fcn.10095377
push 2
push edi
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov dword [ebp - 0x120], eax
cmp eax, edi
jne 0x1000daae
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x13c], eax
push 0x102168c0
lea eax, [ebp - 0x13c]
jmp 0x1000da75
mov dword [ebp - 0x134], edi
lea eax, [ebp - 0x134]
push eax
push 0x1000d01a
push 1
push 0x10
push dword [ebp - 0x120]
call dword [sym.imp.KERNEL32.dll_EnumResourceLanguagesW]
push dword [ebp - 0x134]
push 1
push 0x10
push dword [ebp - 0x120]
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov esi, eax
cmp esi, edi
jne 0x1000db2a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x714
je 0x1000db16
cmp eax, 0x715
je 0x1000db16
mov dword [ebp - 0x144], eax
push 0x102168c0
lea eax, [ebp - 0x144]
jmp 0x1000da75
push dword [ebp - 0x120]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
inc eax
jmp 0x1000de94
push esi
push dword [ebp - 0x120]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x124], eax
push esi
push dword [ebp - 0x120]
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x1000db6a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x154], eax
push 0x102168c0
lea eax, [ebp - 0x154]
jmp 0x1000da75
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
cmp esi, edi
jne 0x1000db93
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14c], eax
push 0x102168c0
lea eax, [ebp - 0x14c]
jmp 0x1000da75
mov eax, dword [ebp - 0x124]
lea edi, [esi + eax]
mov dword [ebp - 0x11c], edi
push edi
mov eax, esi
call fcn.1000d0c6
test eax, eax
jne 0x1000dbc5
or dword [ebp - 0x15c], 0xffffffff
push 0x102168b0
lea eax, [ebp - 0x15c]
jmp 0x1000da75
push edi
mov eax, esi
call fcn.1000d088
push 0xc
pop ecx
cmp cx, word [esi + 2]
ja 0x1000dbdb
mov ecx, dword [eax + 8]
mov dword [ebx], ecx
push 0x10
pop ecx
cmp cx, word [esi + 2]
ja 0x1000dbea
mov eax, dword [eax + 0xc]
mov dword [ebx + 4], eax
push edi
call fcn.1000d0aa
mov esi, eax
push edi
mov ecx, esi
call fcn.1000d12c
test eax, eax
jne 0x1000dc15
or dword [ebp - 0x140], 0xffffffff
push 0x102168b0
lea eax, [ebp - 0x140]
jmp 0x1000da75
push 0x101dc198
mov eax, esi
call fcn.1000d106
push eax
call fcn.10093a8f
pop ecx
pop ecx
test eax, eax
jne 0x1000de60
push dword [ebp - 0x11c]
mov eax, esi
call fcn.1000d10a
mov edi, eax
push dword [ebp - 0x11c]
mov ecx, edi
call fcn.1000d190
test eax, eax
jne 0x1000dc68
or dword [ebp - 0x148], 0xffffffff
push 0x102168b0
lea eax, [ebp - 0x148]
jmp 0x1000da75
push dword [ebp - 0x11c]
mov eax, edi
call fcn.1000d16e
mov esi, eax
push dword [ebp - 0x11c]
mov ecx, esi
call fcn.1000d220
test eax, eax
jne 0x1000dc9f
or dword [ebp - 0x150], 0xffffffff
push 0x102168b0
lea eax, [ebp - 0x150]
jmp 0x1000da75
movzx eax, word [edi]
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
jle 0x1000de60
push dword [ebp - 0x11c]
mov ecx, esi
call fcn.1000d220
test eax, eax
je 0x1000de60
push dword [ebp - 0x11c]
call fcn.1000d1f4
movzx edi, ax
mov eax, esi
call fcn.1000d1ce
mov dword [ebp - 0x124], eax
push 0x101dc180
push eax
call fcn.10093a8f
pop ecx
pop ecx
test eax, eax
jne 0x1000dd1c
test edi, edi
jbe 0x1000dd1c
cmp edi, 0x50
jb 0x1000dd02
push 0x4f
pop edi
push edi
push dword [ebp - 0x11c]
mov eax, esi
call fcn.1000d1d2
push eax
lea eax, [ebx + 0x288]
jmp 0x1000de3a
push 0x101dc160
push dword [ebp - 0x124]
call fcn.10093a8f
pop ecx
pop ecx
test eax, eax
jne 0x1000dd55
test edi, edi
jbe 0x1000dd55
cmp edi, 0x50
jb 0x1000dd3e
push 0x4f
pop edi
push edi
push dword [ebp - 0x11c]
mov eax, esi
call fcn.1000d1d2
push eax
lea eax, [ebx + 8]
jmp 0x1000de3a
push 0x101dc144
push dword [ebp - 0x124]
call fcn.10093a8f
pop ecx
pop ecx
test eax, eax
jne 0x1000dd91
test edi, edi
jbe 0x1000dd91
cmp edi, 0x50
jb 0x1000dd77
push 0x4f
pop edi
push edi
push dword [ebp - 0x11c]
mov eax, esi
call fcn.1000d1d2
push eax
lea eax, [ebx + 0x148]
jmp 0x1000de3a
push 0x101dc124
push dword [ebp - 0x124]
call fcn.10093a8f
pop ecx
pop ecx
test eax, eax
jne 0x1000ddca
test edi, edi
jbe 0x1000ddca
cmp edi, 0x50
jb 0x1000ddb3
push 0x4f
pop edi
push edi
push dword [ebp - 0x11c]
mov eax, esi
call fcn.1000d1d2
push eax
lea eax, [ebx + 0x328]
jmp 0x1000de3a
push 0x101dc100
push dword [ebp - 0x124]
call fcn.10093a8f
pop ecx
pop ecx
test eax, eax
jne 0x1000de03
test edi, edi
jbe 0x1000de03
cmp edi, 0x50
jb 0x1000ddec
push 0x4f
pop edi
push edi
push dword [ebp - 0x11c]
mov eax, esi
call fcn.1000d1d2
push eax
lea eax, [ebx + 0xa8]
jmp 0x1000de3a
push 0x101dc0e8
push dword [ebp - 0x124]
call fcn.10093a8f
pop ecx
pop ecx
test eax, eax
jne 0x1000de43
test edi, edi
jbe 0x1000de43
cmp edi, 0x50
jb 0x1000de25
push 0x4f
pop edi
push edi
push dword [ebp - 0x11c]
mov eax, esi
call fcn.1000d1d2
push eax
lea eax, [ebx + 0x1e8]
push eax
call fcn.1009385c
add esp, 0xc
movzx eax, word [esi]
add eax, 3
and eax, 0xfffffffc
sub dword [ebp - 0x12c], eax
mov eax, esi
call fcn.1000d215
mov esi, eax
jmp 0x1000dca8
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x138], 0
je 0x1000de79
push dword [ebp - 0x138]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [ebp - 0x120], 0
je 0x1000de8e
push dword [ebp - 0x120]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x130]
call fcn.100932a5
ret 8