Function at 0x43a9e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x2009c
call fcn.004b57a0
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
test edi, edi
je 0x43b0cb
cmp word [edi], 0
je 0x43b0cb
mov ebx, dword [0x4e9074]
mov eax, dword [0x4e9d58]
cmp ebx, eax
jl 0x43ac20
cmp ebx, 0xffff
jl 0x43aafd
mov ecx, dword [esi + 0x644]
mov al, byte [0x4ea604]
test ecx, ecx
je 0x43aa97
test al, al
je 0x43aa97
mov eax, dword [0x4e47f8]
cmp dword [eax + 0x34], 0
jne 0x43aa78
cmp dword [esi + 0x67c], 0
jne 0x43aa78
cmp byte [0x4e9ec6], 0
jne 0x43aa78
push 0
push ecx
push 0x4ceea8
push 0
push 0x4d6f8c
mov ecx, esi
call fcn.0040d460
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0
push 0
push ecx
push 0x4ceea8
push 0x4d6f8c
mov ecx, esi
call fcn.0040c280
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp byte [0x4ea607], 0
je 0x43aadb
test al, al
jne 0x43aadb
test ecx, ecx
je 0x43aab1
movzx eax, word [ecx + 2]
mov ecx, dword [ecx + 4]
jmp 0x43aabd
mov eax, dword [esi + 0x27c]
mov ecx, dword [esi + 0x280]
push ecx
push eax
push 0x4ceea8
push 0x4d6f8c
mov ecx, esi
call fcn.0040c730
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0
push 0
push 0x4ceea8
push 0
push 0x4d6f8c
mov ecx, esi
call fcn.0040d460
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
test eax, eax
je 0x43ab13
lea ebx, [eax + eax]
cmp ebx, 0xffff
jle 0x43ab18
mov ebx, 0xffff
jmp 0x43ab18
mov ebx, 0x64
lea eax, [ebx*4]
push eax
push dword [0x4e9070]
call fcn.0049efb8
mov ecx, eax
add esp, 8
test ecx, ecx
jne 0x43ac0c
mov ecx, dword [esi + 0x644]
mov al, byte [0x4ea604]
test ecx, ecx
je 0x43aba6
test al, al
je 0x43aba6
mov eax, dword [0x4e47f8]
cmp dword [eax + 0x34], 0
jne 0x43ab87
cmp dword [esi + 0x67c], 0
jne 0x43ab87
cmp byte [0x4e9ec6], 0
jne 0x43ab87
push 0
push ecx
push 0x4ceea8
push 0
push 0x4d27a0
mov ecx, esi
call fcn.0040d460
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0
push 0
push ecx
push 0x4ceea8
push 0x4d27a0
mov ecx, esi
call fcn.0040c280
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp byte [0x4ea607], 0
je 0x43abea
test al, al
jne 0x43abea
test ecx, ecx
je 0x43abc0
movzx eax, word [ecx + 2]
mov ecx, dword [ecx + 4]
jmp 0x43abcc
mov eax, dword [esi + 0x27c]
mov ecx, dword [esi + 0x280]
push ecx
push eax
push 0x4ceea8
push 0x4d27a0
mov ecx, esi
call fcn.0040c730
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0
push 0
push 0x4ceea8
push 0
push 0x4d27a0
mov ecx, esi
call fcn.0040d460
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov dword [0x4e9d58], ebx
mov ebx, dword [0x4e9074]
mov dword [0x4e9070], ecx
jmp 0x43ac26
mov ecx, dword [0x4e9070]
movzx eax, word [edi]
test ebx, ebx
jne 0x43ac3f
cmp eax, 0x2a
je 0x43ac44
mov eax, dword [esi + 0x6b4]
mov dword [ecx], eax
jmp 0x43acc6
cmp eax, 0x2a
jne 0x43ac6e
push 0x7fff
lea eax, [esp + 0x2c]
push edi
push eax
call fcn.004aa484
xor eax, eax
add esp, 0xc
mov word [esp + 0x10026], ax
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
jmp 0x43ac84
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x2c]
push eax
push 0x8000
push edi
call dword [sym.imp.KERNEL32.DLL_GetFullPathNameW]
cmp byte [ebp + 0x10], 0
jne 0x43acba
xor edi, edi
test ebx, ebx
jle 0x43acb7
push 1
push 0xffffffffffffffff
lea eax, [esp + 0x30]
push eax
mov eax, dword [0x4e9070]
push 0xffffffffffffffff
push dword [eax + edi*4]
call dword [sym.imp.KERNEL32.DLL_CompareStringOrdinal]
sub eax, 2
je 0x43afbd
inc edi
cmp edi, ebx
jl 0x43ac90
mov edi, dword [ebp + 0xc]
mov eax, dword [0x4e9070]
mov dword [eax + ebx*4], 0
cmp word [edi], 0x2a
mov eax, dword [0x4e4804]
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov byte [esp + 0x24], 0
jne 0x43adf9
cmp word [edi + 2], 0
lea eax, [edi + 2]
je 0x43adf9
push 0xa
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov dword [esp + 0x10], eax
test eax, eax
je 0x43adf9
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
je 0x43ae70
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov dword [esp + 0x1c], eax
test eax, eax
je 0x43ae70
push dword [esp + 0x10]
push 0
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x1c]
push 0x44
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], 0xfde9
call fcn.0049b5a6
mov edi, eax
add esp, 4
mov dword [esp + 0x10], edi
mov ecx, dword [0x4ea7fc]
mov dword [edi], vtable.TextStream.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0xffffffff
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
cmp ecx, 0xffffffff
je 0x43adbb
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_GetCPInfo]
test eax, eax
jne 0x43adbb
mov byte [edi + 0x1a], al
mov eax, dword [ebp + 8]
mov dword [edi], vtable.TextMem.0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov byte [edi + 0x3c], 1
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov byte [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [eax], edi
mov edi, dword [ebp + 0xc]
jmp 0x43ae73
push 0x38
call fcn.0049b5a6
mov edi, eax
add esp, 4
mov dword [esp + 0x10], edi
mov ecx, dword [0x4ea7fc]
mov dword [edi], vtable.TextStream.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0xffffffff
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
cmp ecx, 0xffffffff
je 0x43ae59
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_GetCPInfo]
test eax, eax
jne 0x43ae59
mov byte [edi + 0x1a], al
mov eax, dword [ebp + 8]
mov dword [edi], vtable.TextFile.0
mov dword [edi + 0x34], 0xffffffff
mov dword [eax], edi
mov edi, dword [ebp + 0xc]
jmp 0x43ae73
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
test ecx, ecx
je 0x43afb7
push dword [esp + 0x18]
push 0x30c
push dword [esp + 0x1c]
call fcn.0047ed60
test al, al
je 0x43afb7
mov ecx, dword [0x4e9070]
cmp dword [ecx + ebx*4], 0
jne 0x43af0d
cmp word [esp + 0x28], 0
je 0x43af05
lea edi, [esp + 0x28]
lea ecx, [edi + 2]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x43aeb2
sub edi, ecx
sar edi, 1
lea eax, [edi + edi]
lea ecx, [eax + 2]
mov dword [esp + 0x14], eax
call fcn.0047e560
mov dword [esp + 0x10], eax
test eax, eax
je 0x43b0d6
test edi, edi
mov edi, dword [esp + 0x14]
je 0x43aef7
push edi
lea ecx, [esp + 0x2c]
push ecx
push eax
call fcn.0049cad0
mov eax, dword [esp + 0x1c]
add esp, 0xc
xor ecx, ecx
mov word [edi + eax], cx
mov ecx, dword [0x4e9070]
jmp 0x43af0a
mov eax, 0x4ceea8
mov dword [ecx + ebx*4], eax
inc dword [0x4e9074]
test ebx, ebx
jne 0x43af76
push 0xa
push 2
push ebx
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
test eax, eax
je 0x43af3c
push ebx
push ebx
push 0x4d7018
mov ecx, esi
call fcn.0043b0e0
test eax, eax
je 0x43b0cb
mov eax, dword [esi + 0x6e0]
test eax, eax
je 0x43af5a
push 0
push 0
push eax
mov ecx, esi
call fcn.0043b0e0
test eax, eax
je 0x43b0cb
push dword [esi + 0x6b8]
call fcn.00450220
add esp, 4
mov eax, 3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea eax, [esp + 0x28]
push 0x5c
push eax
call fcn.0049c97e
mov esi, eax
add esp, 8
lea eax, [esp + 0x28]
cmp esi, eax
jbe 0x43afa9
xor eax, eax
mov word [esi], ax
lea eax, [esp + 0x28]
push eax
call fcn.00450220
mov eax, 0x5c
add esp, 4
mov word [esi], ax
mov eax, 3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp byte [ebp + 0x14], 0
je 0x43afcb
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push edi
mov ecx, 0x4d6fc8
test ebx, ebx
mov eax, 0x4d6fb4
cmove eax, ecx
push eax
push 0x4d6fd8
lea eax, [esp + 0x10034]
push 0x8040
push eax
call fcn.00481800
mov ecx, dword [esi + 0x644]
add esp, 0x14
mov al, byte [0x4ea604]
test ecx, ecx
je 0x43b06a
test al, al
je 0x43b06a
mov eax, dword [0x4e47f8]
cmp dword [eax + 0x34], 0
jne 0x43b048
cmp dword [esi + 0x67c], 0
jne 0x43b048
cmp byte [0x4e9ec6], 0
jne 0x43b048
push 0
push ecx
push 0x4ceea8
push 0
lea eax, [esp + 0x10038]
mov ecx, esi
push eax
call fcn.0040d460
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0
push 0
push ecx
push 0x4ceea8
lea eax, [esp + 0x10038]
mov ecx, esi
push eax
call fcn.0040c280
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp byte [0x4ea607], 0
je 0x43b0b1
test al, al
jne 0x43b0b1
test ecx, ecx
je 0x43b084
movzx eax, word [ecx + 2]
mov ecx, dword [ecx + 4]
jmp 0x43b090
mov eax, dword [esi + 0x27c]
mov ecx, dword [esi + 0x280]
push ecx
push eax
push 0x4ceea8
lea eax, [esp + 0x10034]
mov ecx, esi
push eax
call fcn.0040c730
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0
push 0
push 0x4ceea8
push 0
lea eax, [esp + 0x10038]
mov ecx, esi
push eax
call fcn.0040d460
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
call fcn.0040dbe0
int3