Function at 0x403f00
Capabilities:
Extract resource via kernel32 functions
Get common file path

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push ebp
mov ebp, dword [esp + 0x1c]
push esi
push edi
push 0x2a4
push 0
mov edi, eax
call ebx
mov esi, eax
test esi, esi
je 0x403f51
push 0xa4
push 0
push esi
call fcn.0051ab50
add esp, 0xc
test edi, edi
je 0x403f68
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push 0
call ebx
mov dword [esi + 0x30], eax
test eax, eax
jne 0x403f60
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov edi, 2
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
push edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ebx, dword [esp + 0x2c]
mov eax, ebx
and eax, 0x3ffffff7
sub eax, 1
mov dword [esi + 0x24], 0xffffffff
je 0x40402c
sub eax, 1
je 0x403fb4
sub eax, 2
jne 0x40409e
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
push eax
push eax
lea edi, [esi + 4]
push edi
call ebx
push eax
push ebp
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x403ff7
mov dword [edi], ebp
jmp 0x403ffd
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
lea edi, [esi + 4]
push ebp
test ebx, ebx
jns 0x403fd6
call dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x403fdc
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [edi], eax
cmp eax, 0xffffffff
jne 0x403ff7
mov edi, 1
call fcn.00403e30
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov dword [esi], 2
mov eax, dword [edi]
push 1
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [esi + 0xc], eax
cmp eax, 0xffffffff
jne 0x40409a
mov edi, 0x10
call fcn.00403e30
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov dword [esi + 4], ebp
test ebp, ebp
je 0x404042
mov ecx, dword [esp + 0x28]
mov dword [esi + 0x10], ecx
mov dword [esi], 1
jmp 0x40409e
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
movzx edx, word [esp + 0x28]
push 0xa
mov edi, eax
push edx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebp, eax
test ebp, ebp
je 0x404351
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x404351
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [esi + 4], eax
test eax, eax
je 0x4042b3
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [esi + 0x10], eax
mov dword [esi], 1
jmp 0x40409e
mov ebx, dword [esp + 0x2c]
test bl, 8
je 0x4040d0
push 0x2a
lea eax, [esi + 0x38]
push 0
push eax
call fcn.0051ab50
mov edx, dword [esi + 0xc]
mov ecx, 8
add esp, 0xc
or dword [esi], ecx
mov word [esi + 0x3e], cx
mov dword [esi + 0x5e], edx
mov dword [esi + 0x24], 0
jmp 0x4042fa
test byte [esi], 1
jne 0x4040f0
mov eax, dword [esi + 4]
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edi, eax
sub edi, dword [esi + 0xc]
mov dword [esp + 0x18], edi
jmp 0x4040fc
mov eax, dword [esi + 0x10]
mov dword [esi + 0x14], eax
mov dword [esp + 0x18], eax
mov edi, eax
mov ebx, 0xffff
mov dword [esp + 0x10], ebx
cmp edi, ebx
jae 0x40410f
mov dword [esp + 0x10], edi
mov ebx, edi
push 0x404
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
je 0x4042b3
mov eax, 4
cmp ebx, eax
jbe 0x404177
nop
add eax, 0x400
mov dword [esp + 0x14], ebx
cmp eax, ebx
ja 0x404141
mov dword [esp + 0x14], eax
mov ebx, edi
sub ebx, dword [esp + 0x14]
mov eax, edi
sub eax, ebx
mov edi, 0x404
cmp eax, 0x404
ja 0x404159
mov edi, eax
test byte [esi], 1
jne 0x40419e
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push 0
push 0
add ecx, ebx
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x4041a1
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
test byte [esi], 1
jne 0x4042c7
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 4]
push 0
push 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x4042ce
mov dword [esi + 0x14], ebx
mov eax, edi
mov edx, ebp
call fcn.00402fb0
test eax, eax
je 0x404177
add edi, 0xfffffffd
js 0x4041d3
dec edi
cmp byte [edi + ebp], 0x50
jne 0x4041cf
cmp byte [edi + ebp + 1], 0x4b
jne 0x4041cf
cmp byte [edi + ebp + 2], 5
jne 0x4041cf
cmp byte [edi + ebp + 3], 6
je 0x4041ec
test edi, edi
jge 0x4041b3
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x14], eax
jae 0x404177
mov edi, dword [esp + 0x18]
mov ebx, eax
mov eax, dword [esp + 0x14]
jmp 0x404130
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
add ebx, edi
test byte [esi], 1
jne 0x404210
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push 0
push 0
add ecx, ebx
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x404213
mov dword [esi + 0x14], ebx
mov eax, esi
call fcn.00403080
mov eax, esi
call fcn.00403010
movzx ebp, ax
mov eax, esi
call fcn.00403010
movzx edi, ax
mov eax, esi
call fcn.00403010
movzx eax, ax
mov dword [esi + 0x18], eax
mov eax, esi
call fcn.00403010
cmp dword [esi + 8], 0
movzx eax, ax
jne 0x4042df
movzx ecx, ax
cmp ecx, dword [esi + 0x18]
jne 0x40429f
test di, di
jne 0x40429f
test bp, bp
jne 0x40429f
mov eax, esi
call fcn.00403080
mov edi, eax
mov eax, esi
call fcn.00403080
mov dword [esi + 0x2c], eax
mov eax, esi
call fcn.00403010
cmp dword [esi + 8], 0
movzx edx, ax
mov dword [esi + 0x1c], edx
jne 0x4042df
mov ecx, dword [esi + 0x2c]
mov eax, dword [esi + 0xc]
lea edx, [ecx + edi]
lea ebp, [eax + ebx]
cmp ebp, edx
jb 0x4042df
sub eax, ecx
sub eax, edi
add eax, ebx
jmp 0x40430e
mov edi, 8
call fcn.00403e30
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov edi, 2
call fcn.00403e30
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov dword [esi + 0x14], 0
mov eax, esi
call fcn.00403010
mov edx, 0x8b1f
cmp ax, dx
je 0x4042f3
mov edi, 6
call fcn.00403e30
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov dword [esi + 0x2c], 3
mov eax, dword [esi + 0xc]
or dword [esi], 4
mov dword [esi + 8], 0
mov dword [esi + 0x18], 1
lea ecx, [esi + 0xa4]
push ecx
push 0x1ff
mov dword [esi + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov cl, 0x5c
test eax, eax
je 0x404332
cmp byte [eax + esi + 0xa3], cl
je 0x404341
mov byte [eax + esi + 0xa4], cl
mov byte [eax + esi + 0xa5], 0
mov edx, dword [esp + 0x20]
pop edi
mov dword [edx], esi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
mov edi, 4
call fcn.00403e30
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret