Function at 0x41ae50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x74
mov eax, dword [0x43a004]
xor eax, esp
mov dword [esp + 0x70], eax
push ebx
push esi
mov esi, dword [ebp + 8]
or ebx, 0xffffffff
push edi
push 2
push 0x436ba4
push esi
call fcn.0041f3ea
add esp, 0xc
push 0
test eax, eax
jne 0x41aecb
mov dword [esp + 0x14], eax
mov edx, 0x2b1
lea eax, [esp + 0x14]
push eax
push ecx
call fcn.0041d0b0
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x41b294
test eax, eax
je 0x41b294
push eax
push ecx
push 1
call fcn.0041ce60
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.0041d22b
mov esp, ebp
pop ebp
ret
push 0
lea edx, [esp + 0x1c]
mov dword [0x43bbd4], 0
mov ecx, esi
call fcn.00411e00
mov edi, dword [esp + 0x1c]
add esp, 8
mov ecx, eax
xor esi, esi
mov dword [esp + 0x10], ecx
test edi, edi
jle 0x41af35
nop word [eax + eax]
push 0x436c08
push dword [ecx + esi*4]
call fcn.0041f4c2
add esp, 8
test eax, eax
je 0x41b0d8
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx + esi*4]
cmp word [eax], 0x2f
je 0x41af2b
cmp ebx, 0xffffffff
cmove ebx, esi
inc esi
cmp esi, edi
jl 0x41af00
cmp ebx, 0xffffffff
jne 0x41afb2
push 0x29a
push 0x44a060
call fcn.0041cd80
add esp, 8
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [esp + 0x26]
mov eax, 0xcccccccd
movzx esi, word [0x44a1b6]
mul ecx
movzx eax, word [0x44a1b4]
shr edx, 3
push edx
push eax
movzx eax, word [esp + 0x2c]
push eax
movzx eax, word [esp + 0x2e]
push esi
push eax
movzx eax, word [esp + 0x34]
push esi
push eax
push str._2d_c_02d_c_02d_c_02d
push 0x441f18
call fcn.00402b70
add esp, 0x24
push 0x441f18
push 0x437c78
push 0x44a060
call fcn.0041cbe0
mov ecx, dword [esp + 0x1c]
add esp, 0xc
mov esi, dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov edi, dword [sym.imp.KERNEL32.dll_LoadResource]
cmp ebx, 0xffffffff
jne 0x41b1d8
push 0
push 0x2c
push 6
push 0
call esi
test eax, eax
je 0x41b03b
push eax
push 0
call edi
test eax, eax
je 0x41b03b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edx, 2
nop word [eax + eax]
movzx ecx, word [eax]
lea eax, [eax + ecx*2]
lea eax, [eax + 2]
sub edx, 1
jne 0x41aff0
movzx esi, word [eax]
lea edi, [eax + 2]
test edi, edi
je 0x41b02f
test esi, esi
je 0x41b02f
push 0x44a068
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
push edi
push 0x44a060
call dword [0x44a060]
push 0x44a068
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov edi, dword [sym.imp.KERNEL32.dll_LoadResource]
mov edx, 0x28
lea ecx, [esp + 0x28]
call fcn.00407900
cmp word [esp + 0x28], 0
je 0x41b095
lea eax, [esp + 0x28]
lea edx, [eax + 2]
nop dword [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41b060
sub eax, edx
sar eax, 1
cmp word [esp + eax*2 + 0x26], 0x20
jae 0x41b095
lea eax, [eax*2 - 2]
cmp eax, 0x50
jae 0x41b2a8
xor ecx, ecx
mov word [esp + eax + 0x28], cx
cmp word [esp + 0x28], cx
jne 0x41b051
lea ecx, [esp + 0x28]
call fcn.0041ac00
test eax, eax
je 0x41b1eb
mov edi, dword [esp + 0x10]
test edi, edi
je 0x41b294
mov eax, dword [edi]
mov esi, edi
test eax, eax
je 0x41b28b
nop
push eax
call fcn.0041f3e5
mov eax, dword [esi + 4]
lea esi, [esi + 4]
add esp, 4
test eax, eax
jne 0x41b0c0
jmp 0x41b28b
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [0x44a1b8]
sub eax, 0
je 0x41b11a
sub eax, 1
jne 0x41b11a
movzx eax, word [esp + 0x22]
push eax
movzx eax, word [0x44a1b6]
push eax
movzx eax, word [esp + 0x28]
push eax
lea eax, [esp + 0x34]
push str._02d_c_02u
push eax
call fcn.00402b70
add esp, 0x14
jmp 0x41b168
mov ax, word [esp + 0x20]
test ax, ax
jne 0x41b12b
mov ecx, 0xc
jmp 0x41b137
movzx ecx, ax
cmp ax, 0xc
jbe 0x41b137
sub ecx, 0xc
mov dx, 0xb
cmp dx, ax
sbb eax, eax
and eax, 0xf
add eax, 0x41
push eax
movzx eax, word [esp + 0x26]
push eax
movzx eax, word [0x44a1b6]
push eax
push ecx
lea eax, [esp + 0x38]
push str._02d_c_02u__cM
push eax
call fcn.00402b70
add esp, 0x18
lea esi, [esp + 0x28]
lea ecx, [esi + 2]
nop
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x41b170
sub esi, ecx
push 0x44a068
sar esi, 1
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
lea eax, [esp + 0x2c]
push eax
push 0x44a060
call dword [0x44a060]
push 0x44a068
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, dword [esp + 0x10]
test edi, edi
je 0x41b294
mov eax, dword [edi]
mov esi, edi
test eax, eax
je 0x41b28b
nop
push eax
call fcn.0041f3e5
mov eax, dword [esi + 4]
lea esi, [esi + 4]
add esp, 4
test eax, eax
jne 0x41b1c0
jmp 0x41b28b
mov ecx, dword [ecx + ebx*4]
call fcn.0041ac00
test eax, eax
jne 0x41b268
or ebx, 0xffffffff
push 0
push 0x16
push 6
push 0
call esi
test eax, eax
je 0x41b255
push eax
push 0
call edi
test eax, eax
je 0x41b255
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edx, 0xc
nop
movzx ecx, word [eax]
lea eax, [eax + ecx*2]
lea eax, [eax + 2]
sub edx, 1
jne 0x41b210
movzx esi, word [eax]
lea edi, [eax + 2]
test edi, edi
je 0x41b24f
test esi, esi
je 0x41b24f
push 0x44a028
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
push edi
push 0x44a020
call dword [0x44a020]
push 0x44a028
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov ecx, dword [esp + 0x10]
mov dword [0x43bbd4], 1
jmp 0x41afb8
mov edi, dword [esp + 0x10]
test edi, edi
je 0x41b294
mov eax, dword [edi]
mov esi, edi
test eax, eax
je 0x41b28b
push eax
call fcn.0041f3e5
mov eax, dword [esi + 4]
lea esi, [esi + 4]
add esp, 4
test eax, eax
jne 0x41b278
push edi
call fcn.0041f3e5
add esp, 4
mov ecx, dword [esp + 0x7c]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041d22b
mov esp, ebp
pop ebp
ret
call fcn.0041d35b
int3