Function at 0x77ca4df3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
cmp eax, ebx
jbe 0x77ca4e54
jmp 0x77cebf41
cmp dword [ebp - 4], ebx
je 0x77ca30de
jmp 0x77ca4f3e
mov dword [ebp - 4], 0xd
jmp 0x77ca4f34
mov dword [ebp - 4], 8
jmp 0x77ca4f2c
push 0xa
push ebx
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
cmp eax, ebx
mov dword [esi + 0x18], eax
je 0x77cebf33
cmp dword [ebp - 8], ebx
je 0x77ca4e5e
jmp 0x77cec027
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor ebx, ebx
push esi
mov esi, dword [ebp + 8]
cmp esi, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
je 0x77cebf41
mov ecx, dword [ebp + 0x18]
cmp ecx, ebx
je 0x77cebf41
mov eax, dword [esi + 0x10]
cmp eax, ebx
je 0x77cebf27
cmp word [eax], bx
je 0x77cebf27
cmp dword [ebp + 0x14], ebx
mov eax, dword [ecx]
mov dword [ebp - 0x14], eax
je 0x77c9db80
cmp eax, ebx
jbe 0x77ca4e54
push eax
push ebx
push dword [ebp + 0x14]
call sub.ntdll.dll_memset
add esp, 0xc
cmp dword [esi + 0x18], ebx
push edi
je 0x77ca30c7
mov edi, dword [ebp + 0xc]
push dword [ebp + 0x10]
mov eax, edi
shr eax, 4
inc eax
movzx eax, ax
push eax
push 6
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov ebx, eax
test ebx, ebx
je 0x77ca5930
push ebx
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
push dword [esi + 0x18]
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x77ca5930
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x77ca5930
xor esi, esi
and edi, 0xf
jbe 0x77ca4ecc
movzx ecx, word [esi + eax]
lea esi, [esi + ecx*2 + 2]
cmp esi, dword [ebp + 8]
jae 0x77c9db9b
dec edi
jne 0x77ca4eb8
lea ecx, [esi + 2]
cmp ecx, dword [ebp + 8]
jae 0x77c9db9b
lea edi, [esi + eax]
movzx eax, word [edi]
push 0
cdq
push 2
push edx
push eax
call fcn.77cb0191
mov ebx, eax
mov eax, edx
sar eax, 0x1f
test edx, edx
ja 0x77cec039
lea eax, [ebx + esi + 2]
cmp eax, dword [ebp + 8]
ja 0x77c9db9b
cmp dword [ebp + 0x14], 0
je 0x77c9dba7
lea eax, [ebx + 2]
cmp eax, dword [ebp - 0x14]
ja 0x77c9dba7
push ebx
add edi, 2
push edi
push dword [ebp + 0x14]
call sub.ntdll.dll_memcpy
add esp, 0xc
mov eax, dword [ebp + 0x18]
add ebx, 2
mov dword [eax], ebx
cmp dword [ebp - 0xc], 0
jne 0x77cec045
pop edi
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 0x14
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x77ca4f34
mov dword [ebp - 4], 0xd
jmp 0x77ca4f3f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x10]
jmp 0x77cebf63
mov dword [ebp - 4], 0x57
jmp 0x77ca4f3f
cmp cx, 0x5c
je 0x77c9db8d
cmp cx, 0x3a
je 0x77c9db8d
inc eax
inc eax
movzx ecx, word [eax]
cmp cx, bx
jne 0x77cebf4d
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
lea edi, [eax + 0x10]
cmp eax, edi
jae 0x77c9db8d
push dword [esi + 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
call ebx
add eax, edi
cmp edi, eax
jae 0x77cec020
push dword [esi + 0x10]
call ebx
add edi, eax
push 2
pop ecx
mov eax, edi
mul ecx
mov ecx, edx
sar ecx, 0x1f
test edx, edx
jne 0x77cec020
push eax
push 0x2a3
push 0x77cceba4
call fcn.77ca96e5
mov ebx, eax
test ebx, ebx
je 0x77cec020
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
push 0x77cec054
push edi
push ebx
call fcn.77cac786
push dword [esi + 0x10]
push edi
push ebx
call fcn.77cac786
push 0xa
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test eax, eax
mov dword [esi + 0x18], eax
je 0x77cec007
and dword [ebp - 4], 0
jmp 0x77cec010
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
push ebx
push 0x2b7
push 0x77cceba4
call fcn.77ca972d
xor ebx, ebx
jmp 0x77c9db8d
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
mov dword [ebp - 0xc], eax
jmp 0x77ca4e5e
mov dword [ebp - 4], 0x216
jmp 0x77ca4f34
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
jmp 0x77ca4f3e