Function at 0x49ce80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd4
push ebx
push esi
push edi
push 0x22
push 0
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, eax
mov dword [ebp - 4], ebx
test ebx, ebx
je 0x49d0ba
lea eax, [ebp - 8]
mov dword [ebp - 0x24], 0x10
push eax
push 3
lea eax, [ebp - 0x24]
mov dword [ebp - 0x20], 1
push eax
push ebx
mov dword [ebp - 0x1c], 0
call dword [sym.imp.ntdll.dll_LdrFindResource_U]
test eax, eax
js 0x49d0b3
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
push ebx
call dword [sym.imp.ntdll.dll_LdrAccessResource]
test eax, eax
js 0x49d0b3
mov edi, dword [ebp - 0xc]
mov esi, dword [ebp - 0x10]
push edi
push 4
push dword [0x54b674]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
push edi
mov ebx, eax
push esi
push ebx
call fcn.004dd620
add esp, 0xc
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test ebx, ebx
je 0x49d0ba
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
push str.VarFileInfoTranslation
push ebx
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x49cf4a
mov eax, dword [ebp - 4]
movzx edi, word [eax]
movzx eax, word [eax + 2]
shl edi, 0x10
add edi, eax
jmp 0x49cf4f
mov edi, 0x40904e4
push 0x532928
push edi
push ebx
call sym.ProcessHacker.exe_PhGetFileVersionInfoString2
mov esi, dword [ebp + 8]
push 0x532940
push edi
push ebx
mov dword [esi], eax
call sym.ProcessHacker.exe_PhGetFileVersionInfoString2
push 0x532960
push edi
push ebx
mov dword [esi + 4], eax
call sym.ProcessHacker.exe_PhGetFileVersionInfoString2
cmp dword [esi], 0
mov dword [esi + 0xc], eax
jne 0x49cfe0
test eax, eax
jne 0x49cfe0
cmp dword [esi + 4], eax
jne 0x49cfe0
and edi, 0xffff0000
mov edx, ebx
add edi, 0x4e4
mov ecx, esi
push edi
call fcn.0049ce40
cmp dword [esi], 0
jne 0x49cfe0
cmp dword [esi + 4], 0
jne 0x49cfe0
cmp dword [esi + 0xc], 0
jne 0x49cfe0
push 0x40904e4
mov edx, ebx
mov ecx, esi
call fcn.0049ce40
cmp dword [esi], 0
jne 0x49cfe0
cmp dword [esi + 4], 0
jne 0x49cfe0
cmp dword [esi + 0xc], 0
jne 0x49cfe0
push 0x4090000
mov edx, ebx
mov ecx, esi
call fcn.0049ce40
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x507e1c
push ebx
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x49d094
cmp dword [ebp - 0x14], 0
je 0x49d094
mov edx, dword [ebp - 0x18]
mov edi, 0x2e
push 0x1e
push 7
mov dword [ebp - 0xd0], 8
mov ecx, dword [edx + 8]
mov eax, ecx
shr eax, 0x10
mov dword [ebp - 0xc0], eax
movzx eax, cx
mov ecx, dword [edx + 0xc]
mov dword [ebp - 0x90], eax
mov eax, ecx
shr eax, 0x10
mov dword [ebp - 0x60], eax
movzx eax, cx
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0xd0]
push eax
mov dword [ebp - 0xb8], 0
mov word [ebp - 0xa8], di
mov dword [ebp - 0xa0], 8
mov dword [ebp - 0x88], 0
mov word [ebp - 0x78], di
mov dword [ebp - 0x70], 8
mov dword [ebp - 0x58], 0
mov word [ebp - 0x48], di
mov dword [ebp - 0x40], 8
call sym.ProcessHacker.exe_PhFormat
jmp 0x49d096
xor eax, eax
push ebx
push 0
mov dword [esi + 8], eax
push dword [0x54b674]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8