Function at 0x426fd9
Capabilities:
Extract resource via kernel32 functions
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x4e26d0]
xor eax, ebp
mov dword [ebp - 8], eax
and dword [ebp - 0x48], 0
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov edi, 0x4d9d24
mov dword [ebp - 0x3c], ebx
mov edx, edi
mov dword [ebp - 0x44], esi
mov ecx, 0x8c
call fcn.004247e2
push eax
lea ecx, [ebx + 0x44]
call fcn.00429d16
mov edx, edi
mov ecx, 0x8d
call fcn.004247e2
push eax
lea ecx, [ebx + 0x48]
call fcn.00429d16
mov edx, 0x4d9d2c
mov ecx, 0x8b
call fcn.004247e2
push eax
lea ecx, [ebx + 0x50]
call fcn.00429d16
push esi
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, eax
mov dword [ebp - 0x48], ebx
test esi, esi
jne 0x42705b
test ebx, ebx
jne 0x42705b
call fcn.004514d0
push 0x5a
push ebx
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x4d9d34
mov ebx, eax
mov edi, dword [sym.imp.KERNEL32.dll_MulDiv]
xor eax, eax
push eax
push eax
push eax
push 8
push 1
push eax
push eax
push eax
push 0x17a
push eax
push eax
push eax
push 0x48
push ebx
push 8
call edi
mov esi, dword [sym.imp.GDI32.dll_CreateFontW]
neg eax
push eax
call esi
mov ecx, dword [ebp - 0x3c]
push eax
add ecx, 0x10
call fcn.00429d16
mov eax, dword [ebp - 0x3c]
push 0x4d9d34
push 2
push 4
add eax, 0x14
mov dword [ebp - 0x40], eax
xor eax, eax
push eax
push 8
push 1
push eax
push eax
push eax
push 0x2bc
push eax
push eax
push eax
push 0x48
push ebx
push 8
call edi
neg eax
push eax
call esi
mov ecx, dword [ebp - 0x40]
push eax
call fcn.00429d16
mov eax, dword [ebp - 0x3c]
push str.MS_Shell_Dlg_2
push 2
push 4
add eax, 0x18
mov dword [ebp - 0x40], eax
xor eax, eax
push eax
push 8
push 1
push eax
push eax
push eax
push 0x1f4
push eax
push eax
push eax
push 0x48
push ebx
push 0xe
call edi
neg eax
push eax
call esi
mov ecx, dword [ebp - 0x40]
push eax
call fcn.00429d16
mov eax, dword [ebp - 0x3c]
push str.Segoe_UI
push 2
push 4
add eax, 0x1c
mov dword [ebp - 0x40], eax
xor eax, eax
push eax
push 8
push 1
push eax
push eax
push eax
push 0x384
push eax
push eax
push eax
push 0x48
push ebx
push 0x16
call edi
neg eax
push eax
call esi
mov ecx, dword [ebp - 0x40]
push eax
call fcn.00429d16
mov eax, dword [ebp - 0x48]
mov ebx, dword [ebp - 0x44]
test eax, eax
je 0x427160
push eax
push ebx
call dword [sym.imp.USER32.dll_ReleaseDC]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
mov esi, eax
test esi, esi
je 0x4271a9
push esi
push 0
push 0x80
push ebx
call edi
test eax, eax
je 0x427193
push eax
call dword [sym.imp.USER32.dll_DestroyIcon]
push esi
push 1
push 0x80
push ebx
call edi
test eax, eax
je 0x4271a9
push eax
call dword [sym.imp.USER32.dll_DestroyIcon]
push 0x3e8
push ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, dword [ebp - 0x3c]
test eax, eax
je 0x4271cb
push esi
push 0
push 0x429ad8
push eax
call dword [sym.imp.COMCTL32.dll_SetWindowSubclass]
cmp dword [esi + 0x14], 0
je 0x4271eb
push 0x404
push ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
je 0x4271eb
push 1
push dword [esi + 0x14]
push 0x30
push eax
call edi
push 0x3f0
push ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebp - 0x44], eax
test eax, eax
je 0x42722d
push 0
push 0
push 0x43b
push eax
call edi
or eax, 0x4000000
push eax
push 0
push 0x445
push dword [ebp - 0x44]
call edi
push esi
push 1
push 0x42a6e4
push dword [ebp - 0x44]
call dword [sym.imp.COMCTL32.dll_SetWindowSubclass]
cmp dword [esi + 0x18], 0
je 0x427275
push 0x3f1
push ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
push 1
push dword [esi + 0x18]
push 0x30
push eax
call edi
push 0x3f2
push ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
push 1
push dword [esi + 0x18]
push 0x30
push eax
call edi
push 0x40c
push ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
push 1
push dword [esi + 0x18]
push 0x30
push eax
call edi
push 0x3ef
push ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
push esi
push 1
push 0x42a6e4
push eax
mov dword [ebp - 0x48], eax
call dword [sym.imp.COMCTL32.dll_SetWindowSubclass]
cmp dword [esi + 0x1c], 0
je 0x4272a5
push 1
push dword [esi + 0x1c]
push 0x30
push dword [ebp - 0x48]
call edi
cmp byte [esi + 8], 0
je 0x4272b9
push 4
mov ecx, esi
call fcn.004279a3
jmp 0x427386
mov eax, dword [esi + 4]
cmp byte [eax + 0xf], 0
jne 0x427386
push 0x4d9d84
push 0x8e
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x427386
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
lea ecx, [ebp - 0x20]
call fcn.004049a0
push 0x4d6100
lea ecx, [ebp - 0x38]
call fcn.004049a0
mov eax, 0x4d9d8c
push eax
mov dword [ebp - 0x4c], eax
call fcn.00404840
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x20]
pop ecx
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0043f440
add esp, 0x10
lea ecx, [ebp - 0x38]
push esi
push 1
call fcn.00404a6d
push ecx
push ecx
lea eax, [ebp - 0x20]
mov ecx, esp
push eax
call fcn.00405def
lea eax, [ebp - 0x38]
push eax
call fcn.0044b3d0
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x42735c
mov eax, dword [eax]
push eax
push 0x3f4
push ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push esi
push 1
lea ecx, [ebp - 0x38]
call fcn.00405676
push esi
push 1
lea ecx, [ebp - 0x20]
call fcn.00404a6d
mov ecx, dword [ebp - 8]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
inc eax
pop ebx
call fcn.0049653f
mov esp, ebp
pop ebp
ret 4