Function at 0x41a6c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x456b38
push 0x44bffc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x630
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
mov ecx, 7
xor eax, eax
lea edi, [ebp - 0x250]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov dword [ebp - 0x630], eax
mov dword [ebp - 0x62c], eax
call fcn.0041b1f0
mov ebx, eax
mov dword [ebp - 0x624], ebx
test ebx, ebx
jne 0x41a738
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov edi, eax
mov dword [ebp - 0x640], edi
mov byte [ebp - 0x11c], 0
push 5
push 0x99
mov ecx, dword [0x4773fc]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
mov edx, dword [0x4773fc]
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
mov dword [ebp - 0x638], esi
lea eax, [ebp - 0x11c]
push eax
push 0x41b300
push edi
push esi
mov ecx, dword [0x477340]
push ecx
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamA]
mov edi, eax
mov dword [ebp - 0x63c], edi
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
test edi, edi
jne 0x41a7bd
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x11c]
push edx
call fcn.00448e70
mov eax, dword [0x477358]
mov dword [ebp - 0x250], eax
mov esi, 1
mov dword [ebp - 0x24c], esi
mov word [ebp - 0x240], si
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
push 0
push 0
push 0x184
mov ecx, dword [0x477450]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
push esi
lea edx, [ebp - 0x630]
push edx
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x250]
push ecx
push ebx
call fcn.0041aa90
test eax, eax
je 0x41a9ff
lea edx, [ebp - 0x250]
push edx
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
mov eax, dword [ebp - 0x23e]
test eax, eax
je 0x41a87b
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x228]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push eax
call fcn.00449800
lea edx, [ebp - 0x228]
push edx
call fcn.00448ed0
test eax, eax
jne 0x41a87b
mov dword [ebp - 0x630], eax
xor ebx, ebx
mov dword [ebp - 0x628], ebx
cmp ebx, dword [ebp - 0x630]
jae 0x41a9c0
lea eax, [ebp - 0x620]
push eax
push 0
push 0
xor ecx, ecx
mov edx, dword [ebp - 0x62c]
mov cx, word [edx + ebx*4]
push ecx
call fcn.00432ab0
push 0x5c
lea eax, [ebp - 0x55e]
push eax
call fcn.0044c660
add esp, 8
inc eax
push eax
lea ecx, [ebp - 0x11c]
push ecx
lea edx, [ebp - 0x228]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x228]
push eax
call fcn.00448fd0
test eax, eax
je 0x41a95c
cmp byte [ebp - 0x227], 0x3a
jne 0x41a910
lea ecx, [ebp - 0x228]
push ecx
call fcn.00448b20
cmp eax, 4
jne 0x41a910
lea edx, [ebp - 0x228]
push edx
call fcn.00449840
lea eax, [ebp - 0x55e]
push eax
call fcn.00448a90
push eax
call fcn.00432170
mov edi, eax
mov dword [ebp - 0x22c], edi
test edi, edi
mov eax, dword [ebp - 0x620]
je 0x41a94a
cmp word [edi], ax
je 0x41a94a
mov ecx, 0x18
xor eax, eax
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp - 0x620]
lea ecx, [ebp - 0x228]
push ecx
and eax, 0xffff
push eax
call fcn.00435de0
mov edx, dword [ebp - 0x62c]
mov esi, dword [edx + ebx*4]
shr esi, 0x10
mov dword [ebp - 0x120], esi
xor edi, edi
mov dword [ebp - 0x230], edi
cmp edi, esi
jae 0x41a9ba
test byte [ebp - 0x5fe], 0x10
push 1
je 0x41a99f
mov eax, dword [ebp - 0x620]
and eax, 0xffff
push eax
call fcn.00432ed0
push eax
call fcn.00438db0
inc edi
jmp 0x41a970
mov ecx, dword [ebp - 0x620]
and ecx, 0xffff
push ecx
call fcn.00432ed0
push eax
call fcn.004384d0
inc edi
jmp 0x41a970
inc ebx
jmp 0x41a87d
mov edx, dword [ebp - 0x62c]
push edx
call fcn.0044c186
add esp, 4
mov eax, dword [0x477350]
test eax, eax
jne 0x41a9dd
call fcn.00405840
call fcn.00447af0
jmp 0x41a9ff
mov dword [ebp - 4], 0xffffffff
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, dword [ebp - 0x248]
test eax, eax
je 0x41aa46
push eax
mov esi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edx, dword [ebp - 0x248]
push edx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x41aa4c
mov esi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
mov eax, dword [ebp - 0x244]
test eax, eax
je 0x41aa70
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 0x244]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret