Function at 0x77ca0cba
Capabilities:
Extract resource via kernel32 functions

Disassembly:
cmp eax, ebx
jbe 0x77ca0d1b
jmp 0x77cdd6df
cmp dword [ebp - 4], ebx
je 0x77c9b0d9
jmp 0x77ca0e05
mov dword [ebp - 4], 0xd
jmp 0x77ca0dfb
mov dword [ebp - 4], 8
jmp 0x77ca0df3
push 0xa
push ebx
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
cmp eax, ebx
mov dword [esi + 0x18], eax
je 0x77cdd6d1
cmp dword [ebp - 8], ebx
je 0x77ca0d25
jmp 0x77cdd7c5
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor ebx, ebx
push esi
mov esi, dword [ebp + 8]
cmp esi, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
je 0x77cdd6df
mov ecx, dword [ebp + 0x18]
cmp ecx, ebx
je 0x77cdd6df
mov eax, dword [esi + 0x10]
cmp eax, ebx
je 0x77cdd6c5
cmp word [eax], bx
je 0x77cdd6c5
cmp dword [ebp + 0x14], ebx
mov eax, dword [ecx]
mov dword [ebp - 0x14], eax
je 0x77c861e0
cmp eax, ebx
jbe 0x77ca0d1b
push eax
push ebx
push dword [ebp + 0x14]
call sub.ntdll.dll_memset
add esp, 0xc
cmp dword [esi + 0x18], ebx
push edi
je 0x77c9b0c2
mov edi, dword [ebp + 0xc]
push dword [ebp + 0x10]
mov eax, edi
shr eax, 4
inc eax
movzx eax, ax
push eax
push 6
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov ebx, eax
test ebx, ebx
je 0x77ca0e0f
push ebx
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
push dword [esi + 0x18]
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x77ca0e0f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x77ca0e0f
xor esi, esi
and edi, 0xf
jbe 0x77ca0d93
movzx ecx, word [esi + eax]
lea esi, [esi + ecx*2 + 2]
cmp esi, dword [ebp + 8]
jae 0x77c861fb
dec edi
jne 0x77ca0d7f
lea ecx, [esi + 2]
cmp ecx, dword [ebp + 8]
jae 0x77c861fb
lea edi, [esi + eax]
movzx eax, word [edi]
push 0
cdq
push 2
push edx
push eax
call fcn.77c9e322
mov ebx, eax
mov eax, edx
sar eax, 0x1f
test edx, edx
ja 0x77cdd7d7
lea eax, [ebx + esi + 2]
cmp eax, dword [ebp + 8]
ja 0x77c861fb
cmp dword [ebp + 0x14], 0
je 0x77c86207
lea eax, [ebx + 2]
cmp eax, dword [ebp - 0x14]
ja 0x77c86207
push ebx
add edi, 2
push edi
push dword [ebp + 0x14]
call sub.ntdll.dll_memcpy
add esp, 0xc
mov eax, dword [ebp + 0x18]
add ebx, 2
mov dword [eax], ebx
cmp dword [ebp - 0xc], 0
jne 0x77cdd7e3
pop edi
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 0x14
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x77ca0dfb
mov dword [ebp - 4], 0xd
jmp 0x77ca0e06
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x10]
jmp 0x77cdd701
mov dword [ebp - 4], 0x57
jmp 0x77ca0e06
cmp cx, 0x5c
je 0x77c861ed
cmp cx, 0x3a
je 0x77c861ed
inc eax
inc eax
movzx ecx, word [eax]
cmp cx, bx
jne 0x77cdd6eb
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
lea edi, [eax + 0x10]
cmp eax, edi
jae 0x77c861ed
push dword [esi + 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
call ebx
add eax, edi
cmp edi, eax
jae 0x77cdd7be
push dword [esi + 0x10]
call ebx
add edi, eax
push 2
pop ecx
mov eax, edi
mul ecx
mov ecx, edx
sar ecx, 0x1f
test edx, edx
jne 0x77cdd7be
push eax
push 0x2a3
push 0x77cb4db8
call fcn.77c9e393
mov ebx, eax
test ebx, ebx
je 0x77cdd7be
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
push 0x77cdd7f4
push edi
push ebx
call fcn.77ca0f32
push dword [esi + 0x10]
push edi
push ebx
call fcn.77ca0f32
push 0xa
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test eax, eax
mov dword [esi + 0x18], eax
je 0x77cdd7a5
and dword [ebp - 4], 0
jmp 0x77cdd7ae
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
push ebx
push 0x2b7
push 0x77cb4db8
call fcn.77c9e3db
xor ebx, ebx
jmp 0x77c861ed
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
mov dword [ebp - 0xc], eax
jmp 0x77ca0d25
mov dword [ebp - 4], 0x216
jmp 0x77ca0dfb
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
jmp 0x77ca0e05