Function at 0x422e50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x49d66e
mov eax, dword fs:[0]
push eax
sub esp, 0x858
mov eax, dword [0x4c2c40]
xor eax, esp
mov dword [esp + 0x850], eax
push ebx
push esi
push edi
mov eax, dword [0x4c2c40]
xor eax, esp
push eax
lea eax, [esp + 0x868]
mov dword fs:[0], eax
mov ebx, ecx
mov byte [esp + 0x17], 1
call fcn.0045acd4
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x20
call esi
push 0x21
mov dword [esp + 0x14], eax
call esi
push 0x21
mov dword [esp + 0x38], eax
call esi
push 4
mov edi, eax
call esi
mov ecx, dword [esp + 0x34]
add edi, eax
mov eax, dword [esp + 0x10]
push 1
lea edi, [edi + ecx + 0x213]
push edi
lea eax, [eax + eax + 0x248]
push eax
push 0
push 0
mov ecx, ebx
call fcn.004607d0
push 0
mov ecx, ebx
call fcn.0045d325
push 5
push 0x86
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test esi, esi
jne 0x422f10
mov byte [esp + 0x17], al
push edi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x422f21
mov byte [esp + 0x17], al
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
xor edi, edi
cmp eax, edi
mov dword [esp + 0x34], eax
je 0x422f88
cmp byte [esp + 0x17], 0
je 0x422f88
mov esi, dword [sym.imp.KERNEL32.dll_FindResourceW]
push 0x4abe30
push 0xbb8
push edi
call esi
cmp eax, edi
je 0x422f68
lea edx, [ebx + 0xb0]
push edx
call fcn.0042d6d0
add esp, 4
push 0x4abe30
push 0xbb9
push edi
call esi
cmp eax, edi
je 0x422f88
lea ecx, [ebx + 0xe0]
push ecx
call fcn.0042d6d0
add esp, 4
mov dword [esp + 0x88], 7
mov dword [esp + 0x84], edi
mov word [esp + 0x74], di
lea ecx, [esp + 0x70]
mov dword [esp + 0x870], edi
call fcn.0043d1a0
mov ecx, dword [0x4c8548]
cmp ecx, edi
jne 0x422fd9
push 4
call fcn.0045a845
add esp, 4
cmp eax, edi
je 0x422fcf
mov dword [eax], vtable.CWinAUNetworkUtil.0
jmp 0x422fd1
xor eax, eax
mov ecx, eax
mov dword [0x4c8548], ecx
mov edx, dword [ecx]
mov edx, dword [edx + 8]
xor esi, esi
push esi
push esi
push esi
push 1
lea eax, [esp + 0x80]
push eax
lea eax, [ebx + 0x94]
push eax
call edx
mov dword [esp + 0x50], 7
mov dword [esp + 0x4c], esi
mov word [esp + 0x3c], si
lea edi, [esp + 0x38]
mov byte [esp + 0x870], 1
call fcn.00415ed0
push 0xffffffffffffffff
push esi
lea eax, [esp + 0x78]
mov ecx, edi
call fcn.00401b70
push 5
push 0x4aa908
mov ecx, edi
call fcn.004035d0
mov ecx, dword [esp + 0x3c]
mov eax, 8
cmp dword [esp + 0x50], eax
jae 0x423047
lea ecx, [esp + 0x3c]
cmp dword [esp + 0x88], eax
mov eax, dword [esp + 0x74]
jae 0x423058
lea eax, [esp + 0x74]
push ecx
push eax
call fcn.00479477
add esp, 8
push 7
xor edi, edi
push str.file:__
lea esi, [esp + 0x5c]
mov dword [esp + 0x74], 7
mov dword [esp + 0x70], edi
mov word [esp + 0x60], di
call fcn.00401c20
push edi
lea eax, [esp + 0x3c]
push eax
or eax, 0xffffffff
mov byte [esp + 0x878], 2
call fcn.004036a0
push 0x3ff
mov ecx, ebx
call fcn.00460672
lea esi, [ebx + 0x27c]
cmp esi, edi
mov dword [esp + 0x10], eax
jne 0x4230b9
xor eax, eax
jmp 0x4230bc
mov eax, dword [esi + 4]
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx + 0x20]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 1
push eax
push 0x30
push edx
call edi
mov ecx, dword [esp + 0x10]
push 1
push 0x1e7
push 0x66
push 0
push 0
call fcn.004607d0
push 0x3f5
mov ecx, ebx
call fcn.00460672
test esi, esi
mov dword [esp + 0x10], eax
jne 0x4230ff
xor eax, eax
jmp 0x423102
mov eax, dword [esi + 4]
push 1
push eax
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x20]
push 0x30
push ecx
call edi
mov ecx, dword [esp + 0x10]
push 1
push 0x2a
push 0x2a
push 0x14
push 0x74
call fcn.004607d0
push 0x3f0
mov ecx, ebx
call fcn.00460672
test esi, esi
mov dword [esp + 0x10], eax
jne 0x42313c
xor eax, eax
jmp 0x42313f
mov eax, dword [esi + 4]
mov edx, dword [esp + 0x10]
push 1
push eax
mov eax, dword [edx + 0x20]
push 0x30
push eax
call edi
mov ecx, dword [esp + 0x10]
push 1
push 0x24
push 0x190
push 9
push 0xa8
call fcn.004607d0
push 0x3f1
mov ecx, ebx
call fcn.00460672
test esi, esi
mov dword [esp + 0x10], eax
jne 0x42317f
xor eax, eax
jmp 0x423182
mov eax, dword [esi + 4]
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx + 0x20]
push 1
push eax
push 0x30
push edx
call edi
mov ecx, dword [esp + 0x10]
push 1
push 0x24
push 0x190
push 0x2d
push 0xa8
call fcn.004607d0
push 0x3f2
mov ecx, ebx
call fcn.00460672
test esi, esi
mov dword [esp + 0x10], eax
jne 0x4231c2
xor eax, eax
jmp 0x4231c5
mov eax, dword [esi + 4]
push 1
push eax
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x20]
push 0x30
push ecx
call edi
mov ecx, dword [esp + 0x10]
push 1
push 0x14
push 0x1c2
push 0x56
push 0x72
call fcn.004607d0
push 0x3f7
mov ecx, ebx
call fcn.00460672
test esi, esi
mov dword [esp + 0x10], eax
jne 0x423202
xor eax, eax
jmp 0x423205
mov eax, dword [esi + 4]
mov edx, dword [esp + 0x10]
push 1
push eax
mov eax, dword [edx + 0x20]
push 0x30
push eax
call edi
mov ecx, dword [esp + 0x10]
push 1
push 1
push 0x1c2
push 0x6f
push 0x74
call fcn.004607d0
push 0x3f4
mov ecx, ebx
call fcn.00460672
test esi, esi
mov dword [esp + 0x10], eax
jne 0x423242
xor eax, eax
jmp 0x423245
mov eax, dword [esi + 4]
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx + 0x20]
push 1
push eax
push 0x30
push edx
call edi
mov ecx, dword [esp + 0x10]
push 1
push 0x14
push 0x1c2
push 0x78
push 0x72
call fcn.004607d0
push 0x3ed
mov ecx, ebx
call fcn.00460672
test esi, esi
mov dword [esp + 0x10], eax
jne 0x423282
xor eax, eax
jmp 0x423285
mov eax, dword [esi + 4]
push 1
push eax
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x20]
push 0x30
push ecx
call edi
mov ecx, dword [esp + 0x10]
push 1
push 0xc7
push 0x1c0
push 0x95
push 0x74
call fcn.004607d0
push 0x400
mov ecx, ebx
call fcn.00460672
test esi, esi
mov dword [esp + 0x10], eax
jne 0x4232c8
xor eax, eax
jmp 0x4232cb
mov eax, dword [esi + 4]
mov edx, dword [esp + 0x10]
push 1
push eax
mov eax, dword [edx + 0x20]
push 0x30
push eax
call edi
mov ecx, dword [esp + 0x10]
push 1
push 0x1e
push 0x128
push 0x165
push 0x74
call fcn.004607d0
push 0x3fa
mov ecx, ebx
call fcn.00460672
test esi, esi
mov dword [esp + 0x10], eax
jne 0x42330b
xor eax, eax
jmp 0x42330e
mov eax, dword [esi + 4]
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx + 0x20]
push 1
push eax
push 0x30
push edx
call edi
mov ecx, dword [esp + 0x10]
push 1
push 1
push 0x1c2
push 0x192
push 0x74
call fcn.004607d0
push 0x3fc
mov ecx, ebx
call fcn.00460672
test esi, esi
mov dword [esp + 0x10], eax
jne 0x42334e
xor eax, eax
jmp 0x423351
mov eax, dword [esi + 4]
push 1
push eax
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x20]
push 0x30
push ecx
call edi
mov ecx, dword [esp + 0x10]
push 1
push 0x4c
push 0x1c4
push 0x19b
push 0x72
call fcn.004607d0
push 0x3fe
mov ecx, ebx
call fcn.00460672
test esi, esi
mov dword [esp + 0x10], eax
jne 0x423391
xor eax, eax
jmp 0x423394
mov eax, dword [esi + 4]
mov edx, dword [esp + 0x10]
push 1
push eax
mov eax, dword [edx + 0x20]
push 0x30
push eax
call edi
mov ecx, dword [esp + 0x10]
push 1
push 0x28
push 0x1c4
push 0x1bf
push 0x72
call fcn.004607d0
push 1
mov ecx, ebx
call fcn.00460672
test esi, esi
mov dword [esp + 0x10], eax
jne 0x4233d1
xor eax, eax
jmp 0x4233d4
mov eax, dword [esi + 4]
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx + 0x20]
push 1
push eax
push 0x30
push edx
call edi
mov ecx, dword [esp + 0x10]
push 1
push 0x14
push 0xcb
push 0x1f4
push 0x9c
call fcn.004607d0
push 2
mov ecx, ebx
call fcn.00460672
test esi, esi
mov dword [esp + 0x10], eax
jne 0x423414
xor eax, eax
jmp 0x423417
mov eax, dword [esi + 4]
mov esi, dword [esp + 0x10]
push 1
push eax
mov eax, dword [esi + 0x20]
push 0x30
push eax
call edi
push 1
push 0x14
push 0xcb
push 0x1f4
push 0x173
mov ecx, esi
call fcn.004607d0
mov edi, ebx
call fcn.00423eb0
mov ecx, 0x70
lea edx, [esp + 0x18]
call fcn.00432a50
mov byte [esp + 0x870], 3
cmp dword [eax + 0x18], 8
jb 0x423468
mov eax, dword [eax + 4]
jmp 0x42346b
add eax, 4
push eax
lea ecx, [ebx + 0x284]
call fcn.00460774
mov edi, 8
mov byte [esp + 0x870], 2
cmp dword [esp + 0x30], edi
jb 0x423497
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.0045a870
add esp, 4
push 0x7ce
lea edx, [esp + 0x92]
push 0
push edx
mov word [esp + 0x98], 0
call fcn.0047dfc0
mov eax, dword [ebx + 0x140]
add esp, 0xc
push eax
push 0x4aa924
lea edx, [esp + 0x94]
call fcn.00424440
add esp, 8
lea ecx, [esp + 0x8c]
push ecx
mov ecx, ebx
call fcn.00460774
push 0x7d0
lea edx, [esp + 0x90]
push 0
push edx
call fcn.0047dfc0
add esp, 0xc
cmp dword [ebx + 0x204], 1
lea edx, [esp + 0x18]
mov ecx, 0xae
je 0x423510
mov ecx, 0x8c
call fcn.00432a50
cmp dword [eax + 0x18], edi
jb 0x42351f
mov eax, dword [eax + 4]
jmp 0x423522
add eax, 4
mov ecx, dword [ebx + 0x140]
push ecx
push eax
lea edx, [esp + 0x94]
call fcn.00424440
add esp, 8
cmp dword [esp + 0x30], edi
jb 0x42354c
mov edx, dword [esp + 0x1c]
push edx
call fcn.0045a870
add esp, 4
lea eax, [esp + 0x8c]
lea ecx, [ebx + 0x144]
lea esi, [eax + 2]
lea esp, [esp]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x423560
sub eax, esi
sar eax, 1
push eax
lea eax, [esp + 0x90]
push eax
call fcn.00424800
push 0x7d0
lea ecx, [esp + 0x90]
push 0
push ecx
call fcn.0047dfc0
add esp, 0xc
mov ecx, 0x8e
lea edx, [esp + 0x18]
call fcn.00432a50
cmp dword [eax + 0x18], edi
jb 0x4235ac
mov ecx, dword [eax + 4]
jmp 0x4235af
lea ecx, [eax + 4]
mov eax, dword [ebx + 0x74]
call fcn.00423c10
push eax
push ecx
lea edx, [esp + 0x94]
call fcn.00424440
add esp, 8
cmp dword [esp + 0x30], edi
jb 0x4235db
mov edx, dword [esp + 0x1c]
push edx
call fcn.0045a870
add esp, 4
lea eax, [esp + 0x8c]
lea ecx, [ebx + 0x14c]
lea esi, [eax + 2]
jmp 0x4235f0
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x4235f0
sub eax, esi
sar eax, 1
push eax
lea eax, [esp + 0x90]
push eax
call fcn.00424800
mov ecx, 0x8d
lea edx, [esp + 0x18]
call fcn.00432a50
mov byte [esp + 0x870], 4
cmp dword [eax + 0x18], edi
jb 0x42362d
mov esi, dword [eax + 4]
jmp 0x423630
lea esi, [eax + 4]
test esi, esi
lea edi, [ebx + 0x148]
jne 0x42363e
xor eax, eax
jmp 0x423652
mov eax, esi
lea ecx, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x423643
sub eax, ecx
sar eax, 1
push eax
push esi
mov ecx, edi
call fcn.00424800
mov byte [esp + 0x870], 2
cmp dword [esp + 0x30], 8
jb 0x423677
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.0045a870
add esp, 4
mov ecx, 0x90
lea edx, [esp + 0x18]
call fcn.00432a50
mov byte [esp + 0x870], 5
cmp dword [eax + 0x18], 8
jb 0x423698
mov esi, dword [eax + 4]
jmp 0x42369b
lea esi, [eax + 4]
test esi, esi
lea edi, [ebx + 0x150]
jne 0x4236a9
xor eax, eax
jmp 0x4236bf
mov eax, esi
lea ecx, [eax + 2]
mov edi, edi
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x4236b0
sub eax, ecx
sar eax, 1
push eax
push esi
mov ecx, edi
call fcn.00424800
mov byte [esp + 0x870], 2
cmp dword [esp + 0x30], 8
jb 0x4236e4
mov edx, dword [esp + 0x1c]
push edx
call fcn.0045a870
add esp, 4
mov ecx, 0x99
lea edx, [esp + 0x18]
call fcn.00432a50
mov edi, 8
mov byte [esp + 0x870], 6
cmp dword [eax + 0x18], edi
jb 0x423709
mov edx, dword [eax + 4]
jmp 0x42370c
lea edx, [eax + 4]
test edx, edx
jne 0x423714
xor eax, eax
jmp 0x42372f
mov eax, edx
lea esi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x423720
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [ebx + 0x154]
call fcn.00424800
mov byte [esp + 0x870], 2
cmp dword [esp + 0x30], edi
jb 0x423757
mov eax, dword [esp + 0x1c]
push eax
call fcn.0045a870
add esp, 4
mov ecx, 0x9a
lea edx, [esp + 0x18]
call fcn.00432a50
mov byte [esp + 0x870], 7
cmp dword [eax + 0x18], edi
jb 0x423777
mov edx, dword [eax + 4]
jmp 0x42377a
lea edx, [eax + 4]
test edx, edx
lea edi, [ebx + 0x158]
jne 0x423788
xor eax, eax
jmp 0x42379f
mov eax, edx
lea esi, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x423790
sub eax, esi
sar eax, 1
push eax
push edx
mov ecx, edi
call fcn.00424800
mov esi, 8
mov byte [esp + 0x870], 2
cmp dword [esp + 0x30], esi
jb 0x4237c8
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.0045a870
add esp, 4
mov ecx, 0x91
lea edx, [esp + 0x18]
call fcn.00432a50
mov byte [esp + 0x870], 8
cmp dword [eax + 0x18], esi
jb 0x4237e8
mov eax, dword [eax + 4]
jmp 0x4237eb
add eax, 4
push eax
lea ecx, [ebx + 0x15c]
call fcn.00460774
mov byte [esp + 0x870], 2
cmp dword [esp + 0x30], esi
jb 0x423812
mov edx, dword [esp + 0x1c]
push edx
call fcn.0045a870
add esp, 4
mov ecx, 0x75
lea edx, [esp + 0x18]
call fcn.00432a50
mov byte [esp + 0x870], 9
cmp dword [eax + 0x18], esi
jb 0x423832
mov eax, dword [eax + 4]
jmp 0x423835
add eax, 4
push eax
lea ecx, [ebx + 0x1b0]
call fcn.00460774
mov byte [esp + 0x870], 2
cmp dword [esp + 0x30], esi
jb 0x42385c
mov eax, dword [esp + 0x1c]
push eax
call fcn.0045a870
add esp, 4
cmp dword [esp + 0x6c], esi
mov eax, dword [esp + 0x58]
jae 0x42386a
lea eax, [esp + 0x58]
push 0
push 0
push 0
push 0
push eax
push str._bLLLL
push 0
push 0
push 1
lea ecx, [ebx + 0x208]
push 0x68
push ecx
call fcn.0046088c
add esp, 0x2c
cmp dword [ebx + 0x204], 1
jne 0x423947
push 0x7d0
lea edx, [esp + 0x90]
push 0
push edx
call fcn.0047dfc0
add esp, 0xc
mov ecx, 0x9d
lea edx, [esp + 0x18]
call fcn.00432a50
cmp dword [eax + 0x18], esi
jb 0x4238cb
mov eax, dword [eax + 4]
jmp 0x4238ce
add eax, 4
push eax
lea edx, [esp + 0x90]
call fcn.00424440
add esp, 4
cmp dword [esp + 0x30], esi
jb 0x4238f1
mov eax, dword [esp + 0x1c]
push eax
call fcn.0045a870
add esp, 4
lea eax, [esp + 0x8c]
lea edx, [eax + 2]
jmp 0x423900
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x423900
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0x90]
push ecx
lea ecx, [ebx + 0x154]
call fcn.00424800
push 0
push 0x4a9c14
mov ecx, edi
call fcn.00424800
mov edx, dword [ebx + 0x20]
push 0xb
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0
mov ecx, ebx
call fcn.0045d29a
mov eax, dword [esp + 0x34]
test eax, eax
je 0x42395f
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [esp + 0x6c], esi
jb 0x423972
mov eax, dword [esp + 0x58]
push eax
call fcn.0045a870
add esp, 4
xor edi, edi
mov ebx, 8
cmp dword [esp + 0x50], ebx
mov esi, 7
mov dword [esp + 0x6c], esi
mov dword [esp + 0x68], edi
mov word [esp + 0x58], di
jb 0x42399e
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.0045a870
add esp, 4
cmp dword [esp + 0x88], ebx
mov dword [esp + 0x50], esi
mov dword [esp + 0x4c], edi
mov word [esp + 0x3c], di
jb 0x4239c1
mov edx, dword [esp + 0x74]
push edx
call fcn.0045a870
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x868]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x850]
xor ecx, esp
call fcn.00478599
mov esp, ebp
pop ebp
ret