Function at 0x41c9d0
Capabilities:
Extract resource via kernel32 functions
Get file system object information

Disassembly:
push ebp
push ebx
push edi
mov edx, 0xbc
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x41c9d8
mov edx, dword [esp + 0x304]
lea ecx, [esp]
call fcn.0041e000
mov dword [esp + 8], 0
mov ebx, dword [esp + 0x314]
cmp ebx, 0x10
jne 0x41ca32
dec dword [esp + 0x308]
push 1
lea eax, [esp + 8]
push eax
push 0
push dword [esp + 0x314]
push dword [esp + 0x10]
call sub.SHELL32.DLL_ExtractIconExW
mov dword [esp + 8], eax
mov ebx, dword [esp + 0x314]
cmp ebx, 0x20
jne 0x41ca68
dec dword [esp + 0x308]
push 1
push 0
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x314]
push dword [esp + 0x10]
call sub.SHELL32.DLL_ExtractIconExW
mov dword [esp + 8], eax
mov ebx, dword [esp + 0x314]
mov ecx, ebx
sar ecx, 0x1f
push ecx
push ebx
pop ebx
pop edi
cmp ebx, 0xd096be13
jne 0x41ca88
cmp edi, 0x3279e
je 0x41ca8c
xor eax, eax
jmp 0x41ca91
mov eax, 1
or eax, eax
je 0x41cb51
push 0x4000
push 0x2b4
lea eax, [esp + 0x14]
push eax
push 0xffffffff
push dword [esp + 0x10]
call sub.SHELL32.DLL_SHGetFileInfoW
push str.Shell32.dll
push 0xffffffff
call fcn.0041fd4f
mov dword [esp + 0x2c0], eax
cmp dword [esp + 0x2c0], 0
je 0x41cb51
mov ebp, 0x438ef8
mov dword [esp + 0x2c4], ebp
lea eax, [esp + 0x2cc]
push eax
push dword [esp + 0x2c8]
push 2
push str.SHGetImageList
push dword [esp + 0x2d0]
call fcn.0041fcd4
mov dword [esp + 0x2c8], eax
mov ebx, dword [esp + 0x2c8]
and ebx, ebx
jne 0x41cb51
lea eax, [esp + 4]
push eax
push 1
lea ebp, [esp + 0x14]
push dword [ebp + 4]
mov eax, dword [esp + 0x2d8]
push eax
mov eax, dword [eax]
call dword [eax + 0x28]
mov dword [esp + 0x2c8], eax
mov ebx, dword [esp + 0x2c8]
and ebx, ebx
jne 0x41cb51
mov dword [esp + 8], 1
mov ebx, dword [esp + 0x314]
cmp ebx, 0x28
jle 0x41cd90
mov dword [esp + 0x2d8], 0
mov dword [esp + 4], 0
push 2
push 0
push dword [esp + 8]
call sub.KERNEL32.dll_LoadLibraryExW
mov dword [esp + 0x2d0], eax
cmp dword [esp + 0x2d0], 0
je 0x41cd90
push 0xe
push dword [esp + 0x30c]
push dword [esp + 0x2d8]
call sub.KERNEL32.dll_FindResourceW
mov dword [esp + 0x2dc], eax
cmp dword [esp + 0x2dc], 0
je 0x41ccce
push dword [esp + 0x2dc]
push dword [esp + 0x2d4]
call sub.KERNEL32.dll_LoadResource
mov dword [esp + 0x2e0], eax
cmp dword [esp + 0x2e0], 0
je 0x41ccce
push dword [esp + 0x2e0]
call sub.KERNEL32.dll_LockResource
mov dword [esp + 0x2d4], eax
cmp dword [esp + 0x2d4], 0
je 0x41ccce
mov dword [esp + 0x2e4], 0
mov ebp, dword [esp + 0x2d4]
movsx ebx, word [ebp + 4]
dec ebx
cmp ebx, dword [esp + 0x2e4]
jl 0x41ccce
mov ebp, dword [esp + 0x2d4]
push ebp
mov eax, dword [esp + 0x2e8]
imul eax, eax, 0xe
pop ebp
add ebp, eax
lea eax, [ebp + 6]
push eax
call fcn.00430490
mov ebx, eax
cmp ebx, dword [esp + 0x314]
jne 0x41ccc1
mov ebp, dword [esp + 0x2d4]
push ebp
mov eax, dword [esp + 0x2e8]
imul eax, eax, 0xe
pop ebp
add ebp, eax
movsx ebx, word [ebp + 0xc]
cmp ebx, dword [esp + 0x2e8]
jle 0x41ccc1
mov ebp, dword [esp + 0x2d4]
push ebp
mov eax, dword [esp + 0x2e8]
imul eax, eax, 0xe
pop ebp
add ebp, eax
movsx eax, word [ebp + 0xc]
mov dword [esp + 0x2e8], eax
mov ebp, dword [esp + 0x2d4]
push ebp
mov eax, dword [esp + 0x2e8]
imul eax, eax, 0xe
pop ebp
add ebp, eax
movsx eax, word [ebp + 0x12]
mov dword [esp + 0x2d8], eax
inc dword [esp + 0x2e4]
jno 0x41cc1d
mov ebx, dword [esp + 0x2d8]
and ebx, ebx
jle 0x41cd84
push 3
push dword [esp + 0x2dc]
push dword [esp + 0x2d8]
call sub.KERNEL32.dll_FindResourceW
mov dword [esp + 0x2dc], eax
cmp dword [esp + 0x2dc], 0
je 0x41cd84
push dword [esp + 0x2dc]
push dword [esp + 0x2d4]
call sub.KERNEL32.dll_LoadResource
mov dword [esp + 0x2e0], eax
cmp dword [esp + 0x2e0], 0
je 0x41cd84
push dword [esp + 0x2e0]
call sub.KERNEL32.dll_LockResource
mov dword [esp + 0x2ec], eax
cmp dword [esp + 0x2ec], 0
je 0x41cd84
push 0
push 0
push 0
push 0x30000
push 1
push dword [esp + 0x2f0]
push dword [esp + 0x2e8]
call sub.KERNEL32.dll_SizeofResource
push eax
push dword [esp + 0x304]
call sub.USER32.DLL_CreateIconFromResourceEx
mov dword [esp + 4], eax
push dword [esp + 0x2d0]
call sub.KERNEL32.dll_FreeLibrary
push dword [esp + 4]
push 0
push 0
push dword [esp + 0x31c]
push dword [esp + 0x31c]
push dword [esp + 0x314]
call fcn.0042062e
xor eax, eax
push dword [esp]
call fcn.00431170
add esp, 0x2f0
pop edi
pop ebx
pop ebp
ret 0x18