Function at 0x402bd0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov edx, 0x4120bb
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x37c
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], edx
mov eax, dword [ebp + 0xc]
mov dword [esp], 0
mov dword [esp + 4], eax
call sub.KERNEL32.dll_FindResourceA
mov ebx, eax
sub esp, 0xc
xor eax, eax
test ebx, ebx
je 0x402c90
mov dword [esp + 4], ebx
mov dword [esp], 0
call sub.KERNEL32.dll_SizeofResource
mov dword [ebp - 0x360], eax
sub esp, 8
mov dword [esp + 4], ebx
mov dword [esp], 0
call sub.KERNEL32.dll_LoadResource
sub esp, 8
test eax, eax
mov esi, eax
je 0x402c77
mov dword [esp], eax
call sub.KERNEL32.dll_LockResource
mov edi, eax
sub esp, 4
xor eax, eax
test edi, edi
je 0x402c90
movzx eax, byte [edi]
mov edx, 2
cmp al, 0x49
je switch.0x00402c70
jle 0x402c98
cmp al, 0x4d
je 0x402e5b
cmp al, 0x52
je case.default.0x402c70
lea esi, [esi]
jmp dword [edx*4 + 0x412138]
cmp edi, 1
je 0x402e09
cmp edi, 2
je 0x402e37
xor eax, eax
nop
lea esi, [esi]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp al, 0x30
je 0x402e51
jg switch.0x00402c70
cmp al, 0xff
je 0x402e83
test al, al
jne switch.0x00402c70
movzx eax, byte [edi + 8]
cmp al, 0x41
je 0x402cbf
cmp al, 0x57
mov edx, 5
jne switch.0x00402c70
mov edx, 3
jmp switch.0x00402c70
mov ecx, 0x4120bf
mov dword [esp + 4], ecx
nop
lea ebx, [ebp - 0x358]
mov dword [esp], ebx
call sub.KERNEL32.dll_lstrcpyA
sub esp, 8
mov dword [esp + 0x10], ebx
mov edx, dword [ebp + 0xc]
mov ebx, str._squizz_d._s
mov dword [esp + 0xc], edx
mov eax, dword [0x413020]
mov dword [esp + 4], ebx
lea ebx, [ebp - 0x238]
add eax, 0x68e8
mov dword [esp], ebx
mov dword [esp + 8], eax
call sub.USER32.dll_wsprintfA
mov dword [esp + 4], ebx
mov dword [esp], 0x413160
call sub.KERNEL32.dll_lstrcpyA
sub esp, 8
xor ecx, ecx
mov edx, pe_nt_image_headers32
mov dword [esp + 0x18], ecx
mov eax, 2
xor ecx, ecx
mov dword [esp + 0x14], edx
xor edx, edx
mov dword [esp + 0x10], eax
mov eax, 0x40000000
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.KERNEL32.dll_CreateFileA
sub esp, 0x1c
lea edx, [ebp - 0x35c]
xor ecx, ecx
mov dword [esp + 0x10], ecx
mov ebx, eax
mov dword [esp + 0xc], edx
mov eax, dword [ebp - 0x360]
mov dword [esp + 4], edi
mov dword [esp], ebx
mov dword [esp + 8], eax
call sub.KERNEL32.dll_WriteFile
sub esp, 0x14
mov dword [esp], ebx
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov dword [esp], esi
call sub.KERNEL32.dll_FreeResource
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
lea ebx, [ebp - 0x358]
jmp 0x402ce1
mov eax, 0x4120d0
mov dword [esp + 4], eax
jmp 0x402cd0
mov ebx, 0x4120d4
mov dword [esp + 4], ebx
jmp 0x402cd0
mov eax, 0x4120d8
mov dword [esp + 4], eax
jmp 0x402cd0
mov eax, 0x4120dc
mov dword [esp + 4], eax
jmp 0x402cd0
mov eax, 0x4120e0
mov dword [esp + 4], eax
jmp 0x402cd0
mov eax, 0x4120e4
mov dword [esp + 4], eax
jmp 0x402cd0
xor edi, edi
mov esi, 0x411014
mov ebx, str.Impossible_de_charger_le_fichier_audio.
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], 0
call sub.USER32.dll_MessageBoxA
sub esp, 0x10
xor eax, eax
jmp 0x402c90
xor edx, edx
mov eax, 0x411014
mov ecx, str.Impossible_de_charger_le_fichier_vid
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
jmp 0x402e21
mov edx, 4
jmp switch.0x00402c70
mov edx, 6
jmp switch.0x00402c70
movzx eax, byte [edi + 8]
cmp al, 0x41
je 0x402cbf
cmp al, 0x57
jne switch.0x00402c70
mov edx, 1
jmp switch.0x00402c70
movzx eax, byte [edi + 1]
cmp al, 0xf3
je 0x402e95
jg 0x402e9f
cmp al, 0xe3
jne switch.0x00402c70
mov edx, 2
jmp switch.0x00402c70
test al, al
jne switch.0x00402c70
mov edx, 5
jmp switch.0x00402c70