Function at 0x402110
Capabilities:
Extract resource via kernel32 functions
Get file size
Read file on windows

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push edi
push 0x454644
push 0x3f1
xor ebp, ebp
push ebp
mov edi, ecx
mov dword [esp + 0x18], 1
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebp
jne 0x40213b
mov dword [esp + 0xc], ebp
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
cmp ebx, ebp
mov dword [esp + 0x24], ebx
je 0x402153
cmp dword [esp + 0xc], ebp
jne 0x40215c
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c
ret
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov eax, dword [esi + 0x28]
mov dword [edi + 0x214], eax
cmp dword [edi + 0xc4], ebp
jne 0x402180
cmp dword [0x468d80], 2
jne 0x4021ac
mov ecx, dword [esi + 0xc]
mov dword [edi + 0x1e8], ecx
mov edx, dword [esi + 0x10]
mov dword [edi + 0x1ec], edx
mov eax, dword [esi + 0x20]
mov dword [edi + 0xc0], eax
mov ecx, dword [esi + 0x1c]
mov dword [edi + 0xc], ecx
cmp dword [esi + 0x1c], ebp
je 0x4021ac
mov dword [edi + 0x1ec], ebp
mov eax, dword [esi + 8]
mov edx, dword [esi]
mov ecx, dword [esi + 4]
mov dword [esp + 0x14], eax
cmp dword [esi + 0x24], ebp
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], ecx
jne 0x4021cf
mov dword [0x468d80], 2
mov dl, byte [edi + 0xe4]
lea eax, [edi + 0xe4]
xor ecx, ecx
test dl, dl
sete cl
cmp ecx, ebp
mov dword [edi + 0xb4], ecx
jne 0x4022ac
cmp dword [edi + 0xd0], ebp
jne 0x4022ac
push ebp
push 0x80
push 3
push ebp
push 1
push SysReAllocStringLen
push eax
xor ebx, ebx
mov dword [esp + 0x34], ebp
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x4022d8
test ebp, ebp
je 0x4022d8
push ebx
push ebp
mov dword [esp + 0x2c], 1
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
push ebx
call fcn.0043f0db
mov ecx, dword [esp + 0x28]
add esp, 4
mov dword [edi + 0xc8], eax
mov eax, dword [edi + 0xc8]
test eax, eax
je 0x40229f
test ecx, ecx
je 0x40229f
push 0
lea edx, [esp + 0x1c]
push edx
push ebx
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [edi + 0xc8]
mov edx, dword [esp + 0x18]
push eax
mov ecx, edi
mov dword [edi + 0xd8], edx
call fcn.004019f0
cmp ebx, edx
mov dword [edi + 0xdc], eax
mov eax, 1
mov dword [edi + 0xd4], eax
jne 0x40229f
mov dword [edi + 0x10], eax
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [esp + 0x28]
xor ebp, ebp
cmp dword [edi + 0xb4], ebp
jne 0x4022df
cmp dword [edi + 0xc4], ebp
jne 0x4022df
cmp dword [0x468d80], 2
je 0x4022df
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x402398
xor ecx, ecx
jmp 0x402251
cmp dword [edi + 0xd0], ebp
jne 0x4022ee
mov dword [edi + 0x10], 1
mov al, byte [edi + 0x1c]
test al, al
jne 0x40230f
cmp dword [edi + 0xc4], 1
jne 0x40230f
mov eax, dword [esi + 0x18]
push eax
mov ecx, edi
mov dword [edi + 0x1f4], eax
call fcn.00401660
mov dword [edi + 0xb4], 1
mov esi, dword [esi + 0x14]
cmp esi, 4
mov dword [edi + 0xdc], esi
je 0x402330
cmp esi, 5
je 0x402330
xor esi, esi
jmp 0x402335
mov esi, 1
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
cmp esi, ebp
je 0x402386
movzx ecx, word [esp + 0x20]
push str.PM_USER_DATA
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push ebp
mov dword [edi + 0xc8], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [edi + 0xd8], eax
mov dword [edi + 0xd4], ebp
jmp 0x402398
mov dword [edi + 0xc8], ebp
mov dword [edi + 0xd8], ebp
mov dword [edi + 0xb4], ebp
push str.PM_RESOURCE_TYPE_MAP
push 0x3f2
push ebp
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebp
jne 0x4023b1
mov dword [esp + 0x10], ebp
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebp
je 0x4023c3
cmp dword [esp + 0x10], ebp
jne 0x4023cd
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x1c]
cmp ecx, ebp
je 0x402482
mov edx, ecx
mov ebx, eax
mov dword [esp + 0x1c], edx
jmp 0x4023f0
xor ebp, ebp
lea esp, [esp]
push 0x14
call fcn.0043f0b7
add esp, 4
cmp eax, ebp
je 0x402418
mov dword [eax], vtable.CPmwEmbeddedResource.0
mov dword [eax + 8], 9
mov dword [eax + 4], ebp
mov dword [eax + 0xc], ebp
mov dword [eax + 0x10], ebp
mov esi, eax
jmp 0x40241a
xor esi, esi
mov eax, dword [esp + 0x14]
movzx edx, ax
push str.PM_USER_DATA
mov dword [esi + 0xc], eax
movzx ecx, byte [ebx]
push edx
push ebp
mov dword [esi + 8], ecx
inc ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebp, eax
push ebp
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebp
mov dword [esi + 4], eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [esp + 0x20]
cmp eax, dword [esp + 0x14]
jne 0x402461
mov edx, dword [esi]
push 1
mov ecx, esi
call dword [edx]
jmp 0x40246a
mov eax, dword [edi + 0x40]
lea ecx, [edi + 0x40]
push esi
call dword [eax]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
inc ecx
dec eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x1c], eax
jne 0x4023ea
mov eax, dword [esp + 0x10]
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x1c
ret