Function at 0x423d00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, ecx
mov dword [ebp - 8], ebx
cmp dword [ebx + 4], 0
jne 0x423f47
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
push 0
mov dword [ebx + 0x10], eax
mov dword [ebx + 0xc], esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push ebx
push eax
push 0
push dword [ebx + 0x10]
test esi, esi
mov ecx, closesocket
push 0
push 0
push 0
push 0
mov eax, 0x88000000
cmovne eax, ecx
mov ecx, 0x8080080
push eax
push 0x628fa4
mov eax, 0x80800a0
push 0x62b464
cmovne eax, ecx
push eax
call dword [sym.imp.USER32.dll_CreateWindowExW]
push eax
mov dword [ebx + 4], eax
call dword [sym.imp.USER32.dll_IsWindow]
xor edx, edx
lea esi, [ebx + 0x28]
mov dword [ebp + 8], edx
nop dword [eax + eax]
cmp dword [esi - 0x10], 0
jne 0x423ef9
call fcn.0043a8bb
xor ecx, ecx
mov edi, eax
test edx, edx
push 0x62b47c
setne cl
add ecx, 0x7a
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x423e5a
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x423e5a
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x423e5a
mov ebx, dword [ebp - 4]
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x423e50
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x423e44
push ebx
mov ebx, dword [ebp + 0xc]
push ebx
push eax
call fcn.004d0350
add esp, 0xc
mov dword [ebp + 0xc], 0
lea eax, [ebp + 0xc]
push eax
push 0
push edi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x423e34
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x423e34
push eax
lea ecx, [esi - 0x14]
call fcn.00423760
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x423e53
mov ebx, dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x423e53
mov ebx, dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi - 0x10], 0
je 0x423ef6
xor ecx, ecx
mov dword [ebp + 0xc], ecx
cmp dword [esi - 8], ecx
jle 0x423ef6
mov eax, dword [esi - 4]
xor edi, edi
mov dword [ebp - 4], edi
test eax, eax
jle 0x423ee9
nop
mov eax, dword [esi + 4]
imul eax, ecx
mov ecx, dword [esi]
imul ecx, edi
cdq
and edx, 7
lea ebx, [edx + eax]
mov eax, 0x80808081
sar ebx, 3
add ebx, ecx
add ebx, dword [esi - 0xc]
movzx edi, byte [ebx + 3]
movzx ecx, byte [ebx]
imul ecx, edi
mul ecx
movzx ecx, byte [ebx + 1]
mov eax, 0x80808081
imul ecx, edi
shr edx, 7
mov byte [ebx], dl
mul ecx
movzx ecx, byte [ebx + 2]
mov eax, 0x80808081
imul ecx, edi
mov edi, dword [ebp - 4]
shr edx, 7
inc edi
mov byte [ebx + 1], dl
mov dword [ebp - 4], edi
mul ecx
mov ecx, dword [ebp + 0xc]
shr edx, 7
mov byte [ebx + 2], dl
mov eax, dword [esi - 4]
cmp edi, eax
jl 0x423e80
inc ecx
mov dword [ebp + 0xc], ecx
cmp ecx, dword [esi - 8]
jl 0x423e75
mov edx, dword [ebp + 8]
inc edx
add esi, 0x30
mov dword [ebp + 8], edx
cmp edx, 2
jl 0x423d80
mov esi, dword [sym.imp.USER32.dll_LoadCursorW]
push 0x7f84
push 0
call esi
mov edi, dword [ebp - 8]
push 0x7f85
push 0
mov dword [edi + 0x74], eax
call esi
push 0x7f82
push 0
mov dword [edi + 0x78], eax
call esi
push 0x7f83
push 0
mov dword [edi + 0x7c], eax
call esi
mov dword [edi + 0x80], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8