Function at 0x4df4a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b30ad
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x6244f8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x34], ebx
mov edx, dword [ebx + 0x40]
mov ecx, dword [ebx + 0xb8]
lea eax, [edx + 1]
cmp eax, dword [ecx + 0x2c]
jge 0x4df516
mov edi, edi
add edx, 1
js 0x4df4f2
cmp edx, dword [ecx + 0x2c]
jge 0x4df4f2
mov eax, dword [ecx + 0x28]
mov edx, dword [eax + edx*4]
jmp 0x4df4f4
xor edx, edx
mov eax, dword [edx + 0x44]
cmp eax, dword [0x623c78]
jl 0x4df516
mov eax, dword [ecx]
push edx
call dword [eax + 0x50]
mov edx, dword [ebx + 0x40]
mov ecx, dword [ebx + 0xb8]
lea eax, [edx + 1]
cmp eax, dword [ecx + 0x2c]
jl 0x4df4e0
mov ecx, dword [ebx + 0xc0]
call fcn.004a28e0
push eax
push 0x5e9a7c
call fcn.0054abdb
add esp, 8
test eax, eax
je 0x4df53b
mov esi, dword [eax + 0x120]
jmp 0x4df53d
xor esi, esi
mov ecx, dword [ebx + 0xc0]
mov dword [ebp - 0x24], esi
call fcn.004a29c0
test eax, eax
jne 0x4df8a6
test esi, esi
je 0x4df8a6
mov edi, dword [ebx + 0x40]
or dword [ebx + 0x90], 1
inc edi
mov dword [ebp - 0x10], edi
call fcn.0053955f
mov ecx, eax
test ecx, ecx
je 0x4df8c4
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
push 0
push 0
push 0x229
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x2c], eax
test eax, eax
je 0x4df5d6
push eax
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
mov edx, dword [0x623c78]
mov dword [ebp - 0x20], 0x8000
lea ecx, [eax - 0x8000]
cmp ecx, 0x2e
cmovbe edx, dword [ebp - 0x20]
dec eax
cmp eax, 0x2d
mov eax, 1
cmovbe edx, eax
mov dword [0x623c78], edx
jmp 0x4df5dc
mov edx, dword [0x623c78]
push edx
push esi
mov dword [ebp - 0x14], edx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
test esi, esi
je 0x4df870
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4df83e
lea eax, [ebp - 0x18]
push eax
push esi
call fcn.00477080
add esp, 8
mov ecx, 0xb
cmp dword [0x62d1e8], 0
mov eax, 1
cmovne eax, ecx
mov ecx, dword [ebx + 0xb8]
push 1
push edi
push 0x5bbe20
push dword [ebp - 0x14]
push eax
call fcn.004868d0
mov ecx, dword [ebp - 0x10]
mov edi, eax
sub ecx, dword [ebx + 0x40]
lea eax, [ebp - 0x18]
push ecx
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x20], edi
push eax
call fcn.004de020
add esp, 0xc
push dword [eax]
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.0048ce40
mov edx, dword [ebp - 0x28]
or eax, 0xffffffff
mov byte [ebp - 4], 0
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4df680
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebx + 0x40]
xor ecx, ecx
mov edx, dword [edi]
inc eax
cmp dword [ebp - 0x10], eax
sete cl
push ecx
mov ecx, edi
call dword [edx + 0x5c]
mov edx, dword [edi]
xor eax, eax
cmp dword [ebp - 0x2c], esi
mov esi, dword [ebp - 0x20]
mov ecx, esi
sete al
push eax
call dword [edx + 0x68]
push 8
mov ecx, esi
call fcn.0048d1e0
mov ecx, ebx
mov dword [esi + 0x4c], 0xef1f
call fcn.0048bfb0
test al, al
jns 0x4df6df
mov eax, dword [ebx + 0x40]
inc eax
cmp dword [ebp - 0x10], eax
jne 0x4df6df
mov ecx, esi
call fcn.0048bfb0
or eax, 0x80
mov ecx, esi
push eax
call fcn.0048d1e0
call fcn.0053955f
mov ecx, eax
test ecx, ecx
je 0x4df8c4
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x1c], esi
push 0xef1f
mov byte [ebp - 4], 2
call fcn.00539418
mov ebx, eax
test ebx, ebx
je 0x4df802
push 6
push 0xef2
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x30], eax
test eax, eax
je 0x4df802
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4df802
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x4df802
push dword [ebp - 0x30]
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, 0xf
lea ecx, [eax + edi]
lea ecx, [ecx]
cmp edi, ecx
jae 0x4df802
movzx edx, word [edi]
inc edx
lea edx, [edi + edx*2]
cmp edx, ecx
jae 0x4df802
movzx eax, word [edx]
lea edx, [edx + eax*2]
add edx, 2
cmp edx, ecx
jae 0x4df802
movzx eax, word [edx]
lea edx, [edx + eax*2]
add edx, 2
cmp edx, ecx
jae 0x4df802
movzx eax, word [edx]
lea edx, [edx + eax*2]
add edx, 2
cmp edx, ecx
jae 0x4df802
movzx edi, word [edx]
inc edi
lea edi, [edx + edi*2]
sub ebx, 5
jne 0x4df760
cmp edi, ecx
jae 0x4df802
movzx edx, word [edi]
test dx, dx
je 0x4df802
mov eax, dword [esi - 8]
mov ebx, edx
mov ecx, 1
sub eax, ebx
sub ecx, dword [esi - 4]
or eax, ecx
jge 0x4df7d8
push ebx
lea ecx, [ebp - 0x1c]
call fcn.004053a9
movzx edx, word [edi]
mov esi, dword [ebp - 0x1c]
movzx eax, dx
add edi, 2
push eax
push edi
push ebx
push esi
call fcn.0057a3e7
push eax
call fcn.00404d1a
add esp, 0x14
cmp ebx, dword [esi - 8]
jg 0x4df8ce
xor eax, eax
mov dword [esi - 0xc], ebx
mov word [esi + ebx*2], ax
mov ecx, dword [ebp - 0x20]
push esi
call fcn.0048d2c0
mov edi, dword [ebp - 0x10]
add esi, 0xfffffff0
mov ebx, dword [ebp - 0x34]
inc edi
mov eax, edi
mov dword [ebp - 0x10], edi
mov byte [ebp - 4], 0
sub eax, dword [ebx + 0x40]
cmp eax, dword [0x623c7c]
jg 0x4df85b
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4df83e
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x14]
inc eax
push eax
push dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
test esi, esi
jne 0x4df5f1
jmp 0x4df870
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4df870
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x18]
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4df8b0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [ebx + 0x90], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00404e00
push 0x80070057
call fcn.00404e00
int3