Function at 0x4295b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x4b20b8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4dc104]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov eax, dword [esp + 0x4c]
mov eax, dword [eax]
mov edx, dword [esp + 0x48]
push eax
lea ecx, [esp + 0x18]
xor esi, esi
push ecx
lea ecx, [esp + 0x2c]
mov dword [esp + 0x2c], esi
call fcn.0040fce1
mov dword [esp + 0x40], esi
mov edx, dword [esp + 0x14]
mov ecx, dword [edx - 0x10]
test ecx, ecx
je 0x429610
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
call edx
test eax, eax
jne 0x42961f
mov eax, dword [0x4ee75c]
mov edx, dword [eax + 0x10]
mov ecx, 0x4ee75c
call edx
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x429a41
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebp, [eax + 0x10]
mov dword [esp + 0x18], ebp
mov byte [esp + 0x40], 1
mov ecx, 0x4c5c28
push 0
test ecx, 0xffff0000
jne 0x4297b4
mov edx, ecx
movzx eax, dx
mov ecx, 0x4ee718
mov dword [esp + 0x20], eax
xor esi, esi
call fcn.004878f6
mov edi, eax
mov dword [esp + 0x20], 1
test edi, edi
je 0x429866
test esi, esi
jne 0x429866
mov ecx, dword [esp + 0x1c]
shr ecx, 4
inc ecx
push esi
movzx edx, cx
push edx
push 6
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov ebx, eax
test ebx, ebx
je 0x4296f7
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4296f1
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4296f1
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [eax + esi]
mov eax, dword [esp + 0x1c]
and eax, 0xf
jbe 0x4296e0
mov edi, edi
cmp esi, ecx
jae 0x4296e4
sub eax, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4296d0
cmp esi, ecx
jb 0x4296e8
xor eax, eax
jmp 0x4296f1
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
mov esi, eax
test eax, eax
jne 0x42971a
mov ebx, dword [esp + 0x20]
push ebx
mov ecx, 0x4ee718
call fcn.004878f6
mov edi, eax
inc ebx
mov dword [esp + 0x20], ebx
test edi, edi
jne 0x42967d
jmp 0x429866
test edi, edi
je 0x429866
mov esi, dword [esp + 0x1c]
mov eax, esi
shr eax, 4
inc eax
movzx ecx, ax
push 6
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x429866
push esi
push eax
push edi
call fcn.004010e8
mov edi, eax
add esp, 0xc
test edi, edi
je 0x429866
movzx eax, word [edi]
push 0
push 0
push 0
push 0
push eax
lea ebx, [edi + 2]
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
mov eax, dword [ebp - 8]
mov ecx, 1
sub ecx, dword [ebp - 4]
sub eax, esi
or eax, ecx
jge 0x429791
push esi
lea ecx, [esp + 0x1c]
call fcn.00407ecd
mov ebp, dword [esp + 0x18]
movzx eax, word [edi]
push 0
push 0
push esi
push ebp
push eax
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test esi, esi
jge 0x429806
push 0x80070057
call fcn.0040103e
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
push 0
push 0
push 0xffffffffffffffff
push 0x4c5c28
push 0
push 3
call edi
mov esi, eax
dec esi
test esi, esi
jle 0x429814
mov eax, dword [ebp - 8]
mov ecx, 1
sub ecx, dword [ebp - 4]
sub eax, esi
or eax, ecx
jge 0x4297f3
push esi
lea ecx, [esp + 0x1c]
call fcn.00407ecd
mov ebp, dword [esp + 0x18]
push 0
push 0
push esi
push ebp
push 0xffffffffffffffff
push 0x4c5c28
push 0
push 3
call edi
cmp esi, dword [ebp - 8]
jg 0x4297aa
mov dword [ebp - 0xc], esi
mov byte [esi + ebp], 0
jmp 0x429866
cmp dword [ebp - 0xc], 0
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 0x10]
je 0x429866
cmp dword [eax + 0xc], 0
lea ecx, [eax + 0xc]
jge 0x429840
cmp dword [ebp - 8], 0
jl 0x4297aa
mov dword [ebp - 0xc], 0
mov byte [ebp], 0
jmp 0x429866
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x429856
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0xc]
mov ecx, esi
call eax
lea ebp, [eax + 0x10]
mov dword [esp + 0x18], ebp
mov byte [esp + 0x40], 2
xor eax, eax
test ebp, ebp
setne al
test eax, eax
je 0x429a41
mov ecx, dword [esp + 0x14]
push ebp
push ecx
call fcn.004899d2
add esp, 8
test eax, eax
setne bl
mov byte [esp + 0x40], 0
add ebp, 0xfffffff0
lea edx, [ebp + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x4298af
mov ecx, dword [ebp]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push ebp
call eax
test bl, bl
je 0x429a4b
mov ecx, dword [esp + 0x50]
mov eax, dword [ecx]
lea ecx, [esp + 0x14]
call fcn.00415838
lea edx, [esp + 0x14]
push edx
push 0x4ef840
lea ebx, [esp + 0x34]
call fcn.00409a0d
mov eax, dword [esp + 0x4c]
mov eax, dword [eax]
mov edx, dword [esp + 0x48]
push eax
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0x2c]
call fcn.0040fce1
mov byte [esp + 0x40], 4
mov edi, dword [eax]
mov eax, dword [esp + 0x14]
lea ecx, [edi - 0x10]
lea esi, [eax - 0x10]
cmp ecx, esi
je 0x429a13
cmp dword [esi + 0xc], 0
lea ebx, [esi + 0xc]
jl 0x429947
mov edx, dword [ecx]
cmp edx, dword [esi]
jne 0x429947
push ecx
call fcn.0040648c
mov edi, eax
add esp, 4
or eax, 0xffffffff
lock xadd dword [ebx], eax
dec eax
test eax, eax
jg 0x42993b
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
add edi, 0x10
mov dword [esp + 0x14], edi
jmp 0x429a13
mov ebx, dword [edi - 0xc]
test ebx, ebx
jne 0x4299a0
mov edi, dword [esi]
cmp dword [esi + 4], ebx
je 0x429a13
cmp dword [esi + 0xc], ebx
lea ecx, [esi + 0xc]
jge 0x429978
cmp dword [eax - 8], ebx
jl 0x4297aa
mov dword [eax - 0xc], ebx
mov ecx, dword [esp + 0x14]
mov byte [ecx], bl
jmp 0x429a13
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42998e
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
mov ecx, edi
call edx
add eax, 0x10
mov dword [esp + 0x14], eax
jmp 0x429a13
test edi, edi
je 0x4297aa
mov ecx, dword [eax - 0xc]
mov dword [esp + 0x20], ecx
mov ecx, 1
sub ecx, dword [esi + 0xc]
mov esi, dword [esi + 8]
mov ebp, edi
sub esi, ebx
sub ebp, eax
or esi, ecx
jge 0x4299d2
push ebx
lea ecx, [esp + 0x18]
call fcn.00407ecd
mov eax, dword [esp + 0x14]
mov ecx, dword [eax - 8]
push ebx
cmp ebp, dword [esp + 0x24]
ja 0x4299e8
add ebp, eax
push ebp
push ecx
push eax
call fcn.0048883b
jmp 0x4299f0
push edi
push ecx
push eax
call fcn.00489281
add esp, 0x10
test ebx, ebx
jl 0x4297aa
mov eax, dword [esp + 0x14]
cmp ebx, dword [eax - 8]
jg 0x4297aa
mov dword [eax - 0xc], ebx
mov edx, dword [esp + 0x14]
mov byte [ebx + edx], 0
mov byte [esp + 0x40], 0
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4295fa
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x4295fa
push 0x80004005
call fcn.0040103e
mov dword [esp + 0x40], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x429a73
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret