Function at 0x436397
Capabilities:
Extract resource via kernel32 functions
Get common file path

Disassembly:
push 0x224
mov eax, 0x57edfa
call fcn.004f495a
push dword [0x60c6ac]
call fcn.00536259
pop ecx
push 2
call fcn.005364ce
pop ecx
lea eax, [ebp - 0x230]
push eax
call fcn.00532063
pop ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
call fcn.005321ad
dec eax
sub eax, 1
jne 0x436882
cmp byte [0x607458], bl
jne 0x4363f4
mov eax, dword [0x60c6b8]
cmp eax, 3
je 0x4363f4
cmp eax, 4
mov al, bl
jne 0x4363f6
mov al, 1
cmp byte [0x60bfeb], bl
je 0x43640c
xor ecx, ecx
movzx eax, al
cmp dword [0x60ca58], ecx
cmovne eax, ecx
test al, al
je 0x43654d
movzx eax, word [0x60c814]
push 0x5c2234
push eax
call fcn.00532198
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x436884
push esi
call fcn.00532198
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
push esi
test edi, edi
jne 0x436456
call dword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x436884
call fcn.00532198
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x436884
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
call fcn.005364db
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
push 0x104
lea eax, [ebp - 0x118]
push ebx
push eax
call fcn.005065b0
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
push ebx
push ebx
push 0x1a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendA]
mov eax, 0x60ca14
push 0x10
pop esi
cmp dword [0x60ca28], esi
cmovae eax, dword [0x60ca14]
push eax
lea eax, [ebp - 0x118]
push eax
call edi
push 4
push 0x5b71c0
lea ecx, [ebp - 0x130]
call fcn.004313b0
cmp dword [eax + 0x14], esi
jb 0x4364e6
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x118]
push eax
call edi
lea ecx, [ebp - 0x130]
call fcn.0040bb00
mov edx, 0x60c74c
lea ecx, [ebp - 0x130]
call fcn.004304b0
cmp dword [eax + 0x14], esi
jb 0x436512
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x118]
push eax
call edi
lea ecx, [ebp - 0x130]
call fcn.0040bb00
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x160]
call fcn.0040bb40
lea ecx, [ebp - 0x160]
mov byte [ebp - 4], 1
call fcn.0041d740
jmp 0x436877
cmp dword [0x60cd7c], ebx
jne 0x4367e0
push 0x104
lea eax, [ebp - 0x118]
push ebx
push eax
call fcn.005065b0
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
push ebx
push ebx
push 0x1a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendA]
mov eax, 0x60ca14
push 0x10
pop esi
cmp dword [0x60ca28], esi
cmovae eax, dword [0x60ca14]
push eax
lea eax, [ebp - 0x118]
push eax
call edi
push 4
push 0x5b71c0
lea ecx, [ebp - 0x130]
call fcn.004313b0
cmp dword [eax + 0x14], esi
jb 0x4365be
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x118]
push eax
call edi
lea ecx, [ebp - 0x130]
call fcn.0040bb00
mov edx, 0x60c74c
lea ecx, [ebp - 0x130]
call fcn.004304b0
cmp dword [eax + 0x14], esi
jb 0x4365ea
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x118]
push eax
call edi
lea ecx, [ebp - 0x130]
call fcn.0040bb00
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x130]
call fcn.0040bb40
lea ecx, [ebp - 0x130]
mov byte [ebp - 4], 2
call fcn.0041d740
lea ecx, [ebp - 0x130]
mov byte [ebp - 4], bl
call fcn.0040bb00
push 0x60ca48
lea ecx, [ebp - 0x160]
call fcn.00422770
lea eax, [ebp - 0x118]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x130]
call fcn.0040bb40
lea eax, [ebp - 0x130]
mov byte [ebp - 4], 4
push 1
push eax
lea edx, [ebp - 0x160]
lea ecx, [ebp - 0x178]
call fcn.0042c600
pop ecx
pop ecx
lea ecx, [ebp - 0x130]
mov byte [ebp - 4], 6
call fcn.0040bb00
cmp dword [ebp - 0x168], 0
jne 0x4366d7
push esi
push 0x5b71ac
lea ecx, [ebp - 0x148]
call fcn.004313b0
mov byte [ebp - 4], 7
cmp dword [eax + 0x14], esi
jb 0x4366a8
mov eax, dword [eax]
xor edx, edx
mov ecx, eax
call fcn.0040ae40
lea ecx, [ebp - 0x148]
call fcn.0040bb00
lea ecx, [ebp - 0x178]
call fcn.0040bb00
lea ecx, [ebp - 0x160]
call fcn.0040bb00
jmp 0x436884
lea edx, [ebp - 0x178]
lea ecx, [ebp - 0x1a8]
call fcn.0042f320
lea edx, [ebp - 0x178]
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x190]
call fcn.0042f3d0
push 0x5b5dc0
lea edx, [ebp - 0x1a8]
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x130]
call fcn.004275a0
pop ecx
lea ecx, [ebp - 0x190]
mov byte [ebp - 4], 0xa
push ecx
mov edx, eax
lea ecx, [ebp - 0x148]
call fcn.004272e0
pop ecx
push eax
mov ecx, 0x60cd6c
mov byte [ebp - 4], 0xb
call fcn.00422690
lea ecx, [ebp - 0x148]
call fcn.0040bb00
lea ecx, [ebp - 0x130]
mov byte [ebp - 4], 9
call fcn.0040bb00
lea edx, [ebp - 0x1a8]
lea ecx, [ebp - 0x148]
call fcn.00430640
mov byte [ebp - 4], 0xc
cmp dword [eax + 0x14], 8
jb 0x436777
mov eax, dword [eax]
push eax
call fcn.00536485
pop ecx
lea ecx, [ebp - 0x148]
mov byte [ebp - 4], 9
call fcn.0040ba40
lea edx, [ebp - 0x190]
lea ecx, [ebp - 0x148]
call fcn.00430640
mov byte [ebp - 4], 0xd
cmp dword [eax + 0x14], 8
jb 0x4367aa
mov eax, dword [eax]
push 1
push eax
call fcn.0053653f
pop ecx
pop ecx
lea ecx, [ebp - 0x148]
call fcn.0040ba40
lea ecx, [ebp - 0x190]
call fcn.0040bb00
lea ecx, [ebp - 0x1a8]
call fcn.0040bb00
lea ecx, [ebp - 0x178]
jmp 0x436872
mov esi, 0x60cd6c
lea ecx, [ebp - 0x160]
mov edx, esi
call fcn.0042f320
mov edx, esi
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x130]
call fcn.0042f3d0
lea edx, [ebp - 0x160]
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x148]
call fcn.00430640
mov byte [ebp - 4], 0x10
cmp dword [eax + 0x14], 8
jb 0x436824
mov eax, dword [eax]
push eax
call fcn.00536485
pop ecx
lea ecx, [ebp - 0x148]
mov byte [ebp - 4], 0xf
call fcn.0040ba40
lea edx, [ebp - 0x130]
lea ecx, [ebp - 0x148]
call fcn.00430640
mov byte [ebp - 4], 0x11
cmp dword [eax + 0x14], 8
jb 0x436857
mov eax, dword [eax]
push 1
push eax
call fcn.0053653f
pop ecx
pop ecx
lea ecx, [ebp - 0x148]
call fcn.0040ba40
lea ecx, [ebp - 0x130]
call fcn.0040bb00
lea ecx, [ebp - 0x160]
call fcn.0040bb00
mov bl, 1
lea ecx, [ebp - 0x230]
call fcn.0052f1a2
mov al, bl
call fcn.004f4915
ret