Function at 0x408670
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46a7e2
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push ebx
push esi
push edi
mov eax, dword [0x4914f4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x20], ebx
call fcn.0042e07d
mov edi, dword [ebp + 8]
mov esi, dword [eax + 0xc]
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
jne 0x4086dc
push 4
push edi
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
jne 0x4086dc
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
xor edi, edi
cmp esi, edi
je 0x4086c6
mov eax, dword [ebx]
mov edx, dword [eax + 0x1c]
mov ecx, ebx
call edx
call dword [sym.imp.USER32.dll_CreateMenu]
push eax
mov ecx, ebx
call fcn.004232bb
test eax, eax
je 0x4086c6
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
movzx ecx, word [eax + 2]
lea esi, [ecx + eax + 4]
lea ecx, [ebp - 0x4c]
call fcn.0042d14c
mov dword [ebp - 0x4c], 0x471a04
mov dword [ebp - 4], edi
mov dword [ebp - 0x38], vtable.CArray_int__int_.0
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x30], edi
mov edx, dword [ebp - 0x44]
push ebx
push edx
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 1
call fcn.0042d2e2
push 0xffffffffffffffff
push 1
lea ecx, [ebp - 0x38]
call fcn.00401c10
mov eax, dword [ebp - 0x34]
mov dword [eax], edi
lea ecx, [ecx]
movzx eax, word [esi]
mov ecx, eax
add esi, 2
and ecx, 0x10
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ecx
jne 0x40877e
movzx ecx, word [esi]
mov dword [ebp - 0x14], ecx
add esi, 2
jmp 0x408781
mov dword [ebp - 0x14], edi
movzx eax, ax
mov dword [ebp + 8], eax
test al, al
jns 0x408791
add eax, 0xffffff80
mov dword [ebp + 8], eax
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x408796
sub eax, edx
sar eax, 1
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0042316d
mov edi, eax
mov edx, edi
add esp, 4
mov dword [ebp - 0x10], edi
mov eax, esi
sub edx, esi
lea ebx, [ebx]
movzx ecx, word [eax]
mov word [eax + edx], cx
add eax, 2
test cx, cx
jne 0x4087d0
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4087e4
sub eax, edx
sar eax, 1
lea eax, [esi + eax*2 + 2]
mov dword [ebp - 0x24], eax
cmp word [ebp - 0x1c], cx
je 0x4088dc
test byte [ebp - 0x18], 0x80
je 0x40882b
mov eax, dword [ebp - 0x44]
dec eax
js case.0x4089ba.1
mov edi, dword [ebp - 0x30]
cmp eax, edi
jge case.0x4089ba.1
mov ecx, dword [ebp - 0x34]
mov dword [ecx + eax*4], 1
jmp 0x40882e
mov edi, dword [ebp - 0x30]
push 0x5c
call fcn.0042313e
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x40884e
mov ecx, eax
call fcn.00401d70
mov esi, eax
jmp 0x408850
xor esi, esi
mov edx, dword [ebx + 0x50]
mov dword [esi + 0x50], edx
mov eax, dword [ebx + 0x4c]
mov dword [esi + 0x4c], eax
mov ecx, dword [ebx + 0x44]
mov byte [ebp - 4], 1
mov dword [esi + 0x44], ecx
mov dword [esi + 0x48], 1
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push eax
mov ecx, esi
call fcn.004232bb
mov ecx, dword [ebp - 0x44]
lea eax, [ecx - 1]
test eax, eax
js case.0x4089ba.1
cmp eax, ecx
jge case.0x4089ba.1
mov edx, dword [esi + 4]
mov ecx, dword [ebp + 8]
push 0xffffffffffffffff
push edx
mov edx, dword [ebp - 0x10]
push ecx
mov ecx, dword [ebp - 0x48]
mov ecx, dword [ecx + eax*4]
push edx
call fcn.004084d0
mov edx, dword [ebp - 0x44]
push esi
push edx
lea ecx, [ebp - 0x4c]
call fcn.0042d2e2
test edi, edi
js case.0x4089ba.1
push 0xffffffffffffffff
lea eax, [edi + 1]
push eax
lea ecx, [ebp - 0x38]
call fcn.00401c10
mov ecx, dword [ebp - 0x34]
mov dword [ecx + edi*4], 0
jmp 0x4089d2
mov ecx, dword [ebp - 0x44]
lea eax, [ecx - 1]
test eax, eax
js case.0x4089ba.1
cmp eax, ecx
jge case.0x4089ba.1
movzx edx, word [ebp - 0x14]
mov ecx, dword [ebp + 8]
push 0xffffffffffffffff
push edx
mov edx, dword [ebp - 0x48]
push ecx
mov ecx, dword [edx + eax*4]
push edi
call fcn.004084d0
test byte [ebp - 0x18], 0x80
je 0x40892c
mov eax, dword [ebp - 0x44]
dec eax
js case.0x4089ba.1
cmp eax, dword [ebp - 0x30]
jge case.0x4089ba.1
mov ecx, dword [ebp - 0x34]
mov dword [ecx + eax*4], 1
mov ecx, dword [ebp - 0x44]
lea esi, [ecx - 1]
test esi, esi
js 0x4089d5
mov edx, dword [ebp - 0x34]
lea edi, [esi + 1]
lea ebx, [edx + esi*4]
jmp 0x408948
mov ecx, dword [ebp - 0x44]
test esi, esi
js case.0x4089ba.1
cmp esi, dword [ebp - 0x30]
jge case.0x4089ba.1
cmp dword [ebx], 0
je 0x4089cf
lea eax, [ecx - 1]
test eax, eax
js case.0x4089ba.1
cmp eax, ecx
jge case.0x4089ba.1
mov ecx, dword [ebp - 0x48]
mov ecx, dword [ecx + eax*4]
call fcn.00407a30
push 1
push esi
lea ecx, [ebp - 0x4c]
call fcn.0042d3bc
mov eax, dword [ebp - 0x30]
cmp edi, eax
jg case.0x4089ba.1
cmp edi, esi
jl case.0x4089ba.1
cmp edi, 1
jl case.0x4089ba.1
sub eax, edi
je case.0x4089ba.0
add eax, eax
add eax, eax
push eax
lea edx, [ebx + 4]
push edx
push eax
push ebx
call fcn.00446602
add esp, 0x10
cmp eax, 0x50
ja case.0x4089ba.1
movzx eax, byte [eax + 0x408b40]
jmp dword [eax*4 + 0x408b30]
dec dword [ebp - 0x30]
dec edi
sub ebx, 4
dec esi
jns 0x408945
mov ebx, dword [ebp - 0x20]
mov edi, dword [ebp - 0x10]
push edi
call fcn.00423178
mov ecx, dword [ebp - 0x44]
dec ecx
add esp, 4
cmp ecx, 0xffffffff
je 0x4089fb
mov esi, dword [ebp - 0x24]
xor edi, edi
jmp 0x408760
call fcn.0042d53d
call fcn.0042d505
mov edx, dword [ebx + 4]
push edx
xor esi, esi
call dword [sym.imp.USER32.dll_GetMenuItemCount]
test eax, eax
jle 0x408af1
test esi, esi
js case.0x4089ba.1
cmp esi, dword [ebx + 0x10]
jge case.0x4089ba.1
mov eax, dword [ebx + 0xc]
lea ecx, [ebp + 8]
lea edi, [esi*4]
push ecx
mov ecx, dword [eax + edi]
call fcn.00405910
mov edx, dword [ebx + 4]
push esi
push edx
mov byte [ebp - 4], 3
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call fcn.00423286
test eax, eax
je 0x408a7e
cmp esi, dword [ebx + 0x10]
jge case.0x4089ba.1
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + edi]
mov dword [eax + 0x14], 0x410
mov ecx, dword [ebx + 4]
mov edi, dword [ebp + 8]
push esi
push ecx
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call fcn.00423286
mov eax, dword [eax + 4]
mov edx, dword [ebx + 4]
push edi
push eax
push 0x410
push esi
push edx
jmp 0x408ab5
cmp esi, dword [ebx + 0x10]
jge case.0x4089ba.1
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + edi]
mov dword [eax + 0x14], 0x400
cmp esi, dword [ebx + 0x10]
jge case.0x4089ba.1
mov eax, dword [ebx + 0xc]
mov ecx, dword [eax + edi]
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x18]
push edx
push eax
mov eax, dword [ebx + 4]
push 0x400
push esi
push eax
call dword [sym.imp.USER32.dll_ModifyMenuW]
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
mov byte [ebp - 4], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408ade
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebx + 4]
push ecx
inc esi
call dword [sym.imp.USER32.dll_GetMenuItemCount]
cmp esi, eax
jl 0x408a0f
mov eax, dword [ebp - 0x34]
mov dword [ebx + 0x58], 1
test eax, eax
je 0x408b08
push eax
call fcn.00423178
add esp, 4
lea ecx, [ebp - 0x4c]
mov dword [ebp - 4], 0xffffffff
call fcn.0042d163
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4