Function at 0x10103220
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101c5a18
mov eax, dword fs:[0]
push eax
sub esp, 0x264
mov eax, dword [0x1023c014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x220], ecx
mov esi, dword [0x1023c868]
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push 4
push 0x3c01
push esi
mov dword [ebp - 0x21c], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x1010370d
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x1010370d
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
mov ecx, ebx
call sym.HncOfficeFramework.dll_public:_int___thiscall_CHncMenu::LoadMenuIndirectW_void_const__
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
test esi, esi
je 0x1010370d
mov eax, dword [ebx + 4]
test eax, eax
je 0x101032cf
mov ecx, dword [eax + 0x10]
mov eax, dword [eax + 0x14]
sub eax, ecx
sar eax, 2
test eax, eax
je 0x101032cf
mov eax, dword [ecx]
test eax, eax
je 0x101032cf
mov eax, dword [eax + 0xc]
jmp 0x101032d1
xor eax, eax
mov ecx, dword [ebp - 0x21c]
cmp dword [ecx + 4], 0
jne 0x1010370d
mov dword [ecx + 4], eax
mov dword [ebp - sym.HncOfficeFramework.dll_public_virtual:_int___thiscall_CHncMenu::OnMouseEvent_class_CHMouseEvent___class_CHncMenuData___struct_tagHNCMENUITEMINFO___int_], sym.HncOfficeFramework.dll_const_CHncMenu::vftable
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x228], 0xffffffff
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x23c], 0
mov dword [ebp - 4], 0
test eax, eax
je 0x10103359
mov esi, dword [eax + 0x10]
mov eax, dword [eax + 0x14]
sub eax, esi
sar eax, 2
test eax, eax
je 0x10103359
mov esi, dword [esi]
test esi, esi
je 0x10103359
mov esi, dword [esi + 0xc]
jmp 0x1010335b
xor esi, esi
mov ecx, dword [ebp - 0x220]
mov dword [ebp - 0x244], esi
call sym.HncOfficeFramework.dll_public:_unsigned_long_int___thiscall_CHDCListCtrl::GetViewType_void_const
cmp eax, 6
ja case.0x10103375.2
jmp dword [eax*4 + 0x1010372c]
test esi, esi
je case.0x10103375.2
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
cmp eax, ecx
je case.0x10103375.2
nop dword [eax]
nop word [eax + eax]
mov edx, dword [eax]
cmp dword [edx + 8], 0x43dd
je 0x10103428
add eax, 4
cmp eax, ecx
jne 0x101033a0
jmp case.0x10103375.2
test esi, esi
je case.0x10103375.2
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
cmp eax, ecx
je case.0x10103375.2
nop word [eax + eax]
mov edx, dword [eax]
cmp dword [edx + 8], 0x43b2
je 0x10103428
add eax, 4
cmp eax, ecx
jne 0x101033d0
jmp case.0x10103375.2
test esi, esi
je case.0x10103375.2
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
cmp eax, ecx
je case.0x10103375.2
mov edx, dword [eax]
cmp dword [edx + 8], 0x3c03
je 0x10103428
add eax, 4
cmp eax, ecx
jne 0x101033f2
jmp case.0x10103375.2
test esi, esi
je case.0x10103375.2
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
cmp eax, ecx
je case.0x10103375.2
mov edx, dword [eax]
cmp dword [edx + 8], 0x3c02
je 0x10103428
add eax, 4
cmp eax, ecx
jne 0x10103414
jmp case.0x10103375.2
or dword [edx + 4], 8
lea ecx, [ebp - 0x26c]
call sym.HncOfficeFramework.dll_public:_void___thiscall_CHncMenu::constructor_void_
mov esi, dword [ebp - 0x21c]
mov byte [ebp - 4], 1
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x10103464
mov eax, dword [ecx + 0x10]
mov ecx, dword [ecx + 0x14]
sub ecx, eax
sar ecx, 2
cmp ecx, 2
jbe 0x10103464
mov edi, dword [eax + 8]
test edi, edi
je 0x10103464
mov edi, dword [edi + 0xc]
jmp 0x10103466
xor edi, edi
mov ebx, dword [ebp - 0x268]
test ebx, ebx
jne 0x101036f8
mov eax, dword [ebp - 0x220]
mov ebx, edi
mov dword [ebp - 0x268], ebx
mov edx, 0x5098
mov eax, dword [eax + 0x4a4]
cmp eax, 4
ja case.0x10103492.0
jmp dword [eax*4 + 0x10103748]
mov edx, 0x3c07
jmp case.0x10103492.0
mov edx, 0x3c08
jmp case.0x10103492.0
mov edx, 0x3c09
jmp case.0x10103492.0
mov edx, 0x3c0a
test edi, edi
je 0x101034db
mov eax, dword [edi + 0x10]
mov ecx, dword [edi + 0x14]
cmp eax, ecx
je 0x101034db
mov esi, dword [eax]
cmp dword [esi + 8], edx
je 0x101034d1
add eax, 4
cmp eax, ecx
jne 0x101034c1
jmp 0x101034d5
or dword [esi + 4], 8
mov esi, dword [ebp - 0x21c]
mov eax, dword [ebp - 0x220]
cmp dword [eax + 0x4a0], 0
je 0x10103518
test edi, edi
je 0x10103518
mov eax, dword [edi + 0x10]
mov ecx, dword [edi + 0x14]
cmp eax, ecx
je 0x10103518
nop dword [eax + eax]
mov edx, dword [eax]
cmp dword [edx + 8], 0x3c0b
je 0x10103514
add eax, 4
cmp eax, ecx
jne 0x10103500
jmp 0x10103518
or dword [edx + 4], 8
mov edi, dword [ebp - 0x220]
mov ecx, edi
push str.paste
call sym.HncOfficeFramework.dll_public:_int___thiscall_CHncShellListCtrlVL::IsValidShellCmdInThisFolder_unsigned_short_int_const__
test eax, eax
jne 0x10103558
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x10103558
mov eax, dword [ecx + 0x10]
mov ecx, dword [ecx + 0x14]
cmp eax, ecx
je 0x10103558
nop
mov edx, dword [eax]
cmp dword [edx + 8], 0x3c0d
je 0x10103554
add eax, 4
cmp eax, ecx
jne 0x10103540
jmp 0x10103558
or dword [edx + 4], 3
push str.properties
mov ecx, edi
call sym.HncOfficeFramework.dll_public:_int___thiscall_CHncShellListCtrlVL::IsValidShellCmdInThisFolder_unsigned_short_int_const__
test eax, eax
jne 0x10103598
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x10103598
mov eax, dword [ecx + 0x10]
mov ecx, dword [ecx + 0x14]
cmp eax, ecx
je 0x10103598
nop dword [eax]
mov edx, dword [eax]
cmp dword [edx + 8], 0x3c0f
je 0x10103594
add eax, 4
cmp eax, ecx
jne 0x10103580
jmp 0x10103598
or dword [edx + 4], 3
call dword [sym.imp.HncFoundation.dll_HncGetWinVersion]
cmp eax, 0xa
jb 0x101036f8
mov ecx, edi
call sym.HncOfficeFramework.dll_public:_int___thiscall_CHncShellListCtrlVL::IsInLibraryRoot_void_
test eax, eax
je 0x10103640
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0x5706
push dword [0x1023c868]
call dword [sym.imp.HncFoundation.dll_int___stdcall_HncLoadStringWToWSTRUsingRC_Deprecate_struct_HINSTANCE_____unsigned_int__unsigned_short_int___int_]
lea eax, [ebp - 0x218]
push eax
push 0x3c0e
push 0
push 0x3c0e
push dword [esi + 4]
call sym.HncOfficeFramework.dll_public:_static_int___cdecl_CHncMenu::ModifyMenuW_class_CHncMenuData___unsigned_int__unsigned_int__unsigned_int__unsigned_short_int_const__
mov ecx, dword [esi + 4]
add esp, 0x14
test ecx, ecx
je 0x101036f8
mov eax, dword [ecx + 0x10]
mov ecx, dword [ecx + 0x14]
cmp eax, ecx
je 0x101036f8
mov edx, dword [eax]
cmp dword [edx + 8], 0x3c0e
je 0x10103637
add eax, 4
cmp eax, ecx
jne 0x10103620
jmp 0x101036f8
and dword [edx + 4], 0xfffffffc
jmp 0x101036f8
mov ecx, edi
call sym.HncOfficeFramework.dll_public:_int___thiscall_CHncShellListCtrlVL::IsInLibraryFolder_void_
test eax, eax
je 0x101036f8
mov ebx, dword [ebp - 0x21c]
xor esi, esi
mov ebx, dword [ebx + 4]
test ebx, ebx
je 0x101036af
mov edi, dword [ebx + 0x14]
sub edi, dword [ebx + 0x10]
sar edi, 2
test edi, edi
je 0x101036af
mov dword [ebp - 0x220], 1
nop word [eax + eax]
lea eax, [ebp - 0x220]
mov dword [ebp - 0x224], esi
push eax
lea edx, [ebp - 0x224]
mov ecx, ebx
call fcn.101212e0
add esp, 4
test eax, eax
je 0x101036aa
cmp dword [eax + 8], 0x3c0e
je 0x101036af
inc esi
cmp esi, edi
jb 0x10103680
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0x5707
push dword [0x1023c868]
call dword [sym.imp.HncFoundation.dll_int___stdcall_HncLoadStringWToWSTRUsingRC_Deprecate_struct_HINSTANCE_____unsigned_int__unsigned_short_int___int_]
lea eax, [ebp - 0x218]
push eax
push 0x7595
push 0x400
lea eax, [esi + 1]
push eax
mov eax, dword [ebp - 0x21c]
push dword [eax + 4]
call sym.HncOfficeFramework.dll_public:_static_int___cdecl_CHncMenu::InsertMenuW_class_CHncMenuData___unsigned_int__unsigned_int__unsigned_int__unsigned_short_int_const__
mov ebx, dword [ebp - 0x268]
add esp, 0x14
cmp dword [ebp - 0x258], 0
je 0x1010370d
test ebx, ebx
je 0x1010370d
push ecx
mov ecx, ebx
call fcn.10022170
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1008548c
mov esp, ebp
pop ebp
ret 8