Function at 0x100ae9e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ff2e0
mov eax, dword fs:[0]
push eax
sub esp, 0x6fc
mov eax, dword [0x1013c014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push ecx
lea ecx, [ebp - 0x708]
call fcn.10026a20
push 0xc8
lea eax, [ebp - 0xd8]
push 0
push eax
call fcn.100d6eb0
mov eax, dword [ebp - 0x708]
add esp, 0xc
cmp dword [eax - 0xc], 0
je 0x100aea98
mov esi, eax
lea edx, [esi + 2]
mov cx, word [esi]
add esi, 2
test cx, cx
jne 0x100aea41
sub esi, edx
sar esi, 1
cmp esi, 0x62
jle 0x100aea5c
mov esi, 0x62
jmp 0x100aea60
test esi, esi
jle 0x100aea79
movzx ecx, word [eax + esi*2]
mov edx, 0xdc00
cmp cx, dx
jb 0x100aea79
mov edx, 0xdfff
cmp cx, dx
ja 0x100aea79
dec esi
add esi, esi
push esi
push eax
lea eax, [ebp - 0xd8]
push eax
call fcn.100d7080
add esp, 0xc
xor eax, eax
mov word [ebp + esi - 0xd8], ax
jmp 0x100aeac9
lea eax, [ebp - 0x700]
mov dword [ebp - 0x6f8], 0
push eax
lea eax, [ebp - 0xd8]
mov dword [ebp - 0x700], 0x64
push eax
lea eax, [ebp - 0x6f8]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetUserPreferredUILanguages]
push 0x104
lea eax, [ebp - 0x6f0]
push eax
push dword [0x1014be3c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x6f0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
xor ecx, ecx
lea edi, [ebp - 0x2e0]
push 0x1a0
mov esi, str._ALLUSERSPROFILE_360WallPaperOpenShellLanguages_
mov word [eax], cx
mov ecx, 0x1a
lea eax, [ebp - 0x278]
push 0
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.100d6eb0
add esp, 0xc
lea eax, [ebp - 0x2e0]
push 0x104
push eax
call dword [sym.imp.SHELL32.dll_DoEnvironmentSubstW]
mov esi, dword [0x1014be3c]
push 0x10
push 1
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
jne 0x100aeb4a
mov dword [ebp - 0x6fc], eax
jmp 0x100aeb86
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, eax
test ecx, ecx
jne 0x100aeb67
mov dword [ebp - 0x6fc], eax
jmp 0x100aeb86
movzx eax, word [ecx + 0x38]
movzx edx, al
movzx eax, word [ecx + 0x3a]
shl eax, 8
or edx, eax
movzx eax, word [ecx + 0x3e]
shl edx, 0x10
or edx, eax
mov dword [ebp - 0x6fc], edx
xor esi, esi
lea ebx, [ebp - 0xd8]
cmp word [ebp - 0xd8], si
je 0x100aed70
nop dword [eax + eax]
push 0x10122078
push ebx
call fcn.100dc721
add esp, 8
test eax, eax
je 0x100aed6e
push 3
push 0x10122080
push ebx
call fcn.100de265
add esp, 0xc
xor esi, esi
test eax, eax
je 0x100aed70
push ebx
lea eax, [ebp - 0x6f0]
mov dword [ebp - 0x700], esi
push eax
push str._s_s.dll
lea eax, [ebp - 0x4e8]
mov dword [ebp - 0x6f8], esi
push 0x104
push eax
xor edi, edi
call fcn.100a4830
add esp, 0x14
lea eax, [ebp - 0x4e8]
push 0x22
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 0x6f4], eax
test eax, eax
je 0x100aec87
push 0x10
push 1
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x100aec73
push eax
push dword [ebp - 0x6f4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x100aec73
movzx ecx, word [eax + 0x3c]
mov dword [ebp - 0x700], ecx
movzx ecx, word [eax + 0x38]
movzx esi, cl
movzx ecx, word [eax + 0x3a]
movzx eax, word [eax + 0x3e]
shl ecx, 8
or esi, ecx
shl esi, 0x10
or esi, eax
cmp esi, 0x3090005
jb 0x100aec73
cmp esi, dword [ebp - 0x6fc]
jbe 0x100aec87
push dword [ebp - 0x6f4]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x6f4], esi
push ebx
lea eax, [ebp - 0x2e0]
push eax
push str._s_s.dll
lea eax, [ebp - 0x4e8]
push 0x104
push eax
call fcn.100a4830
add esp, 0x14
lea eax, [ebp - 0x4e8]
push 0x22
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 0x704], eax
test eax, eax
je 0x100aed3d
push 0x10
push 1
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x100aed1d
push eax
push dword [ebp - 0x704]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x100aed1d
movzx ecx, word [eax + 0x38]
movzx edx, word [eax + 0x3c]
movzx edi, cl
movzx ecx, word [eax + 0x3a]
movzx eax, word [eax + 0x3e]
shl ecx, 8
or edi, ecx
mov dword [ebp - 0x6f8], edx
shl edi, 0x10
or edi, eax
cmp edi, 0x3090005
jb 0x100aed1d
cmp edi, dword [ebp - 0x6fc]
jbe 0x100aed35
push dword [ebp - 0x704]
xor edi, edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edx, dword [ebp - 0x6f8]
xor eax, eax
jmp 0x100aed3f
mov eax, dword [ebp - 0x704]
jmp 0x100aed3f
mov edx, edi
test esi, esi
jne 0x100aedb3
test edi, edi
jne 0x100aedc1
mov eax, ebx
lea edx, [eax + 2]
nop dword [eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100aed50
sub eax, edx
sar eax, 1
lea ebx, [ebx + eax*2]
add ebx, 2
cmp word [ebx], cx
jne 0x100aeba0
xor esi, esi
mov eax, dword [ebp - 0x708]
add eax, 0xfffffff0
mov dword [ebp - 4], 0
or ecx, 0xffffffff
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x100aed95
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100d4906
mov esp, ebp
pop ebp
ret
cmp esi, edi
ja 0x100aedd6
jne 0x100aedc1
cmp dword [ebp - 0x700], edx
ja 0x100aedd6
mov esi, eax
mov eax, dword [ebp - 0x6f4]
test eax, eax
je 0x100aed70
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x100aed70
mov esi, dword [ebp - 0x6f4]
test eax, eax
je 0x100aed70
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x100aed70