Function at 0x409eb5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x4163c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x40c], ecx
mov ecx, dword [ebp + 0x10]
push ebx
xor ebx, ebx
mov dword [ebp - 0x418], ecx
mov ecx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x410], ebx
mov dword [ebp - 0x420], ecx
mov dword [ebp - 0x424], ebx
mov dword [ebp - 0x408], ebx
cmp eax, ebx
je 0x409f96
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
inc edi
push ebx
mov eax, edi
cdq
push 2
push edx
push eax
mov dword [ebp - 0x414], edi
call fcn.004126d0
cmp edx, ebx
jg 0x409f49
jl 0x409f34
cmp eax, 0x7fffffff
ja 0x409f49
push edx
push eax
lea ecx, [ebp - 0x414]
call fcn.00408cb7
mov edi, dword [ebp - 0x414]
jmp 0x409f4e
mov eax, 0x80070057
cmp eax, ebx
jl 0x409f96
cmp edi, 0x400
jg 0x409f6f
push edi
call fcn.00408d1c
test al, al
je 0x409f6f
mov eax, edi
call fcn.00412b80
mov eax, esp
jmp 0x409f82
mov eax, edi
lea esi, [ebp - 0x410]
call fcn.00408d8f
mov ebx, dword [ebp - 0x410]
push 3
push edi
push dword [ebp - 0x41c]
mov esi, eax
call fcn.0040871b
test eax, eax
jne 0x409fca
lea eax, [ebp - 0x404]
cmp dword [ebp - 0x408], eax
je 0x409fbc
lea eax, [ebp - 0x408]
call fcn.00408dc1
jmp 0x409fbc
mov eax, ebx
mov ebx, dword [ebx]
push eax
call fcn.0040bca5
pop ecx
test ebx, ebx
jne 0x409fb1
mov eax, 0x8007000e
jmp 0x40a0fd
push 2
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov edi, eax
test edi, edi
jne 0x409fe7
call fcn.0040868a
mov esi, eax
jmp 0x40a0d1
push dword [ebp - 0x418]
push dword [ebp - 0x40c]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x40a00a
call fcn.0040868a
jmp 0x40a0c8
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x40c], eax
test eax, eax
je 0x40a000
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
cmp eax, esi
jae 0x40a05c
lea eax, [ebp - 0x404]
cmp dword [ebp - 0x408], eax
je 0x40a053
lea eax, [ebp - 0x408]
call fcn.00408dc1
jmp 0x40a053
mov eax, ebx
mov ebx, dword [ebx]
push eax
call fcn.0040bca5
pop ecx
test ebx, ebx
jne 0x40a048
jmp 0x409fc0
push eax
call fcn.00408dcf
cmp eax, 0x400
jbe 0x40a078
push eax
lea eax, [ebp - 0x408]
push eax
call fcn.00408c44
jmp 0x40a084
lea eax, [ebp - 0x404]
mov dword [ebp - 0x408], eax
cmp dword [ebp - 0x408], 0
jne 0x40a094
mov esi, 0x8007000e
jmp 0x40a0ca
push esi
push dword [ebp - 0x40c]
push esi
push dword [ebp - 0x408]
call fcn.0040884d
mov eax, dword [ebp - 0x408]
add esp, 0x10
push dword [ebp + 0x14]
mov byte [eax + esi], 0
mov ecx, dword [ebp - 0x408]
lea edx, [ebp - 0x424]
call fcn.00409d78
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x404]
cmp dword [ebp - 0x408], eax
je 0x40a0f7
lea eax, [ebp - 0x408]
call fcn.00408dc1
jmp 0x40a0f7
mov eax, ebx
mov ebx, dword [ebx]
push eax
call fcn.0040bca5
pop ecx
test ebx, ebx
jne 0x40a0ec
mov eax, esi
lea esp, [ebp - 0x430]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040bb7c
leave
ret 0x10