Function at 0x4f5820
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56d446
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1420
call fcn.00519090
mov eax, dword [0x5b7de4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edx, dword [ebp + 0xc]
xor esi, esi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x142c], edx
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x1420], eax
mov dword [ebp - 0x141c], edx
mov dword [ebp - 0x1430], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x1424], ecx
mov dword [ebp - 0x1428], esi
mov dword [ebp - 0x1418], esi
mov byte [ebp - 4], 1
test eax, eax
je 0x4f5c3b
mov ecx, eax
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4f58a0
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 1]
mov ecx, 2
imul ecx
mov ebx, eax
test edx, edx
jg 0x4f595d
jl 0x4f58d1
cmp ebx, 0x7fffffff
ja 0x4f595d
cmp edx, 0xffffffff
jl 0x4f595d
jg 0x4f58e4
cmp ebx, 0x80000000
jb 0x4f595d
cmp ebx, 0x400
jg 0x4f5907
push ebx
call fcn.0042d960
add esp, 4
test al, al
je 0x4f5907
mov eax, ebx
call fcn.00519740
mov dword [ebp - 0x10], esp
mov edi, esp
jmp 0x4f5935
mov eax, ebx
not eax
cmp eax, 8
jb 0x4f5c90
lea eax, [ebx + 8]
push eax
call fcn.00544ae6
add esp, 4
test eax, eax
je 0x4f595d
mov esi, eax
mov dword [eax], 0
mov dword [ebp - 0x1430], esi
lea edi, [eax + 8]
test edi, edi
je 0x4f595d
push 0
push 0
push ebx
push edi
push 0xffffffffffffffff
push dword [ebp - 0x1420]
mov byte [edi], 0
push 0
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor ecx, ecx
test eax, eax
cmove edi, ecx
jmp 0x4f595f
xor edi, edi
test edi, edi
je 0x4f5c3b
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
push 0x60
push 0
push edi
call ebx
mov dword [ebp - 0x1420], eax
test eax, eax
jne 0x4f599a
push 2
push eax
push edi
call ebx
mov dword [ebp - 0x1420], eax
test eax, eax
jne 0x4f599a
call fcn.004f4410
mov edi, eax
jmp 0x4f5b23
push dword [ebp - 0x141c]
push dword [ebp - 0x142c]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x4f59bf
call fcn.004f4410
mov edi, eax
jmp 0x4f5b12
push edi
push dword [ebp - 0x1420]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x142c], ebx
test ebx, ebx
jne 0x4f59e4
call fcn.004f4410
mov edi, eax
jmp 0x4f5b12
push edi
push dword [ebp - 0x1420]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x141c], edi
lea eax, [edi + 1]
cmp eax, edi
jae 0x4f5a0a
mov edi, 0x8007000e
jmp 0x4f5b12
mov byte [ebp - 4], 2
cmp eax, 0x400
jbe 0x4f5a3d
push eax
lea ecx, [ebp - 0x1418]
call fcn.004f4310
jmp 0x4f5a49
lea eax, [ebp - 0x1414]
mov dword [ebp - 0x1418], eax
cmp dword [ebp - 0x1418], 0
mov dword [ebp - 4], 1
jne 0x4f5a63
mov edi, 0x8007000e
jmp 0x4f5b12
push edi
push ebx
push edi
push dword [ebp - 0x1418]
call fcn.004f7e60
mov eax, dword [ebp - 0x1418]
lea ecx, [ebp - 0x1428]
add esp, 0x10
mov dword [ebp - 0x141c], 0
mov byte [eax + edi], 0
lea eax, [ebp - 0x141c]
push eax
push dword [ebp - 0x1418]
call fcn.004f5190
mov edi, eax
test edi, edi
js 0x4f5b12
mov ebx, dword [ebp - 0x141c]
mov dword [ebp - 0x1428], ebx
cmp byte [ebx], 0
je 0x4f5b0b
nop word [eax + eax]
lea eax, [ebp - 0x1014]
push eax
lea ecx, [ebp - 0x1428]
call fcn.004f4d20
mov edi, eax
test edi, edi
js 0x4f5b05
xor ebx, ebx
xor edi, edi
nop dword [eax]
push dword [edi + 0x57d580]
lea eax, [ebp - 0x1014]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x4f5b56
add edi, 8
inc ebx
cmp edi, 0x70
jb 0x4f5ae0
mov edi, 0x80020009
mov ebx, dword [ebp - 0x141c]
push ebx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, dword [ebp - 0x1420]
test eax, eax
je 0x4f5b23
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x1414]
cmp dword [ebp - 0x1418], eax
je 0x4f5b3c
lea ecx, [ebp - 0x1418]
call fcn.0041e380
test esi, esi
je 0x4f5b4f
push esi
mov esi, dword [esi]
call fcn.00544ae1
add esp, 4
test esi, esi
jne 0x4f5b40
mov eax, edi
jmp 0x4f5c6c
mov ebx, dword [ebx*8 + 0x57d584]
test ebx, ebx
je 0x4f5b00
lea eax, [ebp - 0x1014]
push eax
lea ecx, [ebp - 0x1428]
call fcn.004f4d20
mov edi, eax
test edi, edi
js 0x4f5b05
cmp byte [ebp - 0x1014], 0x7b
jne 0x4f5b00
mov ecx, dword [ebp + 0x14]
push 0
test ecx, ecx
je 0x4f5bdd
mov eax, dword [ebp - 0x1428]
push ecx
mov dword [ebp - 0x142c], eax
lea ecx, [ebp - 0x1428]
push ebx
lea eax, [ebp - 0x1014]
push eax
call fcn.004f5cc0
mov edi, eax
test edi, edi
jns 0x4f5bfc
mov eax, dword [ebp - 0x142c]
lea ecx, [ebp - 0x1428]
push 0
push 0
mov dword [ebp - 0x1428], eax
lea eax, [ebp - 0x1014]
push ebx
push eax
call fcn.004f5cc0
jmp 0x4f5b05
push 0
push ebx
lea eax, [ebp - 0x1014]
push eax
lea ecx, [ebp - 0x1428]
call fcn.004f5cc0
mov edi, eax
test edi, edi
js 0x4f5b05
mov edx, dword [ebp - 0x1428]
mov cl, byte [edx]
movsx eax, cl
add eax, 0xfffffff7
cmp eax, 0x17
ja case.0x4f5c16.11
movzx eax, byte [eax + 0x4f5ca4]
jmp dword [eax*4 + 0x4f5c9c]
push edx
call dword [sym.imp.USER32.dll_CharNextA]
mov edx, eax
mov dword [ebp - 0x1428], edx
jmp 0x4f5c02
test cl, cl
jne 0x4f5ac0
jmp 0x4f5b05
lea eax, [ebp - 0x1414]
cmp dword [ebp - 0x1418], eax
je 0x4f5c54
lea ecx, [ebp - 0x1418]
call fcn.0041e380
test esi, esi
je 0x4f5c67
push esi
mov esi, dword [esi]
call fcn.00544ae1
add esp, 4
test esi, esi
jne 0x4f5c58
mov eax, 0x8007000e
lea esp, [ebp - 0x1440]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005189ad
mov esp, ebp
pop ebp
ret 0x10
push 0x80070216
call fcn.00411a20
nop
sbb eax, 0x2e004f5c
pop esp
dec edi
add byte [eax], al
add byte [ecx], al
add dword [eax], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add ah, cl
int3