Function at 0x1000e606
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x154
mov eax, 0x101cab34
call fcn.10096fc6
mov dword [ebp - 0x128], ecx
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
push 0x3c8
xor edi, edi
push edi
push ebx
call fcn.10097040
add esp, 0xc
mov dword [ebp - 0x130], 1
mov dword [ebp - 0x120], edi
mov dword [ebp - 0x138], edi
mov dword [ebp - 4], edi
mov eax, dword [ebp - 0x128]
cmp dword [eax + 4], edi
je 0x1000e662
push 2
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x1000e6c3
mov byte [ebp - 0x118], 0
push 0x103
push edi
lea eax, [ebp - 0x117]
push eax
call fcn.10097040
push 0x104
lea eax, [ebp - 0x118]
push eax
push 0xffffffffffffffff
push esi
call fcn.1001c1d1
add esp, 0x1c
test eax, eax
jne 0x1000e6b3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x158], eax
push 0x10223794
lea eax, [ebp - 0x158]
push eax
call fcn.100991e7
push 2
push edi
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov dword [ebp - 0x120], eax
cmp eax, edi
jne 0x1000e6e6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x13c], eax
push 0x10223794
lea eax, [ebp - 0x13c]
jmp 0x1000e6ad
mov dword [ebp - 0x134], edi
lea eax, [ebp - 0x134]
push eax
push 0x1000dc52
push 1
push 0x10
push dword [ebp - 0x120]
call dword [sym.imp.KERNEL32.dll_EnumResourceLanguagesW]
push dword [ebp - 0x134]
push 1
push 0x10
push dword [ebp - 0x120]
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov esi, eax
cmp esi, edi
jne 0x1000e762
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x714
je 0x1000e74e
cmp eax, 0x715
je 0x1000e74e
mov dword [ebp - 0x144], eax
push 0x10223794
lea eax, [ebp - 0x144]
jmp 0x1000e6ad
push dword [ebp - 0x120]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
inc eax
jmp 0x1000eacc
push esi
push dword [ebp - 0x120]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x124], eax
push esi
push dword [ebp - 0x120]
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x1000e7a2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x154], eax
push 0x10223794
lea eax, [ebp - 0x154]
jmp 0x1000e6ad
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
cmp esi, edi
jne 0x1000e7cb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14c], eax
push 0x10223794
lea eax, [ebp - 0x14c]
jmp 0x1000e6ad
mov eax, dword [ebp - 0x124]
lea edi, [esi + eax]
mov dword [ebp - 0x11c], edi
push edi
mov eax, esi
call fcn.1000dcfe
test eax, eax
jne 0x1000e7fd
or dword [ebp - 0x15c], 0xffffffff
push 0x10223784
lea eax, [ebp - 0x15c]
jmp 0x1000e6ad
push edi
mov eax, esi
call fcn.1000dcc0
push 0xc
pop ecx
cmp cx, word [esi + 2]
ja 0x1000e813
mov ecx, dword [eax + 8]
mov dword [ebx], ecx
push 0x10
pop ecx
cmp cx, word [esi + 2]
ja 0x1000e822
mov eax, dword [eax + 0xc]
mov dword [ebx + 4], eax
push edi
call fcn.1000dce2
mov esi, eax
push edi
mov ecx, esi
call fcn.1000dd64
test eax, eax
jne 0x1000e84d
or dword [ebp - 0x140], 0xffffffff
push 0x10223784
lea eax, [ebp - 0x140]
jmp 0x1000e6ad
push 0x101e7448
mov eax, esi
call fcn.1000dd3e
push eax
call fcn.100977e9
pop ecx
pop ecx
test eax, eax
jne 0x1000ea98
push dword [ebp - 0x11c]
mov eax, esi
call fcn.1000dd42
mov edi, eax
push dword [ebp - 0x11c]
mov ecx, edi
call fcn.1000ddc8
test eax, eax
jne 0x1000e8a0
or dword [ebp - 0x148], 0xffffffff
push 0x10223784
lea eax, [ebp - 0x148]
jmp 0x1000e6ad
push dword [ebp - 0x11c]
mov eax, edi
call fcn.1000dda6
mov esi, eax
push dword [ebp - 0x11c]
mov ecx, esi
call fcn.1000de58
test eax, eax
jne 0x1000e8d7
or dword [ebp - 0x150], 0xffffffff
push 0x10223784
lea eax, [ebp - 0x150]
jmp 0x1000e6ad
movzx eax, word [edi]
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
jle 0x1000ea98
push dword [ebp - 0x11c]
mov ecx, esi
call fcn.1000de58
test eax, eax
je 0x1000ea98
push dword [ebp - 0x11c]
call fcn.1000de2c
movzx edi, ax
mov eax, esi
call fcn.1000de06
mov dword [ebp - 0x124], eax
push 0x101e7430
push eax
call fcn.100977e9
pop ecx
pop ecx
test eax, eax
jne 0x1000e954
test edi, edi
jbe 0x1000e954
cmp edi, 0x50
jb 0x1000e93a
push 0x4f
pop edi
push edi
push dword [ebp - 0x11c]
mov eax, esi
call fcn.1000de0a
push eax
lea eax, [ebx + 0x288]
jmp 0x1000ea72
push 0x101e7410
push dword [ebp - 0x124]
call fcn.100977e9
pop ecx
pop ecx
test eax, eax
jne 0x1000e98d
test edi, edi
jbe 0x1000e98d
cmp edi, 0x50
jb 0x1000e976
push 0x4f
pop edi
push edi
push dword [ebp - 0x11c]
mov eax, esi
call fcn.1000de0a
push eax
lea eax, [ebx + 8]
jmp 0x1000ea72
push 0x101e73f4
push dword [ebp - 0x124]
call fcn.100977e9
pop ecx
pop ecx
test eax, eax
jne 0x1000e9c9
test edi, edi
jbe 0x1000e9c9
cmp edi, 0x50
jb 0x1000e9af
push 0x4f
pop edi
push edi
push dword [ebp - 0x11c]
mov eax, esi
call fcn.1000de0a
push eax
lea eax, [ebx + 0x148]
jmp 0x1000ea72
push 0x101e73d4
push dword [ebp - 0x124]
call fcn.100977e9
pop ecx
pop ecx
test eax, eax
jne 0x1000ea02
test edi, edi
jbe 0x1000ea02
cmp edi, 0x50
jb 0x1000e9eb
push 0x4f
pop edi
push edi
push dword [ebp - 0x11c]
mov eax, esi
call fcn.1000de0a
push eax
lea eax, [ebx + 0x328]
jmp 0x1000ea72
push 0x101e73b0
push dword [ebp - 0x124]
call fcn.100977e9
pop ecx
pop ecx
test eax, eax
jne 0x1000ea3b
test edi, edi
jbe 0x1000ea3b
cmp edi, 0x50
jb 0x1000ea24
push 0x4f
pop edi
push edi
push dword [ebp - 0x11c]
mov eax, esi
call fcn.1000de0a
push eax
lea eax, [ebx + 0xa8]
jmp 0x1000ea72
push 0x101e7398
push dword [ebp - 0x124]
call fcn.100977e9
pop ecx
pop ecx
test eax, eax
jne 0x1000ea7b
test edi, edi
jbe 0x1000ea7b
cmp edi, 0x50
jb 0x1000ea5d
push 0x4f
pop edi
push edi
push dword [ebp - 0x11c]
mov eax, esi
call fcn.1000de0a
push eax
lea eax, [ebx + 0x1e8]
push eax
call fcn.100975dc
add esp, 0xc
movzx eax, word [esi]
add eax, 3
and eax, 0xfffffffc
sub dword [ebp - 0x12c], eax
mov eax, esi
call fcn.1000de4d
mov esi, eax
jmp 0x1000e8e0
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x138], 0
je 0x1000eab1
push dword [ebp - 0x138]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [ebp - 0x120], 0
je 0x1000eac6
push dword [ebp - 0x120]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x130]
call fcn.10097022
ret 8