Function at 0x448d40
Capabilities:
Extract resource via kernel32 functions
Get file size
Read file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x45aa49
push eax
mov eax, dword [esp + 0x14]
mov dword fs:[0], esp
sub esp, 0x1b8
push ebx
xor ebx, ebx
push ebp
push esi
cmp eax, ebx
push edi
jne 0x448fd6
call fcn.00427970
push eax
lea ecx, [esp + 0x2c]
call fcn.004264a0
mov dword [esp + 0x1d0], ebx
call fcn.00427980
mov ecx, eax
call fcn.004266b0
or esi, 0xffffffff
test al, al
je 0x448e12
mov eax, dword [esp + 0x1d8]
lea ecx, [esp + 0x28]
push eax
call fcn.00426750
push ebx
push 0x80
push 3
push ebx
push 1
push closesocket
lea ecx, [esp + 0x40]
call fcn.00426420
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, esi
je 0x448f17
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
cmp ebp, ebx
je 0x448f17
push ebp
mov dword [esp + 0x1c], ebx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
lea ecx, [esp + 0x18]
mov ebx, eax
push 0
push ecx
push ebp
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x18]
jmp 0x448f06
call fcn.00427980
push eax
lea ecx, [esp + 0x2c]
call fcn.00426730
call fcn.00427990
test al, al
je 0x448e31
call fcn.004279a0
jmp 0x448e46
push 2
push ebx
lea ecx, [esp + 0x30]
call fcn.00426420
push eax
call fcn.004457e0
add esp, 0xc
mov edi, eax
cmp edi, ebx
jne 0x448e67
lea ecx, [esp + 0x28]
mov dword [esp + 0x1d0], 0xffffffff
call fcn.004264d0
xor eax, eax
jmp 0x44924d
mov ebp, dword [esp + 0x1d8]
lea edx, [esp + 0x9c]
lea eax, [esp + 0x1c]
push edx
push eax
push 1
push ebp
push edi
call fcn.00445850
add esp, 0x14
test eax, eax
je 0x448f2e
call fcn.00427970
push eax
lea ecx, [esp + 0x2c]
call fcn.004266f0
push ebp
lea ecx, [esp + 0x2c]
call fcn.00426750
push ebx
push 0x80
push 3
push ebx
push 1
push closesocket
lea ecx, [esp + 0x40]
call fcn.00426420
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, esi
je 0x448f17
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
cmp ebp, ebx
je 0x448f17
push ebp
mov dword [esp + 0x28], ebx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
lea ecx, [esp + 0x24]
mov ebx, eax
push 0
push ecx
push ebp
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x24]
cmp eax, ebp
je 0x448fc1
push ebx
call fcn.00459410
add esp, 4
lea ecx, [esp + 0x28]
mov dword [esp + 0x1d0], esi
call fcn.004264d0
xor eax, eax
jmp 0x44924d
mov ebp, dword [esp + 0x1c4]
cmp ebp, ebx
jne 0x448f54
lea ecx, [esp + 0x28]
mov dword [esp + 0x1d0], 0xffffffff
call fcn.004264d0
xor eax, eax
jmp 0x44924d
push ebp
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edx, dword [esp + 0x20]
mov ebx, eax
push 3
push ebp
push ebx
push edx
push edi
call fcn.004458a0
add esp, 0x18
test eax, eax
je 0x448faf
cmp eax, 0x600
je 0x448faf
push ebx
call fcn.00459410
add esp, 4
call fcn.00427990
test al, al
jne 0x448f94
push edi
call fcn.004458f0
add esp, 4
lea ecx, [esp + 0x28]
mov dword [esp + 0x1d0], 0xffffffff
call fcn.004264d0
xor eax, eax
jmp 0x44924d
call fcn.00427990
test al, al
jne 0x448fc1
push edi
call fcn.004458f0
add esp, 4
lea ecx, [esp + 0x28]
mov dword [esp + 0x1d0], esi
call fcn.004264d0
jmp 0x449067
push eax
mov eax, dword [esp + 0x1dc]
push eax
call fcn.00427960
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
cmp edi, ebx
mov dword [esp + 0x1c], edi
jne 0x448ffc
xor eax, eax
jmp 0x44924d
push edi
call fcn.00427960
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
push edi
cmp esi, ebx
jne 0x44901d
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
jmp 0x44924d
call fcn.00427960
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, eax
cmp ebp, ebx
jne 0x449036
xor eax, eax
jmp 0x44924d
push ebp
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, ebp
mov esi, eax
mov edx, ecx
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x1c]
mov ecx, edx
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FreeResource]
lea ecx, [esp + 0x6c]
push 4
lea edx, [esp + 0x18]
push ecx
lea eax, [esp + 0x28]
push edx
push eax
push ebp
push ebx
call fcn.004521c0
push ebx
mov ebp, eax
call fcn.00459410
xor esi, esi
add esp, 0x1c
cmp ebp, esi
jne 0x449097
xor eax, eax
jmp 0x44924d
mov ecx, 0xb
xor eax, eax
lea edi, [esp + 0x70]
push esi
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x78], eax
imul eax, ecx
shl eax, 2
mov dword [esp + 0x88], eax
lea eax, [esp + 0x14]
mov edx, ecx
push esi
push eax
lea ecx, [esp + 0x7c]
push esi
push ecx
neg edx
push esi
mov dword [esp + 0x88], 0x28
mov dword [esp + 0x90], edx
mov word [esp + 0x94], 1
mov word [esp + 0x96], 0x20
mov dword [esp + 0x98], esi
xor bl, bl
mov dword [esp + 0x28], esi
call dword [sym.imp.GDI32.dll_CreateDIBSection]
cmp eax, esi
mov dword [esp + 0x18], eax
jne 0x449117
xor eax, eax
jmp 0x44924d
mov edx, dword [esp + 0x20]
xor ecx, ecx
imul edx, dword [esp + 0x14]
test edx, edx
jle 0x449203
mov eax, dword [esp + 0x10]
lea esi, [ebp + 3]
mov dl, byte [esi]
mov byte [eax + ecx*4 + 3], dl
mov edi, dword [esp + 0x10]
cmp byte [edi + ecx*4 + 3], 0xff
jae 0x44919d
xor eax, eax
mov bl, 1
mov al, byte [esi - 1]
mov edx, eax
xor eax, eax
mov al, byte [esi]
imul edx, eax
mov eax, 0x80808081
mul edx
shr edx, 7
mov byte [edi + ecx*4], dl
xor edx, edx
mov dl, byte [esi - 2]
xor eax, eax
mov al, byte [esi]
imul edx, eax
mov eax, 0x80808081
mul edx
mov eax, dword [esp + 0x10]
shr edx, 7
mov byte [eax + ecx*4 + 1], dl
xor edx, edx
mov dl, byte [esi - 3]
xor eax, eax
mov al, byte [esi]
imul edx, eax
mov eax, 0x80808081
mul edx
mov eax, dword [esp + 0x10]
shr edx, 7
mov byte [eax + ecx*4 + 2], dl
jmp 0x4491b9
mov dl, byte [esi - 1]
mov byte [edi + ecx*4], dl
mov edx, dword [esp + 0x10]
mov al, byte [esi - 2]
mov byte [edx + ecx*4 + 1], al
mov edx, dword [esp + 0x10]
mov al, byte [esi - 3]
mov byte [edx + ecx*4 + 2], al
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x1e0]
cmp dword [eax + ecx*4], edx
jne 0x4491ee
mov byte [eax + ecx*4], 0
mov eax, dword [esp + 0x10]
mov bl, 1
mov byte [eax + ecx*4 + 1], 0
mov edx, dword [esp + 0x10]
mov byte [edx + ecx*4 + 2], 0
mov eax, dword [esp + 0x10]
mov byte [eax + ecx*4 + 3], 0
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x20]
inc ecx
imul edx, dword [esp + 0x14]
add esi, 4
cmp ecx, edx
jl 0x449131
push ebp
call fcn.004521b0
push 0x58
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
add esp, 8
mov dword [esp + 0x1c], edi
test edi, edi
mov dword [esp + 0x1d0], 1
je 0x449234
lea ecx, [edi + 0x10]
call fcn.00426460
mov eax, edi
jmp 0x449236
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword [eax], ecx
mov edx, dword [esp + 0x20]
mov dword [eax + 4], edx
mov ecx, dword [esp + 0x14]
mov dword [eax + 8], ecx
mov byte [eax + 0xc], bl
mov ecx, dword [esp + 0x1c8]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c4
ret