Function at 0x44d5c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6b97d6
mov eax, dword fs:[0]
push eax
sub esp, 0x40c
mov eax, dword [0x76a02c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 1
lea ecx, [ebp - 0x16c]
mov byte [ebp - 0x3f8], 1
call fcn.0051c200
mov dword [ebp - 0x16c], 0x74939c
mov dword [ebp - 4], 0
mov dword [ebp - method.CParseRuleTime.virtual_0], vtable.CParseRuleTime.0
push 0xa
lea ecx, [ebp - 0x16c]
mov byte [ebp - 4], 1
call fcn.0051d5f0
push 0
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x16c]
push eax
call fcn.0041f2c0
mov ecx, eax
call fcn.0051d950
call fcn.00431fb0
sub esp, 0x18
mov edi, eax
mov esi, esp
xor eax, eax
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x3fc], esp
push 1
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push 0x7477c0
mov word [ecx], ax
call fcn.00402440
sub esp, 0x18
mov byte [ebp - 4], 2
mov ecx, esp
mov dword [ebp - 0x404], esp
xor eax, eax
push 0xc
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str.vPIOWTeRMduY
mov word [ecx], ax
call fcn.00402440
sub esp, 0x18
mov byte [ebp - 4], 3
mov eax, esp
mov dword [ebp - 0x408], esp
mov ecx, edi
push eax
mov eax, dword [edi]
call dword [eax + 4]
sub esp, 0x18
mov byte [ebp - 4], 4
mov eax, dword [edi]
mov ecx, edi
push esp
call dword [eax]
push esi
lea ecx, [edi + 4]
mov byte [ebp - 4], 1
call fcn.004386b0
call fcn.0050baed
mov ebx, dword [ebp - 0x410]
add esp, 0x18
mov edi, dword [ebp - 0x40c]
cmp eax, ebx
jne 0x44d700
cmp edx, edi
je 0x44d780
call fcn.00431fb0
sub esp, 0x18
mov esi, eax
mov ecx, esp
mov dword [ebp - 0x400], esp
push edi
push ebx
push ecx
call fcn.0050b964
sub esp, 0xc
mov byte [ebp - 4], 5
mov ecx, esp
mov dword [ebp - 0x408], esp
xor eax, eax
push 0xc
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str.vPIOWTeRMduY
mov word [ecx], ax
call fcn.00402440
sub esp, 0x18
mov byte [ebp - 4], 6
mov eax, esp
mov dword [ebp - 0x404], esp
mov ecx, esi
push eax
mov eax, dword [esi]
call dword [eax + 4]
sub esp, 0x18
mov byte [ebp - 4], 7
mov eax, dword [esi]
mov ecx, esi
push esp
call dword [eax]
lea ecx, [esi + 4]
mov byte [ebp - 4], 1
call fcn.004388a0
mov byte [ebp - 0x3f8], 0
push 1
lea ecx, [ebp - 0xe4]
call fcn.0051c200
mov dword [ebp - 0xe4], 0x749360
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x2c], vtable.CParseRuleData.0
push dword [ebp - 0x3f8]
lea ecx, [ebp - 0xe4]
mov byte [ebp - 4], 9
call fcn.0051d610
push 0xa8c0
lea ecx, [ebp - 0xe4]
call fcn.0051d5d0
push 0xa
lea ecx, [ebp - 0xe4]
call fcn.0051d5f0
push 0
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0xe4]
push eax
call fcn.0041f2c0
mov ecx, eax
call fcn.0051d950
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x2d4]
push ecx
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push 0
push eax
call fcn.00464270
mov esi, eax
add esp, 0xc
mov dword [ebp - 0x3f8], esi
test esi, esi
je 0x44d82d
cmp dword [esi], 0
je 0x44da3a
call fcn.0050e897
test al, al
je 0x44d892
mov eax, dword [0x77ce78]
test eax, eax
je 0x44d892
cmp dword [eax + 4], 4
jl 0x44d892
sub esp, 0xc
push 0x169
push str.CPopBlcokApp::GetSvrRule
push ecx
lea ecx, [ebp - 0x3f4]
call fcn.00422090
mov esi, eax
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 0xa
mov edx, 0x7498b8
call fcn.0041fea0
mov ecx, dword [0x77ce78]
push esi
call fcn.00422240
lea ecx, [ebp - 0x3f4]
mov byte [ebp - 4], 9
call fcn.00420630
mov esi, dword [ebp - 0x3f8]
push 0xa
push 0x88
call fcn.0041f370
mov ecx, eax
call fcn.00406270
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x44d8b9
xor esi, esi
jmp 0x44dc29
push edi
call fcn.0041f370
mov ecx, eax
call fcn.00406270
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x44da3a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
mov dword [ebp - 0x3fc], eax
call fcn.0041f370
mov ecx, eax
call fcn.00406270
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp dword [ebp - 0x3fc], 0
mov ebx, eax
je 0x44da3a
test ebx, ebx
je 0x44da3a
push 0xd
push str.WinAdMasterBB
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0xf
mov byte [ebp - 0x44], 0
call fcn.00410120
lea ecx, [ebp - 0x1d8]
mov byte [ebp - 4], 0xb
call fcn.0050c4e0
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x1d8]
call fcn.0050ce5c
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x1d8]
call fcn.0050c6cc
lea esi, [ebx + 1]
mov byte [ebp - 4], 0xc
push esi
call fcn.0053441a
push esi
mov edi, eax
push 0
push edi
call fcn.00530310
cmp dword [ebp - 0x48], 0x10
lea ecx, [ebp - 0x5c]
cmovae ecx, dword [ebp - 0x5c]
push ecx
push ebx
push edi
push dword [ebp - 0x3fc]
call fcn.005178da
lea eax, [ebp - 0x2d4]
push eax
push 0
push edi
call fcn.00464270
mov byte [ebp - 4], 0xb
add esp, 0x2c
mov edx, dword [ebp - 0x48]
mov esi, eax
mov dword [ebp - 0x3f8], esi
cmp edx, 0x10
jb 0x44d9de
mov ecx, dword [ebp - 0x5c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x44d9d4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44dcb0
push edx
push ecx
call fcn.00468d54
add esp, 8
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0xf
mov byte [ebp - 0x5c], 0
cmp edx, 0x10
jb 0x44da28
mov ecx, dword [ebp - 0x44]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x44da1e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44dcb5
push edx
push ecx
call fcn.00468d54
add esp, 8
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0xf
mov byte [ebp - 0x44], 0
push str.runv2
push esi
call fcn.00466de0
add esp, 8
mov dword [ebp - 0x3fc], eax
test eax, eax
je 0x44dc29
cmp dword [eax], 0
jne 0x44dc29
push str.login
push eax
call fcn.00466de0
mov esi, eax
add esp, 8
test esi, esi
je 0x44db42
cmp dword [esi], 0
jne 0x44db42
push 0x7498fc
push esi
call fcn.00466de0
add esp, 8
test eax, eax
je 0x44daac
push 0x7498fc
push esi
call fcn.00466de0
add esp, 8
cmp dword [eax], 5
jne 0x44daac
mov eax, 1
jmp 0x44daae
xor eax, eax
push 0x749900
push str.exclude
push esi
mov dword [0x781328], eax
call fcn.00466de0
add esp, 8
push eax
call fcn.00466de0
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x44db42
cmp dword [ebx], 1
jne 0x44db42
push ebx
xor edi, edi
call fcn.00466b50
add esp, 4
test eax, eax
je 0x44db42
nop dword [eax]
push edi
push ebx
call fcn.00466aa0
add esp, 8
test eax, eax
je 0x44db42
push eax
call fcn.00466d10
sub esp, 0x14
mov esi, eax
push esp
call fcn.00431fb0
mov ecx, eax
call fcn.005113ed
call fcn.0050bb30
add esp, 0x18
cmp esi, eax
je 0x44db32
push ebx
inc edi
call fcn.00466b50
add esp, 4
cmp edi, eax
jb 0x44daf0
jmp 0x44db42
xor eax, eax
cmp dword [0x781328], eax
sete al
mov dword [0x781328], eax
push 0x74990c
push dword [ebp - 0x3fc]
call fcn.00466de0
mov esi, eax
add esp, 8
test esi, esi
je 0x44dc23
cmp dword [esi], 0
jne 0x44dc23
push 0x7498fc
push esi
call fcn.00466de0
add esp, 8
test eax, eax
je 0x44db94
push 0x7498fc
push esi
call fcn.00466de0
add esp, 8
cmp dword [eax], 5
jne 0x44db94
mov eax, 1
jmp 0x44db96
xor eax, eax
push 0x749900
push str.exclude
push esi
mov dword [0x78132c], eax
call fcn.00466de0
add esp, 8
push eax
call fcn.00466de0
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x44dc23
cmp dword [ebx], 1
jne 0x44dc23
push ebx
xor edi, edi
call fcn.00466b50
add esp, 4
test eax, eax
je 0x44dc23
push edi
push ebx
call fcn.00466aa0
add esp, 8
test eax, eax
je 0x44dc23
push eax
call fcn.00466d10
sub esp, 0x14
mov esi, eax
push esp
call fcn.00431fb0
mov ecx, eax
call fcn.005113ed
call fcn.0050bb30
add esp, 0x18
cmp esi, eax
je 0x44dc13
push ebx
inc edi
call fcn.00466b50
add esp, 4
cmp edi, eax
jb 0x44dbd1
jmp 0x44dc23
xor eax, eax
cmp dword [0x78132c], eax
sete al
mov dword [0x78132c], eax
mov esi, dword [ebp - 0x3f8]
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x2c], vtable.CParseRuleData.0
cmp edx, 0x10
jb 0x44dc60
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x44dc56
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44dcba
push edx
push ecx
call fcn.00468d54
add esp, 8
lea ecx, [ebp - 0xe4]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.0051c330
lea ecx, [ebp - 0x16c]
mov dword [ebp - method.CParseRuleTime.virtual_0], vtable.CParseRuleTime.0
call fcn.0051c330
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00468d3e
mov esp, ebp
pop ebp
ret
call fcn.00533dd1
call fcn.00533dd1
call fcn.00533dd1
int3