Function at 0x41b02ce1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov edx, dword [ebp + 0x10]
test edx, 0xff80df20
jne 0x41b0fe79
mov ecx, dword [ebp + 8]
mov eax, edx
and eax, 4
push esi
jne 0x41b02d14
mov esi, ecx
shr esi, 0x10
test si, si
je 0x41b02d14
test ecx, ecx
je 0x41b0fe80
push ebx
push edi
mov edi, 0x41b027ac
mov ebx, 0x41b28b68
test eax, eax
jne 0x41b09a18
mov eax, ecx
shr eax, 0x10
test ax, ax
je 0x41b09a7f
mov esi, dword [0x41b28b68]
cmp esi, ebx
je 0x41b02d65
test dword [esi + 0x1c], 0x400000
je 0x41b02d65
cmp byte [esi + 0x19], 4
jb 0x41b02d65
push edx
push ecx
push edi
push 0xd
push dword [esi + 0x14]
push dword [esi + 0x10]
call fcn.41b02acc
mov esi, dword [0x41b28b68]
test byte [ebp + 0x10], 0x10
jne 0x41b0aa10
xor eax, eax
test byte [ebp + 0x10], 1
mov word [0x41b28508], ax
je 0x41b02d90
call fcn.41b02f70
test eax, eax
je 0x41b0feb6
mov esi, dword [0x41b28b68]
cmp dword [ebp + 8], 0
je 0x41b0feec
test byte [ebp + 0x10], 4
jne 0x41b09a52
cmp dword [ebp + 8], 0
je 0x41b09a52
push 0x200
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
mov dword [ebp - 4], esi
test esi, esi
je 0x41b0aa3e
or dword [ebp + 0x10], 0x80000000
mov eax, dword [0x41b28b68]
cmp eax, ebx
je 0x41b02dfb
test dword [eax + 0x1c], 0x400000
je 0x41b02dfb
cmp byte [eax + 0x19], 4
jb 0x41b02dfb
push esi
push edi
push 0x12
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.41b0298a
mov eax, dword [0x41b28b68]
mov edx, dword [ebp + 0x10]
mov ecx, 0x110000
and edx, ecx
cmp edx, ecx
je 0x41b0ff30
mov esi, dword [ebp + 8]
cmp word [esi], 0
je 0x41b0ff9c
test dword [ebp + 0x10], 0x10000
je 0x41b02e33
push esi
push 0x208
push 0x41b28508
call fcn.41b029b6
lea eax, [ebp + 0x10]
push eax
push 0x200
push dword [ebp - 4]
push esi
call fcn.41b02fa6
test eax, eax
je 0x41b0ffc5
mov eax, dword [ebp - 4]
push eax
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, dword [0x41b28b68]
cmp esi, ebx
je 0x41b02e8e
test dword [esi + 0x1c], 0x400000
je 0x41b02e8e
cmp byte [esi + 0x19], 4
jb 0x41b02e8e
push eax
push dword [ebp - 4]
push dword [ebp - 4]
push edi
push 0x16
push dword [esi + 0x14]
push dword [esi + 0x10]
call fcn.41b03120
mov esi, dword [0x41b28b68]
cmp dword [ebp - 4], 0
je 0x41b02e9b
or dword [ebp + 0x10], 0x80000000
test byte [ebp + 0x10], 1
je 0x41b099bb
cmp esi, ebx
je 0x41b02ecf
test dword [esi + 0x1c], 0x400000
je 0x41b02ecf
cmp byte [esi + 0x19], 4
jb 0x41b02ecf
push dword [ebp + 0x10]
push dword [ebp + 8]
push dword [ebp + 8]
push edi
push 0x1a
push dword [esi + 0x14]
push dword [esi + 0x10]
call fcn.41b03120
push dword [ebp + 8]
push dword [ebp + 0x10]
push 0x3cc
push dword [0x41b282b0]
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop ebx
pop esi
leave
ret 0xc
mov eax, dword [0x41b282b0]
test eax, eax
jne 0x41b10156
cmp esi, ebx
je 0x41b099ef
test dword [esi + 0x1c], 0x400000
je 0x41b099ef
cmp byte [esi + 0x19], 4
jb 0x41b099ef
push dword [ebp + 0x10]
push dword [ebp + 8]
push edi
push 0x19
push dword [esi + 0x14]
push dword [esi + 0x10]
call fcn.41b03951
push dword [ebp + 0x10]
push 0x200
push dword [ebp + 8]
call fcn.41b02bd6
jmp 0x41b02ee6
mov esi, dword [0x41b28b68]
cmp esi, ebx
je 0x41b02d65
test dword [esi + 0x1c], 0x400000
je 0x41b02d65
cmp byte [esi + 0x19], 4
jb 0x41b02d65
push edx
push ecx
push edi
push 0xc
push dword [esi + 0x14]
push dword [esi + 0x10]
call fcn.41b03951
jmp 0x41b02d5f
mov ecx, dword [ebp + 0x10]
and dword [ebp - 8], 0
and dword [ebp - 4], 0
mov eax, 0x40004
and ecx, eax
cmp ecx, eax
je 0x41b0fff2
mov eax, dword [ebp + 0x10]
and eax, 1
cmp al, 1
jne 0x41b02e9b
jmp 0x41b10062
test ecx, ecx
jne 0x41b0fe87
jmp 0x41b02d5f
cmp dword [0x41b28b38], 0
je 0x41b02d6f
cmp esi, ebx
je 0x41b0aa3e
test dword [esi + 0x1c], 0x400000
je 0x41b0aa3e
cmp byte [esi + 0x19], 1
jb 0x41b0aa3e
push edi
push 0xf
push dword [esi + 0x14]
push dword [esi + 0x10]
call fcn.41b02941
xor eax, eax
jmp 0x41b02ee6
xor eax, eax
jmp 0x41b02ee9
xor eax, eax
jmp 0x41b02ee8
mov esi, dword [0x41b28b68]
cmp esi, ebx
je 0x41b02d65
test dword [esi + 0x1c], 0x400000
je 0x41b02d65
cmp byte [esi + 0x19], 4
jb 0x41b02d65
push edx
push ecx
push edi
push 0xe
jmp 0x41b09a42
mov esi, dword [0x41b28b68]
cmp esi, ebx
je 0x41b0fee3
test dword [esi + 0x1c], 0x400000
je 0x41b0fee3
cmp byte [esi + 0x19], 4
jb 0x41b0fee3
push edi
push 0x10
push dword [esi + 0x14]
push dword [esi + 0x10]
call fcn.41b02941
mov esi, dword [0x41b28b68]
and dword [ebp + 0x10], 0xfffffffe
jmp 0x41b02d90
test byte [ebp + 0x10], 1
je 0x41b02d9a
test byte [ebp + 0x10], 4
je 0x41b02da4
cmp esi, ebx
je 0x41b0ff27
test dword [esi + 0x1c], 0x400000
je 0x41b0ff27
cmp byte [esi + 0x19], 4
jb 0x41b0ff27
push edi
push 0x11
push dword [esi + 0x14]
push dword [esi + 0x10]
call fcn.41b02941
mov esi, dword [0x41b28b68]
and dword [ebp + 0x10], 0xfffffffe
jmp 0x41b02d9a
push 0x100
push esi
push dword [ebp + 8]
call fcn.41b23403
push eax
push dword [0x41b28b64]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x41b0ff88
mov eax, dword [0x41b28b68]
cmp eax, ebx
je 0x41b0ff76
test dword [eax + 0x1c], 0x400000
je 0x41b0ff76
cmp byte [eax + 0x19], 3
jb 0x41b0ff76
push esi
push edi
push 0x13
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.41b0298a
xor esi, esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
jmp 0x41b02ee6
mov esi, dword [ebp - 4]
and dword [ebp + 0x10], 0xffefffff
mov eax, dword [0x41b28b68]
jmp 0x41b02e10
cmp eax, ebx
je 0x41b0ffc0
test dword [eax + 0x1c], 0x400000
je 0x41b0ffc0
cmp byte [eax + 0x19], 3
jb 0x41b0ffc0
push dword [ebp - 4]
push edi
push 0x14
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.41b0298a
xor esi, esi
inc esi
jmp 0x41b0ff78
test byte [ebp + 0x10], 2
je 0x41b02e4d
mov eax, dword [0x41b28b68]
cmp eax, ebx
je 0x41b0ff76
test dword [eax + 0x1c], 0x400000
je 0x41b0ff76
cmp byte [eax + 0x19], 3
jb 0x41b0ff76
push dword [ebp - 4]
push edi
push 0x15
jmp 0x41b0ff6b
mov ebx, dword [ebp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_FindResourceW]
push 0x41b10180
push dword [ebp + 8]
push ebx
call esi
mov edi, eax
test edi, edi
jne 0x41b10021
push 0x41b10174
push dword [ebp + 8]
push ebx
call esi
mov edi, eax
test edi, edi
je 0x41b100ff
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x41b100cf
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push ebx
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
and dword [ebp + 0x10], 0xfffbffff
mov esi, dword [0x41b28b68]
mov dword [ebp - 8], eax
mov ebx, 0x41b28b68
mov edi, 0x41b027ac
jmp 0x41b09a6c
mov eax, dword [ebp + 0x10]
and eax, 4
cmp al, 4
jne 0x41b100a1
mov eax, dword [ebp + 8]
cmp dword [eax], 0x46464952
jne 0x41b0aa3e
cmp dword [eax + 8], 0x45564157
jne 0x41b0aa3e
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push dword [eax + 4]
push 8
call fcn.41b0a91e
test eax, eax
jl 0x41b0aa3e
cmp dword [ebp - 8], 0
je 0x41b02e9b
cmp dword [ebp - 8], 0x200000
jae 0x41b02e9b
push dword [ebp - 8]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x41b0aa3e
jmp 0x41b10138
mov eax, dword [0x41b28b68]
cmp eax, 0x41b28b68
je 0x41b0aa3e
test dword [eax + 0x1c], 0x400000
je 0x41b0aa3e
cmp byte [eax + 0x19], 1
jb 0x41b0aa3e
push 0x41b027ac
push 0x17
jmp 0x41b1012d
mov eax, dword [0x41b28b68]
cmp eax, 0x41b28b68
je 0x41b0aa3e
test dword [eax + 0x1c], 0x400000
je 0x41b0aa3e
cmp byte [eax + 0x19], 1
jb 0x41b0aa3e
push 0x41b027ac
push 0x18
push dword [eax + 0x14]
push dword [eax + 0x10]
jmp 0x41b0aa39
push dword [ebp - 8]
push dword [ebp + 8]
push esi
call sub.ntdll.dll_memcpy
add esp, 0xc
or dword [ebp + 0x10], 0x40000000
mov dword [ebp + 8], esi
jmp 0x41b02e88
push 0
push 0
push 0x3cd
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov esi, dword [0x41b28b68]
jmp 0x41b099c8