Function at 0x4b5f80
Capabilities:
Extract resource via kernel32 functions
Get file size
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4d99ab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x200
mov eax, dword [0x50ba00]
push ebx
push ebp
push esi
mov dword [esp + 0x208], eax
mov eax, dword [esp + 0x220]
xor esi, esi
cmp eax, esi
push edi
jne 0x4b6168
call fcn.004987a0
lea ecx, [esp + 0x5c]
mov dword [esp + 0x58], ecx
mov dword [esp + 0xdc], esi
mov word [esp + 0x5c], si
mov edx, dword [eax]
push 0xffffffffffffffff
push edx
lea ecx, [esp + 0x60]
call fcn.00401550
mov dword [esp + 0x218], esi
call fcn.004987b0
mov eax, dword [eax]
cmp word [eax], si
jne 0x4b608b
mov ecx, dword [esp + 0x220]
push ecx
lea ecx, [esp + 0x5c]
call fcn.00407660
mov edx, dword [esp + 0x58]
push esi
push 0x80
push 3
push esi
push 1
push Ordinal_2
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4b611a
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
cmp ebp, esi
jne 0x4b604e
mov eax, dword [esp + 0x58]
lea edx, [esp + 0x5c]
cmp eax, edx
jmp 0x4b6124
push ebp
mov dword [esp + 0x18], esi
call fcn.004cabbc
add esp, 4
push esi
mov ebx, eax
lea eax, [esp + 0x18]
push eax
push ebp
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x14], ebp
je 0x4b613f
push ebx
call fcn.004cabc1
add esp, 4
jmp 0x4b611a
call fcn.004987b0
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x5c]
call fcn.00407660
mov edx, dword [esp + 0x58]
push 2
push esi
push edx
call fcn.004c1260
mov edx, dword [esp + 0x22c]
mov edi, eax
lea eax, [esp + 0xec]
push eax
lea ecx, [esp + 0x30]
push ecx
push 1
push edx
push edi
call fcn.004bf1a0
add esp, 0x20
test eax, eax
jne 0x4b611a
mov ebp, dword [esp + 0x208]
cmp ebp, esi
jne 0x4b60e6
mov eax, dword [esp + 0x58]
lea edx, [esp + 0x5c]
cmp eax, edx
jmp 0x4b6124
push ebp
call fcn.004cabbc
push 3
mov ebx, eax
mov eax, dword [esp + 0x28]
push ebp
push ebx
push eax
push edi
call fcn.004c12d0
add esp, 0x18
cmp eax, esi
je 0x4b6136
cmp eax, 0x600
je 0x4b6136
push ebx
call fcn.004cabc1
push edi
call fcn.004c1320
add esp, 8
mov eax, dword [esp + 0x58]
lea ecx, [esp + 0x5c]
cmp eax, ecx
je 0x4b612f
push eax
call fcn.00482838
add esp, 4
xor eax, eax
jmp 0x4b63c6
push edi
call fcn.004c1320
add esp, 4
mov eax, dword [esp + 0x58]
lea edx, [esp + 0x5c]
cmp eax, edx
mov dword [esp + 0x218], 0xffffffff
je 0x4b61f3
push eax
call fcn.00482838
add esp, 4
jmp 0x4b61f3
push eax
mov eax, dword [esp + 0x224]
push eax
call fcn.00498790
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
cmp edi, esi
mov dword [esp + 0x14], edi
je 0x4b61a3
push edi
call fcn.00498790
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, esi
mov dword [esp + 0x20], eax
push edi
jne 0x4b61aa
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
jmp 0x4b63c6
call fcn.00498790
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, eax
cmp ebp, esi
je 0x4b61a3
push ebp
call fcn.004cabbc
mov ecx, dword [esp + 0x24]
add esp, 4
push ecx
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, ebp
mov edx, ecx
shr ecx, 2
mov esi, eax
mov eax, dword [esp + 0x14]
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor esi, esi
push 4
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x24]
push eax
push ebp
push ebx
call fcn.004c87c0
mov edi, eax
push ebx
mov dword [esp + 0x30], edi
call fcn.004cabc1
add esp, 0x1c
xor eax, eax
cmp edi, esi
je 0x4b63c6
mov ecx, 0xb
lea edi, [esp + 0x2c]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x30], eax
imul eax, ecx
push esi
shl eax, 2
push esi
mov dword [esp + 0x48], eax
lea eax, [esp + 0x18]
push eax
mov edx, ecx
push esi
lea ecx, [esp + 0x3c]
push ecx
neg edx
push esi
mov dword [esp + 0x44], 0x28
mov dword [esp + 0x4c], edx
mov word [esp + 0x50], 1
mov word [esp + 0x52], 0x20
mov dword [esp + 0x54], esi
xor ebp, ebp
mov dword [esp + 0x28], esi
call dword [sym.imp.GDI32.dll_CreateDIBSection]
mov edi, eax
cmp edi, esi
mov dword [esp + 0x24], edi
je 0x4b61a3
mov edx, dword [esp + 0x18]
imul edx, dword [esp + 0x1c]
xor ecx, ecx
test edx, edx
jle 0x4b6385
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
add esi, 3
mov bl, 0xff
nop
mov dl, byte [esi]
mov byte [eax + ecx*4 + 3], dl
mov edi, dword [esp + 0x10]
cmp byte [edi + ecx*4 + 3], bl
jae 0x4b6316
movzx eax, byte [esi]
movzx edx, byte [esi - 1]
imul edx, eax
mov eax, 0x80808081
mul edx
shr edx, 7
mov byte [edi + ecx*4], dl
movzx eax, byte [esi]
movzx edx, byte [esi - 2]
imul edx, eax
mov eax, 0x80808081
mul edx
mov eax, dword [esp + 0x10]
shr edx, 7
mov byte [eax + ecx*4 + 1], dl
movzx eax, byte [esi]
movzx edx, byte [esi - 3]
imul edx, eax
mov eax, 0x80808081
mul edx
mov eax, dword [esp + 0x10]
shr edx, 7
mov byte [eax + ecx*4 + 2], dl
mov ebp, 1
jmp 0x4b6332
mov dl, byte [esi - 1]
mov byte [edi + ecx*4], dl
mov al, byte [esi - 2]
mov edx, dword [esp + 0x10]
mov byte [edx + ecx*4 + 1], al
mov al, byte [esi - 3]
mov edx, dword [esp + 0x10]
mov byte [edx + ecx*4 + 2], al
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x228]
cmp dword [eax + ecx*4], edx
jne 0x4b636a
mov byte [eax + ecx*4], 0
mov eax, dword [esp + 0x10]
mov byte [eax + ecx*4 + 1], 0
mov edx, dword [esp + 0x10]
mov byte [edx + ecx*4 + 2], 0
mov eax, dword [esp + 0x10]
mov byte [eax + ecx*4 + 3], 0
mov eax, dword [esp + 0x10]
mov ebp, 1
mov edx, dword [esp + 0x18]
imul edx, dword [esp + 0x1c]
inc ecx
add esi, 4
cmp ecx, edx
jl 0x4b62b0
mov edi, dword [esp + 0x24]
xor esi, esi
mov eax, dword [esp + 0x14]
push eax
call fcn.004c13a0
push 0x9c
call fcn.004cab91
add esp, 8
cmp eax, esi
je 0x4b63b1
lea ecx, [eax + 0x14]
mov dword [eax + 0x10], ecx
mov dword [eax + 0x94], esi
mov word [ecx], si
jmp 0x4b63b3
xor eax, eax
mov dword [eax], edi
mov ecx, dword [esp + 0x18]
mov dword [eax + 4], ecx
mov edx, dword [esp + 0x1c]
mov dword [eax + 8], edx
mov dword [eax + 0xc], ebp
mov ecx, dword [esp + 0x210]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x200]
pop ebx
call fcn.00482423
add esp, 0x20c
ret