Function at 0x404926
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
lea ebp, [esp - 0x204]
sub esp, 0x284
mov eax, dword [0x41f4f0]
xor eax, ebp
mov dword [ebp + 0x200], eax
mov eax, dword [ebp + 0x20c]
push ebx
mov ebx, dword [0x420400]
push esi
mov dword [ebp - 0x68], eax
mov eax, dword [ebp + 0x21c]
push edi
mov dword [ebp - 0x64], eax
movzx eax, word [ebp + 0x210]
push 0xf1
push eax
push ebx
mov dword [ebp - 0x74], ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
xor edi, edi
cmp eax, edi
jne 0x404980
xor eax, eax
jmp 0x404be4
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
je 0x404979
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
xor eax, eax
cmp ebx, edi
je 0x404be4
cmp dword [ebp + 0x214], edi
lea ecx, [ebp - 0x60]
setne al
mov esi, eax
movzx eax, word [ebx + 6]
add eax, esi
push eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x60], edi
call fcn.00404647
cmp eax, edi
mov dword [ebp - 0x70], eax
jne 0x4049d8
lea eax, [ebp - 0x5c]
cmp dword [ebp - 0x60], eax
je 0x404979
lea ecx, [ebp - 0x60]
call fcn.0040388e
jmp 0x404979
cmp dword [ebp + 0x214], edi
je 0x4049f7
mov dword [eax], 4
mov dword [eax + 4], edi
mov byte [eax + 8], 0
mov byte [eax + 9], 1
mov dword [eax + 0xc], edi
mov dword [eax + 0x10], edi
xor ecx, ecx
cmp word [ebx + 6], di
mov dword [ebp - 0x6c], edi
jbe 0x404a4d
imul esi, esi, 0x14
lea eax, [esi + eax + 8]
cmp word [ebx + ecx*2 + 8], di
je 0x404a2a
mov edx, dword [ebp - 0x6c]
inc dword [ebp - 0x6c]
mov dword [eax - 8], edx
movzx edx, word [ebx + ecx*2 + 8]
mov dword [eax - 4], edx
mov byte [eax], 4
mov byte [eax + 1], 0
jmp 0x404a3b
mov dword [eax - 8], 8
mov dword [eax - 4], edi
mov byte [eax], 0
mov byte [eax + 1], 1
mov dword [eax + 8], edi
mov dword [eax + 4], edi
movzx edx, word [ebx + 6]
inc ecx
add eax, 0x14
cmp ecx, edx
jl 0x404a09
push edi
push dword [0x4203fc]
push dword [ebp - 0x64]
push dword [ebp - 0x68]
push 0x64
push 0x64
push edi
push edi
push dword [ebp + 0x218]
push edi
push str.ToolbarWindow32
push edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
cmp eax, edi
mov dword [ebp - 0x68], eax
je 0x4049c6
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push edi
push 0x14
push 0x41e
push eax
call esi
push edi
push edi
push 0x31
push dword [ebp - 0x68]
call esi
cmp eax, edi
mov dword [ebp - 0x64], eax
jne 0x404aaa
push 0x11
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [ebp - 0x64], eax
push 0x58
lea eax, [ebp + 0x1a8]
push edi
push eax
mov dword [ebp + 0x1a4], edi
call fcn.00410970
add esp, 0xc
lea eax, [ebp + 0x1a4]
push eax
push 0x5c
push dword [ebp - 0x64]
call dword [sym.imp.GDI32.dll_GetObjectW]
push dword [ebp + 0x1a4]
call fcn.0041147c
movzx eax, ax
mov dword [ebp - 0x64], eax
movzx eax, word [ebp + 0x210]
mov ecx, esp
mov dword [ecx], eax
call fcn.004037e4
movzx eax, ax
cmp ax, 4
pop ecx
jbe 0x404b3d
cmp ax, 0x20
mov ecx, 0xff000000
jne 0x404b0d
or ecx, 0xffffffff
movzx eax, word [ebx + 2]
push 0x2040
push edi
push ecx
push 1
push eax
movzx eax, word [ebp + 0x210]
push eax
push dword [0x420400]
call dword [sym.imp.COMCTL32.dll_ImageList_LoadImageW]
push eax
push edi
push 0x430
push dword [ebp - 0x68]
call esi
jmp 0x404b65
xor eax, eax
lea edi, [ebp - 0x78]
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp + 0x210]
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x7c]
push eax
push dword [ebp - 0x6c]
push 0x413
push dword [ebp - 0x68]
call esi
xor edi, edi
push dword [ebp - 0x70]
push dword [ebp - 0x80]
push 0x444
push dword [ebp - 0x68]
call esi
movzx eax, word [ebx + 4]
cmp ax, word [ebp - 0x64]
movzx eax, ax
ja 0x404b86
movzx eax, word [ebp - 0x64]
movzx ecx, word [ebx + 2]
movzx eax, ax
shl eax, 0x10
or eax, ecx
push eax
push edi
push 0x420
push dword [ebp - 0x68]
call esi
movzx eax, word [ebx + 4]
cmp ax, word [ebp - 0x64]
movzx eax, ax
ja 0x404baf
movzx eax, word [ebp - 0x64]
mov cx, word [ebx + 2]
add eax, 7
movzx eax, ax
add cx, 7
movzx ecx, cx
shl eax, 0x10
or eax, ecx
push eax
push edi
push 0x41f
push dword [ebp - 0x68]
call esi
lea eax, [ebp - 0x5c]
cmp dword [ebp - 0x60], eax
je 0x404be1
lea ecx, [ebp - 0x60]
call fcn.0040388e
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp + 0x200]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00410c92
add ebp, 0x204
leave
ret