Function at 0x10009cf0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x4c
lea eax, [0x10258b8a]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
sub esp, 4
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
lea ecx, str.CONFIG2
lea eax, [0x1025913a]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
sub esp, 0xc
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0xa4a313d5
lea eax, [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
sub eax, 0x8fc99c96
je 0x1000a1d2
jmp 0x10009d5b
mov eax, dword [ebp - 0x38]
sub eax, 0x90631b4e
je 0x1000a3fc
jmp 0x10009d6e
mov eax, dword [ebp - 0x38]
sub eax, 0x9aca38af
je 0x1000a2cb
jmp 0x10009d81
mov eax, dword [ebp - 0x38]
sub eax, 0x9b7ccd08
je 0x1000a43a
jmp 0x10009d94
mov eax, dword [ebp - 0x38]
sub eax, 0xa4a313d5
je 0x10009f15
jmp 0x10009da7
mov eax, dword [ebp - 0x38]
sub eax, 0xa7c8d208
je 0x1000a04f
jmp 0x10009dba
mov eax, dword [ebp - 0x38]
sub eax, 0xb10b77cb
je 0x1000a4ed
jmp 0x10009dcd
mov eax, dword [ebp - 0x38]
sub eax, 0xbf626f64
je 0x1000a1b7
jmp 0x10009de0
mov eax, dword [ebp - 0x38]
sub eax, 0xe03c0c0c
je 0x1000a492
jmp 0x10009df3
mov eax, dword [ebp - 0x38]
sub eax, 0xfe664f04
je 0x1000a0f6
jmp 0x10009e06
mov eax, dword [ebp - 0x38]
sub eax, 0x1213522
je 0x1000a2bd
jmp 0x10009e19
mov eax, dword [ebp - 0x38]
sub eax, 0x62cfbba
je 0x1000a06a
jmp 0x10009e2c
mov eax, dword [ebp - 0x38]
sub eax, 0x1eac3eed
je 0x1000a440
jmp 0x10009e3f
mov eax, dword [ebp - 0x38]
sub eax, 0x2dcf9456
je 0x10009f88
jmp 0x10009e52
mov eax, dword [ebp - 0x38]
sub eax, 0x3c1833f1
je 0x10009f30
jmp 0x10009e65
mov eax, dword [ebp - 0x38]
sub eax, 0x425e902d
je 0x1000a2a1
jmp 0x10009e78
mov eax, dword [ebp - 0x38]
sub eax, 0x472a952d
je 0x1000a514
jmp 0x10009e8b
mov eax, dword [ebp - 0x38]
sub eax, 0x541eae9c
je 0x1000a2af
jmp 0x10009e9e
mov eax, dword [ebp - 0x38]
sub eax, 0x54bf5ff7
je 0x1000a378
jmp 0x10009eb1
mov eax, dword [ebp - 0x38]
sub eax, 0x58e11942
je 0x1000a233
jmp 0x10009ec4
mov eax, dword [ebp - 0x38]
sub eax, 0x6966550f
je 0x1000a321
jmp 0x10009ed7
mov eax, dword [ebp - 0x38]
sub eax, 0x6c1f0946
je 0x1000a386
jmp 0x10009eea
mov eax, dword [ebp - 0x38]
sub eax, 0x7d748b34
je 0x1000a394
jmp 0x10009efd
mov eax, dword [ebp - 0x38]
sub eax, 0x7d9d80fb
je 0x1000a506
jmp 0x10009f10
jmp 0x1000a51d
mov ecx, 0x6c1f0946
mov eax, 0x3c1833f1
cmp dword [ebp - 0x20], 0
cmovne ecx, eax
mov eax, dword [ebp - 0x34]
mov dword [eax], ecx
jmp 0x1000a51d
mov edx, dword [0x1027a694]
add edx, dword [0x1027a698]
or edx, 0xd0427ab9
mov eax, edx
xor eax, 0x6e4d5a93
xor eax, 0xffffffff
and eax, 0x6e4d5a93
shl eax, 1
sub eax, 0x6e4d5a93
sub edx, eax
mov eax, edx
and eax, 0x16c3c305
shl eax, 1
xor edx, 0x16c3c305
add edx, eax
mov ecx, 0x2dcf9456
mov eax, 0x1eac3eed
cmp edx, 0xec859eee
cmovae ecx, eax
mov eax, dword [ebp - 0x34]
mov dword [eax], ecx
jmp 0x1000a51d
mov eax, dword [0x1027a69c]
sub eax, dword [0x1027a6a0]
mov ecx, 0xd3379725
xor edx, edx
div ecx
mov edx, eax
xor edx, 0xffffffff
and edx, 0x6be0287
mov esi, 0xffffffff
xor esi, 0x6be0287
mov ecx, eax
and ecx, esi
imul ecx, edx
mov edx, eax
and edx, 0x6be0287
or eax, 0x6be0287
imul eax, edx
add eax, ecx
mov ecx, eax
and ecx, 0x1b8815db
shl ecx, 1
xor eax, 0x1b8815db
add eax, ecx
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
sub esp, 8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
sub esp, 8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
sub esp, 4
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
setne al
and al, 1
mov byte [ebp - 0x21], al
mov ecx, 0x1eac3eed
mov eax, 0xa7c8d208
cmp edx, 0x1a0c4ccf
cmovae ecx, eax
mov eax, dword [ebp - 0x34]
mov dword [eax], ecx
jmp 0x1000a51d
mov ecx, 0x1213522
mov eax, 0x62cfbba
test byte [ebp - 0x21], 1
cmovne ecx, eax
mov eax, dword [ebp - 0x34]
mov dword [eax], ecx
jmp 0x1000a51d
mov ecx, dword [0x1027a6a4]
mov eax, dword [0x1027a6a8]
sub ecx, 0x699a42d
sub ecx, eax
add ecx, 0x699a42d
mov eax, ecx
xor eax, 0xffffffff
mov edx, ecx
xor edx, 0xffffffff
or eax, edx
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x8cc6f9c8
or eax, edx
mov edx, 0xffffffff
xor edx, 0x8cc6f9c8
mov esi, 0xffffffff
xor esi, 0x8cc6f9c8
or edx, esi
xor ecx, 0xffffffff
xor edx, 0xffffffff
or ecx, edx
and eax, ecx
xor eax, 0xffffffff
sub eax, 0xa3eb76ac
sub eax, 0x94e20042
add eax, 0xa3eb76ac
imul edx, eax, 0x7f502f5e
mov ecx, 0xfe664f04
mov eax, 0xe03c0c0c
cmp edx, 0xf396847
cmovbe ecx, eax
mov eax, dword [ebp - 0x34]
mov dword [eax], ecx
jmp 0x1000a51d
mov eax, dword [0x1027a6ac]
xor edx, edx
div dword [0x1027a6b0]
mov ecx, eax
or ecx, 0x42199fe7
xor ecx, 0xffffffff
or eax, 0x42199fe7
xor eax, 0xffffffff
xor ecx, 0xffffffff
xor eax, 0xffffffff
and ecx, eax
mov eax, ecx
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0xe66079ca
and eax, edx
or ecx, 0xe66079ca
xor ecx, 0xffffffff
or eax, ecx
xor eax, 0xffffffff
add eax, 0xa049efd4
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [esp], eax
call fcn.100b1454
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.101f00f0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
mov byte [eax + ecx], 0
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call fcn.10009970
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
sete al
and al, 1
mov byte [ebp - 0x29], al
mov ecx, 0xfe664f04
mov eax, 0xbf626f64
cmp edx, 0x3f0118f7
cmovne ecx, eax
mov eax, dword [ebp - 0x34]
mov dword [eax], ecx
jmp 0x1000a51d
mov ecx, 0x8fc99c96
mov eax, 0x541eae9c
test byte [ebp - 0x29], 1
cmovne ecx, eax
mov eax, dword [ebp - 0x34]
mov dword [eax], ecx
jmp 0x1000a51d
mov eax, dword [0x1027a6b4]
or eax, dword [0x1027a6b8]
mov ecx, eax
and ecx, 0xee02d62c
shl ecx, 1
xor eax, 0xee02d62c
add eax, ecx
mov edx, eax
xor edx, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0x93ca91c0
and edx, ecx
or eax, 0x93ca91c0
xor eax, 0xffffffff
xor edx, 0xffffffff
xor eax, 0xffffffff
and edx, eax
xor edx, 0x1c4c850b
mov ecx, 0x58e11942
mov eax, 0xb10b77cb
cmp edx, 0x9801c894
cmovbe ecx, eax
mov eax, dword [ebp - 0x34]
mov dword [eax], ecx
jmp 0x1000a51d
mov eax, dword [0x1027a6bc]
xor edx, edx
div dword [0x1027a6c0]
mov ecx, eax
mov eax, ecx
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x4ef45279
and eax, edx
xor ecx, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x4ef45279
and ecx, edx
or eax, ecx
xor eax, 0xffffffff
and eax, 0xe4846c88
or eax, 0x1dcc25ce
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call fcn.100b145d
mov edx, dword [ebp - 0x44]
mov ecx, 0xb10b77cb
mov eax, 0x425e902d
cmp edx, 0x28c6eb9f
cmovne ecx, eax
mov eax, dword [ebp - 0x34]
mov dword [eax], ecx
jmp 0x1000a51d
mov eax, dword [ebp - 0x34]
mov dword [eax], 0x541eae9c
jmp 0x1000a51d
mov eax, dword [ebp - 0x34]
mov dword [eax], 0x9aca38af
jmp 0x1000a51d
mov eax, dword [ebp - 0x34]
mov dword [eax], 0x9aca38af
jmp 0x1000a51d
mov eax, dword [0x1027a6c4]
mov ecx, dword [0x1027a6c8]
mov esi, eax
xor esi, 0xffffffff
mov edx, ecx
and edx, esi
xor ecx, 0xffffffff
and eax, ecx
or edx, eax
mov eax, edx
xor eax, 0x1b9889ab
xor eax, 0xffffffff
or edx, 0x1b9889ab
and edx, eax
add edx, 0x55258122
add edx, 0x1213ff69
mov ecx, 0x7d9d80fb
mov eax, 0x6966550f
cmp edx, 0xdd623734
cmovbe ecx, eax
mov eax, dword [ebp - 0x34]
mov dword [eax], ecx
jmp 0x1000a51d
mov edx, dword [0x1027a6cc]
mov eax, dword [0x1027a6d0]
add edx, 0x8f3034de
add edx, eax
sub edx, 0x8f3034de
or edx, 0xbb62d237
xor eax, eax
sub eax, 0xf2e5e532
sub edx, eax
mov eax, edx
xor eax, 0x60984947
xor eax, 0xffffffff
or edx, 0x60984947
and edx, eax
mov ecx, 0x7d9d80fb
mov eax, 0x54bf5ff7
cmp edx, 0xd4e236f8
cmovne ecx, eax
mov eax, dword [ebp - 0x34]
mov dword [eax], ecx
jmp 0x1000a51d
mov eax, dword [ebp - 0x34]
mov dword [eax], 0x7d748b34
jmp 0x1000a51d
mov eax, dword [ebp - 0x34]
mov dword [eax], 0x7d748b34
jmp 0x1000a51d
mov edx, dword [0x1027a6d4]
or edx, dword [0x1027a6d8]
xor eax, eax
sub eax, 0xdb130cef
add edx, eax
mov ecx, edx
xor ecx, 0xffffffff
and ecx, 0x57eb356
mov esi, 0xffffffff
xor esi, 0x57eb356
mov eax, edx
and eax, esi
imul eax, ecx
mov ecx, edx
and ecx, 0x57eb356
or edx, 0x57eb356
imul edx, ecx
add edx, eax
xor edx, 0x3ec595f8
mov ecx, 0x90631b4e
mov eax, 0x472a952d
cmp edx, 0xc2f0f917
cmovae ecx, eax
mov eax, dword [ebp - 0x34]
mov dword [eax], ecx
jmp 0x1000a51d
mov eax, dword [0x1027a6dc]
xor edx, edx
div dword [0x1027a6e0]
mov edx, eax
and edx, 0x35f42308
and edx, 0xe0bc5410
sub edx, 0xbf32272
mov ecx, 0x9b7ccd08
mov eax, 0x472a952d
cmp edx, 0xa9734869
cmovbe ecx, eax
mov eax, dword [ebp - 0x34]
mov dword [eax], ecx
jmp 0x1000a51d
add esp, 0x4c
pop esi
pop ebp
ret
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
sub esp, 8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
sub esp, 8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
sub esp, 4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x34]
mov dword [eax], 0x2dcf9456
jmp 0x1000a51d
mov eax, dword [ebp - 0x14]
mov ecx, 0xffffffff
xor ecx, 1
xor edx, edx
sub edx, 1
sub ecx, edx
sub eax, ecx
mov dword [esp], eax
call fcn.100b1454
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.101f00f0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
mov byte [eax + ecx], 0
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call fcn.10009970
mov eax, dword [ebp - 0x34]
mov dword [eax], 0xfe664f04
jmp 0x1000a51d
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call fcn.100b145d
mov eax, dword [ebp - 0x34]
mov dword [eax], 0x58e11942
jmp 0x1000a51d
mov eax, dword [ebp - 0x34]
mov dword [eax], 0x6966550f
jmp 0x1000a51d
mov eax, dword [ebp - 0x34]
mov dword [eax], 0x90631b4e
jmp 0x10009d45