Function at 0x437d00
Capabilities:
Extract resource via kernel32 functions
Get common file path

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push ebp
mov ebp, dword [esp + 0x1c]
push esi
push edi
push 0x2a4
push 0
mov edi, eax
call ebx
mov esi, eax
test esi, esi
je 0x437d51
push 0xa4
push 0
push esi
call sub.MSVCR90.dll_memset
add esp, 0xc
test edi, edi
je 0x437d68
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push 0
call ebx
mov dword [esi + 0x30], eax
test eax, eax
jne 0x437d60
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov edi, 2
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
push edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ebx, dword [esp + 0x2c]
mov eax, ebx
and eax, 0x3ffffff7
sub eax, 1
mov dword [esi + 0x24], 0xffffffff
je 0x437e2c
sub eax, 1
je 0x437db4
sub eax, 2
jne 0x437e9e
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
push eax
push eax
lea edi, [esi + 4]
push edi
call ebx
push eax
push ebp
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x437df7
mov dword [edi], ebp
jmp 0x437dfd
push 0
push 0x80
push 3
push 0
push 1
push bind
lea edi, [esi + 4]
push ebp
test ebx, ebx
jns 0x437dd6
call dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x437ddc
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [edi], eax
cmp eax, 0xffffffff
jne 0x437df7
mov edi, 1
call fcn.00437c30
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov dword [esi], 2
mov eax, dword [edi]
push 1
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [esi + 0xc], eax
cmp eax, 0xffffffff
jne 0x437e9a
mov edi, 0x10
call fcn.00437c30
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov dword [esi + 4], ebp
test ebp, ebp
je 0x437e42
mov ecx, dword [esp + 0x28]
mov dword [esi + 0x10], ecx
mov dword [esi], 1
jmp 0x437e9e
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
movzx edx, word [esp + 0x28]
push 0xa
mov edi, eax
push edx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebp, eax
test ebp, ebp
je 0x438151
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x438151
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [esi + 4], eax
test eax, eax
je 0x4380b3
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [esi + 0x10], eax
mov dword [esi], 1
jmp 0x437e9e
mov ebx, dword [esp + 0x2c]
test bl, 8
je 0x437ed0
push 0x2a
lea eax, [esi + 0x38]
push 0
push eax
call sub.MSVCR90.dll_memset
mov edx, dword [esi + 0xc]
mov ecx, 8
add esp, 0xc
or dword [esi], ecx
mov word [esi + 0x3e], cx
mov dword [esi + 0x5e], edx
mov dword [esi + 0x24], 0
jmp 0x4380fa
test byte [esi], 1
jne 0x437ef0
mov eax, dword [esi + 4]
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edi, eax
sub edi, dword [esi + 0xc]
mov dword [esp + 0x18], edi
jmp 0x437efc
mov eax, dword [esi + 0x10]
mov dword [esi + 0x14], eax
mov dword [esp + 0x18], eax
mov edi, eax
mov ebx, 0xffff
mov dword [esp + 0x10], ebx
cmp edi, ebx
jae 0x437f0f
mov dword [esp + 0x10], edi
mov ebx, edi
push 0x404
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
je 0x4380b3
mov eax, 4
cmp ebx, eax
jbe 0x437f77
nop
add eax, 0x400
mov dword [esp + 0x14], ebx
cmp eax, ebx
ja 0x437f41
mov dword [esp + 0x14], eax
mov ebx, edi
sub ebx, dword [esp + 0x14]
mov eax, edi
sub eax, ebx
mov edi, 0x404
cmp eax, 0x404
ja 0x437f59
mov edi, eax
test byte [esi], 1
jne 0x437f9e
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push 0
push 0
add ecx, ebx
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x437fa1
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
test byte [esi], 1
jne 0x4380c7
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 4]
push 0
push 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x4380ce
mov dword [esi + 0x14], ebx
mov eax, edi
mov edx, ebp
call fcn.00436db0
test eax, eax
je 0x437f77
add edi, 0xfffffffd
js 0x437fd3
dec edi
cmp byte [edi + ebp], 0x50
jne 0x437fcf
cmp byte [edi + ebp + 1], 0x4b
jne 0x437fcf
cmp byte [edi + ebp + 2], 5
jne 0x437fcf
cmp byte [edi + ebp + 3], 6
je 0x437fec
test edi, edi
jge 0x437fb3
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x14], eax
jae 0x437f77
mov edi, dword [esp + 0x18]
mov ebx, eax
mov eax, dword [esp + 0x14]
jmp 0x437f30
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
add ebx, edi
test byte [esi], 1
jne 0x438010
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push 0
push 0
add ecx, ebx
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x438013
mov dword [esi + 0x14], ebx
mov eax, esi
call fcn.00436e80
mov eax, esi
call fcn.00436e10
movzx ebp, ax
mov eax, esi
call fcn.00436e10
movzx edi, ax
mov eax, esi
call fcn.00436e10
movzx eax, ax
mov dword [esi + 0x18], eax
mov eax, esi
call fcn.00436e10
cmp dword [esi + 8], 0
movzx eax, ax
jne 0x4380df
movzx ecx, ax
cmp ecx, dword [esi + 0x18]
jne 0x43809f
test di, di
jne 0x43809f
test bp, bp
jne 0x43809f
mov eax, esi
call fcn.00436e80
mov edi, eax
mov eax, esi
call fcn.00436e80
mov dword [esi + 0x2c], eax
mov eax, esi
call fcn.00436e10
cmp dword [esi + 8], 0
movzx edx, ax
mov dword [esi + 0x1c], edx
jne 0x4380df
mov ecx, dword [esi + 0x2c]
mov eax, dword [esi + 0xc]
lea edx, [ecx + edi]
lea ebp, [eax + ebx]
cmp ebp, edx
jb 0x4380df
sub eax, ecx
sub eax, edi
add eax, ebx
jmp 0x43810e
mov edi, 8
call fcn.00437c30
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov edi, 2
call fcn.00437c30
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov dword [esi + 0x14], 0
mov eax, esi
call fcn.00436e10
mov edx, 0x8b1f
cmp ax, dx
je 0x4380f3
mov edi, 6
call fcn.00437c30
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov dword [esi + 0x2c], 3
mov eax, dword [esi + 0xc]
or dword [esi], 4
mov dword [esi + 8], 0
mov dword [esi + 0x18], 1
lea ecx, [esi + 0xa4]
push ecx
push 0x1ff
mov dword [esi + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov cl, 0x5c
test eax, eax
je 0x438132
cmp byte [eax + esi + 0xa3], cl
je 0x438141
mov byte [eax + esi + 0xa4], cl
mov byte [eax + esi + 0xa5], 0
mov edx, dword [esp + 0x20]
pop edi
mov dword [edx], esi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
mov edi, 4
call fcn.00437c30
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret