Function at 0x404149
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0xc], 1
mov eax, dword [0x41d580]
mov dword [ebp - 8], eax
push 0xf0
movzx eax, word [ebp + 8]
push eax
push dword [ebp - 8]
call dword [0x41d408]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x404389
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x404389
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x404389
call dword [0x41d040]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0xc], 0
je 0x404389
mov eax, dword [ebp - 0x14]
movzx eax, word [eax]
test eax, eax
je 0x404389
mov eax, dword [ebp - 0x14]
mov ax, word [eax]
mov word [ebp - 0x2c], ax
mov eax, dword [ebp - 0x14]
inc eax
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov ax, word [eax]
mov word [ebp - 0x30], ax
mov eax, dword [ebp - 0x14]
inc eax
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
add eax, 4
mov dword [ebp - 0x14], eax
movzx eax, word [ebp - 0x30]
cmp eax, 0x403
jne 0x4042ba
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x404227
and dword [ebp - 0x64], 0
jmp 0x404291
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
shl eax, 1
add eax, 3
and eax, 0xfffffffc
call fcn.004175a0
mov dword [ebp - 0x5c], esp
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x5c], 0
je 0x404259
cmp dword [ebp - 0x24], 0
jne 0x40425f
and dword [ebp - 0x64], 0
jmp 0x404291
mov eax, dword [ebp - 0x5c]
and word [eax], 0
push dword [ebp - 0x18]
push dword [ebp - 0x5c]
push 0xffffffffffffffff
push dword [ebp - 0x24]
push 0
push dword [ebp - 0x20]
call dword [0x41d428]
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
jne 0x40428b
and dword [ebp - 0x64], 0
jmp 0x404291
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x64], eax
push dword [ebp - 0x64]
push 0
push 0x143
movzx eax, word [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x74]
push dword [eax + 4]
call dword [0x41d498]
cmp eax, 0xffffffff
jne 0x4042b5
and dword [ebp - 0xc], 0
jmp 0x40437b
movzx eax, word [ebp - 0x30]
cmp eax, 0x1234
jne 0x40437b
mov dword [ebp - 0x54], 1
or dword [ebp - 0x50], 0xffffffff
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x4042e6
and dword [ebp - 0x78], 0
jmp 0x404350
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
shl eax, 1
add eax, 3
and eax, 0xfffffffc
call fcn.004175a0
mov dword [ebp - 0x6c], esp
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x6c], 0
je 0x404318
cmp dword [ebp - 0x24], 0
jne 0x40431e
and dword [ebp - 0x78], 0
jmp 0x404350
mov eax, dword [ebp - 0x6c]
and word [eax], 0
push dword [ebp - 0x18]
push dword [ebp - 0x6c]
push 0xffffffffffffffff
push dword [ebp - 0x24]
push 0
push dword [ebp - 0x20]
call dword [0x41d428]
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
jne 0x40434a
and dword [ebp - 0x78], 0
jmp 0x404350
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x54]
push eax
push 0
push 0x40b
movzx eax, word [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x74]
push dword [eax + 4]
call dword [0x41d498]
cmp eax, 0xffffffff
jne 0x40437b
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x28]
mov dword [ebp - 0x14], eax
jmp 0x4041b9
mov eax, dword [ebp - 0xc]
lea esp, [ebp - 0x78]
leave
ret 4