Started a demo console application that dumps executable information.

Src/Debug Application/Program.cs

@@ -23,9 +23,9 @@ static void Main(string[] args)
             //string file_name = Assembly.GetEntryAssembly().Location;
             //string file_name = @"C:\Windows\SysWOW64\kernel32.dll";
             //string file_name = @"C:\Windows\System32\kernel32.dll";
-            string file_name = @"C:\Windows\SysWOW64\shell32.dll";
+            //string file_name = @"C:\Windows\SysWOW64\shell32.dll";
             //string file_name = @"C:\Windows\System32\shell32.dll";
-            //string file_name = @"C:\Windows\System32\user32.dll";
+            string file_name = @"C:\Windows\System32\user32.dll";
             //string file_name = @"C:\Windows\explorer.exe";
             //string file_name = @"C:\Windows\SysWOW64\xpsservices.dll";
             //string file_name = @"c:\windows\system32\advapi32.dll";
@@ -42,11 +42,18 @@ static void Main(string[] args)
 
             ExecutableImage image = ExecutableImage.FromFile(file_name);
             ResourceCollection resources = ResourceCollection.Get(image);
+
+            ResourceType group_types = resources.First(t => t.Id == ResourceType.RT_GROUP_CURSOR);
+            Resource group_resource = group_types.First(r => r.Id == 100);
+            CursorGroupResource cursor_group_resource = CursorGroupResource.Load(group_resource);
+
             ResourceType types = resources.First(t => t.Id == ResourceType.RT_CURSOR);
-            Resource resource = types.First(r => r.Id == 97);
+            Resource resource = types.First(r => r.Id == 92);
             CursorResource cursor_resource = CursorResource.Load(resource);
 
-            cursor_resource.Save(@"D:\test.cur");
+            Bitmap bitmap = cursor_resource.ToBitmap();
+
+            bitmap.Save(@"D:\test.bmp");
 
         }
 

Src/PE Dump/App.config

@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="utf-8"?>
+<configuration>
+    <startup> 
+        <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.0"/>
+    </startup>
+</configuration>