Function at 0x409bf0
Capabilities:
Extract resource via kernel32 functions
Get system information on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41c711
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x78
mov eax, dword [0x428014]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x48], ecx
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x4295b8]
cmp eax, dword [ecx + 4]
jle 0x409d97
push 0x4295b8
call fcn.0040b563
add esp, 4
cmp dword [0x4295b8], 0xffffffff
jne 0x409d97
mov dword [ebp - 4], 0
mov esi, dword [sym.imp.USER32.dll_CharLowerW]
push 0x41
call esi
movzx edx, ax
mov ecx, 0x425cc8
lea eax, [ebp - 0x88]
push eax
call fcn.00401030
add esp, 4
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x6c], xmm0
mov ax, word [eax + 0x10]
mov word [ebp - 0x5c], ax
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x44], eax
test eax, eax
je 0x409d30
push 0x41
call esi
xorps xmm0, xmm0
movzx edi, ax
movups xmmword [ebp - 0x58], xmm0
xor esi, esi
mov ecx, edi
test esi, esi
je 0x409cda
lea edx, [esi - 1]
call fcn.004029d0
imul ecx, eax, 0x19660d
add ecx, 0x3c6ef35f
mov al, byte [esi + str.__l1Rv]
xor al, cl
mov byte [ebp + esi - 0x58], al
inc esi
cmp esi, 0x10
jb 0x409cc0
movups xmm0, xmmword [ebp - 0x58]
lea eax, [ebp - 0x58]
push eax
push dword [ebp - 0x44]
movups xmmword [ebp - 0x58], xmm0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
test esi, esi
je 0x409d3e
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
je 0x409d3e
movzx eax, word [ebp - 0x18]
jmp 0x409d84
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [ebp - 0x40]
cmp eax, 0xc
ja case.0x409d58.1
movzx eax, byte [eax + 0x409e4c]
jmp dword [eax*4 + 0x409e34]
mov eax, 0x8664
jmp 0x409d84
mov eax, 0x1c0
jmp 0x409d84
mov eax, 0xaa64
jmp 0x409d84
mov eax, 0x200
jmp 0x409d84
mov eax, 0x14c
jmp 0x409d84
xor eax, eax
push 0x4295b8
mov word [0x4295bc], ax
call fcn.0040b519
add esp, 4
movzx eax, word [0x4295bc]
cmp eax, 0x14c
je 0x409dc1
cmp eax, 0x8664
je 0x409dba
cmp eax, 0xaa64
jne 0x409e06
mov eax, 0x70
jmp 0x409dc6
mov eax, 0x6f
jmp 0x409dc6
mov eax, 0x6e
push 0x100
push eax
push 0x400000
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x409e06
push esi
push 0x400000
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0x400000
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test edi, edi
je 0x409e06
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
jmp 0x409e0a
xor eax, eax
xor esi, esi
mov ecx, dword [ebp - 0x48]
mov dword [ecx], eax
mov eax, ecx
mov dword [ecx + 4], esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040b05b
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret