Function at 0x413575
Capabilities:
Enumerate files on windows
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x274
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push ebx
mov edi, eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x413b88
mov esi, dword [sym.imp.SHLWAPI.dll_StrCmpIW]
push 0x4939bc
push edi
call esi
test eax, eax
je 0x413b88
push str..mum
push edi
call esi
test eax, eax
je 0x413b88
push 0x492d20
push edi
call esi
test eax, eax
je 0x413b88
push str..msu
push edi
call esi
test eax, eax
jne 0x4136d9
call fcn.0043d5bb
push eax
lea ecx, [esp + 0x10]
call fcn.0043bbe8
lea ecx, [esp + 0xc]
call dword [sym.imp.CBSHost.dll_CbsCreateTempDirectory2]
mov edi, eax
test edi, edi
jne 0x4136c6
mov edx, dword [esp + 0xc]
mov ecx, ebx
call fcn.004108e1
mov edi, eax
test edi, edi
jne 0x4136ba
push 0x4939e0
lea edx, [esp + 0x10]
lea ecx, [esp + 0x1c]
call fcn.0043baed
pop ecx
lea ecx, [esp + 0x30]
push ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ecx, dword [esp + 0x18]
mov ebx, eax
add ecx, 0xfffffff0
call fcn.0043d912
cmp ebx, 0xffffffff
jne 0x413659
call fcn.0044cc8a
mov edi, eax
jmp 0x4136ba
test byte [esp + 0x30], 0x10
jne 0x413670
push str.WSUSSCAN.cab
lea eax, [esp + 0x60]
push eax
call esi
test eax, eax
jne 0x413682
lea eax, [esp + 0x30]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x413659
jmp 0x4136b3
lea eax, [esp + 0x5c]
push eax
lea edx, [esp + 0x10]
lea ecx, [esp + 0x14]
call fcn.0043baed
pop ecx
push dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
push dword [ebp + 0x10]
mov edx, dword [eax]
call fcn.0041c311
mov ecx, dword [esp + 0x10]
mov edi, eax
lea ecx, [ecx - 0x10]
call fcn.0043d912
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0xc]
xor edx, edx
inc edx
call fcn.0044d00c
mov ecx, dword [esp + 0xc]
lea ecx, [ecx - 0x10]
call fcn.0043d912
mov eax, edi
jmp 0x413b98
push str..exe
push edi
call esi
test eax, eax
jne 0x413b83
push 2
xor edi, edi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
mov dword [esp + 0x24], esi
test esi, esi
jne 0x41370b
call fcn.0044cc8a
mov ebx, eax
jmp 0x413b76
call fcn.0043d5bb
push eax
lea ecx, [esp + 0x10]
call fcn.0043bbe8
lea ecx, [esp + 0xc]
call dword [sym.imp.CBSHost.dll_CbsCreateTempDirectory2]
mov ebx, eax
test ebx, ebx
jne 0x413b6a
push 0xb
pop ebx
push str.TASKSCHEDULEFILE
push 0x138a
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x41398e
push edi
lea edx, [esp + 0x14]
mov dword [esp + 0x14], edi
mov ecx, esi
mov dword [esp + 0x18], edi
call fcn.0044d947
mov ebx, dword [ebp + 8]
pop ecx
cmp dword [ebx + 0x10], edi
je 0x413781
cmp dword [ebx + 0x10], 9
je 0x413777
mov ebx, 0x80004001
jmp 0x413b5e
mov edx, 0x1b5d
lea ecx, [edx + 1]
jmp 0x413789
mov edx, 0x1775
lea ecx, [edx + 1]
mov eax, dword [ebx + 0xc]
sub eax, 0x60000
je 0x41379a
sub eax, 1
je 0x41379c
jmp 0x41376d
mov ecx, edx
cmp dword [esp + 0x14], 0x90000
je 0x4138e9
cmp dword [esp + 0x14], 0xa0000
je 0x4137be
cmp dword [esp + 0x14], 0xb0000
jne 0x41376d
movzx eax, cx
lea edx, [esp + 0xc]
push str.Temp.cab
lea ecx, [esp + 0x14]
mov dword [esp + 0x1c], eax
call fcn.0043baed
pop ecx
push dword [ebp + 0x14]
mov ecx, dword [esp + 0x1c]
push dword [ebp + 0x10]
mov edx, dword [eax]
push esi
push 0xa
pop edi
movzx ecx, cx
push edi
push ecx
mov ecx, ebx
call fcn.00413502
mov ecx, dword [esp + 0x24]
add esp, 0x14
mov ebx, eax
lea ecx, [ecx - 0x10]
call fcn.0043d912
test ebx, ebx
jne 0x413b5e
push str.Temp.cab
lea edx, [esp + 0x10]
lea ecx, [esp + 0x14]
call fcn.0043baed
pop ecx
push dword [ebp + 0x14]
mov ecx, dword [esp + 0x1c]
push dword [ebp + 0x10]
mov edx, dword [eax]
add ecx, 4
push esi
movzx ecx, cx
push edi
push ecx
mov ecx, dword [ebp + 8]
call fcn.00413502
mov ecx, dword [esp + 0x24]
add esp, 0x14
mov ebx, eax
lea ecx, [ecx - 0x10]
call fcn.0043d912
test ebx, ebx
je 0x41385e
cmp ebx, 0x716
jne 0x413b5e
push str.Temp.msu
lea edx, [esp + 0x10]
lea ecx, [esp + 0x14]
call fcn.0043baed
pop ecx
push dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
push dword [ebp + 0x10]
mov edx, dword [eax]
push esi
push edi
push 0x157d
call fcn.00413502
mov ecx, dword [esp + 0x24]
add esp, 0x14
mov ebx, eax
lea ecx, [ecx - 0x10]
call fcn.0043d912
test ebx, ebx
je 0x4138a6
cmp ebx, 0x50
jne 0x413b5e
push str.Temp.msu
lea edx, [esp + 0x10]
lea ecx, [esp + 0x14]
call fcn.0043baed
pop ecx
push dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
push dword [ebp + 0x10]
mov edx, dword [eax]
push esi
push edi
push 0x157e
call fcn.00413502
mov ecx, dword [esp + 0x24]
add esp, 0x14
mov ebx, eax
lea ecx, [ecx - 0x10]
call fcn.0043d912
cmp ebx, 0x50
jmp 0x413981
movzx eax, cx
lea edx, [esp + 0xc]
mov edi, str.Temp.cab
mov dword [esp + 0x18], eax
push edi
lea ecx, [esp + 0x14]
call fcn.0043baed
pop ecx
push dword [ebp + 0x14]
mov ecx, dword [esp + 0x1c]
push dword [ebp + 0x10]
mov edx, dword [eax]
push esi
movzx ecx, cx
push str.PACKAGES
push ecx
mov ecx, ebx
call fcn.00413502
mov ecx, dword [esp + 0x24]
add esp, 0x14
mov ebx, eax
lea ecx, [ecx - 0x10]
call fcn.0043d912
test ebx, ebx
jne 0x413b5e
push edi
lea edx, [esp + 0x10]
lea ecx, [esp + 0x14]
call fcn.0043baed
pop ecx
push dword [ebp + 0x14]
mov ecx, dword [esp + 0x1c]
push dword [ebp + 0x10]
mov edx, dword [eax]
add ecx, 4
push esi
movzx ecx, cx
push str.PACKAGES
push ecx
mov ecx, dword [ebp + 8]
call fcn.00413502
mov ecx, dword [esp + 0x24]
add esp, 0x14
mov ebx, eax
lea ecx, [ecx - 0x10]
call fcn.0043d912
cmp ebx, 0x716
jne 0x413b5e
xor ebx, ebx
jmp 0x413b5e
push 0xa
pop edi
push edi
push str.CABINET
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [esp + 0x10], eax
test eax, eax
je 0x413a9c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x4139c4
call fcn.0044cc8a
mov ebx, eax
jmp 0x413b5e
push dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], edi
call fcn.00431b08
lea edx, [esp + 0x28]
lea ecx, [esp + 0x10]
call fcn.0041f843
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [eax]
call fcn.0041f86a
pop ecx
mov ecx, dword [esp + 0x10]
lea ecx, [ecx - 0x10]
call fcn.0043d912
mov edi, dword [esp + 0x1c]
mov esi, dword [edi]
mov dword [esp + 0x18], esi
jmp 0x413a38
push str..cab
push dword [esi + 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionA]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x413a3e
lea ecx, [esp + 0x18]
call fcn.00430288
mov esi, dword [esp + 0x18]
cmp esi, edi
jne 0x413a12
jmp 0x413a85
push str.Temp.cab
lea edx, [esp + 0x10]
lea ecx, [esp + 0x14]
call fcn.0043baed
mov edx, dword [esi + 0x14]
mov esi, dword [esp + 0x14]
pop ecx
mov ecx, esi
push dword [edx]
mov edx, dword [edx + 4]
call fcn.0044c3e8
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x413a7d
push dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov edx, esi
push dword [ebp + 0x10]
call fcn.0041c311
mov ebx, eax
lea ecx, [esi - 0x10]
call fcn.0043d912
lea ecx, [esp + 0x1c]
call fcn.0041f7fc
lea ecx, [esp + 0x1c]
call fcn.0043b4fb
jmp 0x413b5e
push edi
push 0x3e9
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [esp + 0x10], eax
test eax, eax
je 0x413af2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4139b8
push str.Temp.cab
lea edx, [esp + 0x10]
lea ecx, [esp + 0x1c]
call fcn.0043baed
pop ecx
push dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, dword [esp + 0x18]
lea edx, [edi + 0x418]
sub eax, 0x41c
jmp 0x413b35
push edi
push 0x67
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x413b5e
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x4139b8
push str.Temp.cab
lea edx, [esp + 0x10]
lea ecx, [esp + 0x14]
call fcn.0043baed
pop ecx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, dword [esp + 0x10]
mov edx, ebx
push eax
mov ecx, esi
call fcn.0044c3e8
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x413b56
push dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov edx, esi
push dword [ebp + 0x10]
call fcn.0041c311
mov ebx, eax
lea ecx, [esi - 0x10]
call fcn.0043d912
mov ecx, dword [esp + 0xc]
xor edx, edx
inc edx
call fcn.0044d00c
mov ecx, dword [esp + 0xc]
lea ecx, [ecx - 0x10]
call fcn.0043d912
lea ecx, [esp + 0x24]
call fcn.00439820
mov eax, ebx
jmp 0x413b98
push 0xb
pop eax
jmp 0x413b98
push dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov edx, ebx
push dword [ebp + 0x10]
call fcn.0041c311
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10