Function at 0x4895ea
Capabilities:
Encode data using xor
Extract resource via kernel32 functions
Terminate process

Disassembly:
push 0x648
mov eax, 0x54eec1
call fcn.00514880
mov ebx, ecx
mov dword [ebp - 0x638], ebx
push 0xfffffffffffffff0
call fcn.00402cb0
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0xff3fffff
mov ecx, ebx
or eax, 0x6000000
push eax
push 0xfffffffffffffff0
call fcn.00402cb0
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
call fcn.00402160
lea eax, [ebp - 0x3ac]
mov ecx, ebx
push eax
call fcn.00402cb0
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0x3a0]
mov ecx, ebx
sub eax, dword [ebp - 0x3a8]
push 0x20
push eax
mov eax, dword [ebp - 0x3a4]
sub eax, dword [ebp - 0x3ac]
push eax
push dword [ebp - 0x3a8]
push dword [ebp - 0x3ac]
push 0
call fcn.00402cb0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
call fcn.00402160
push dword [ebx + 4]
lea ecx, [ebx + 0x38]
call fcn.0048399b
lea eax, [ebx + 0x30]
push eax
lea ecx, [ebx + 0x38]
call fcn.00482c06
xor eax, eax
mov dword [ebp - 0x644], eax
mov dword [ebp - 0x640], eax
mov dword [ebp - 0x63c], eax
push 0x74
pop ecx
mov esi, str.8yJs3XazVc3UYtFsezuDt4FkyKWUmadWsp1pLaoMOf83I4i8ELCTsFPwD3M9Ih6Ux0fUqS5Y6L9Q6CR4jP7A4TZHfl5a8pUEmXReUnvntRkAMMq5HqTrw6jBWGuWLp1NQhXQO5cHjI8AzAmWASkOCVbDWWv9nA0X1jDPOz6EqmXOxyNAMtzbA226ySVHAJFAltBlEclHEx3NKAZX3TClQEFt07BvhwKDyFqNkcss8nGoM7wAsPWjKS2JxtkdytiajKUwxkTL4EKwHdtzZJSBjMRus7wFG7Jv1ktrdUSaYAW9gbcbu9XuFNW7pIbRCotwN6onixcVHCAGovhaKoO7IkwLCtVHVcGnUONsJbHjP4sqF6ww12PutLYP83W96tzXAgocIoHg1VBt4EDpxdtwo9YAQYKCAvLSLpt0ZEzMkzj6iRtwnPrChSgU9mSFbycbUocci7G6f1uqAyQZ
mov dword [ebp - 4], eax
lea edi, [ebp - 0x39c]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x39c]
push eax
lea ecx, [ebp - 0x3c4]
movsb byte es:[edi], byte [esi]
call fcn.004057d0
lea eax, [ebp - 0x3c4]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x644]
call fcn.00407f90
push 0
push 1
lea ecx, [ebp - 0x3c4]
mov byte [ebp - 4], 0
call fcn.00479e2e
lea ecx, [ebp - 0x62c]
call fcn.00491728
mov byte [ebp - 4], 2
call fcn.00483845
mov ecx, eax
call fcn.004816cb
test al, al
je 0x489780
lea eax, [ebp - 0x4e4]
push eax
call fcn.00483426
pop ecx
mov eax, dword [ebx]
lea ecx, [ebp - 0x460]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 3
call dword [eax + 0x24]
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.00481560
push eax
lea ecx, [ebp - 0x4e4]
call fcn.00481127
lea ecx, [ebp - 0x460]
mov byte [ebp - 4], 3
call fcn.00481015
lea ecx, [ebp - 0x4e4]
call fcn.00481560
push eax
call fcn.004876ab
pop ecx
lea ecx, [ebp - 0x4e4]
mov byte [ebp - 4], 2
call fcn.00481015
call fcn.00402160
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x30]
dec eax
sub eax, 1
je 0x489940
dec eax
sub eax, 1
jne 0x489972
mov eax, dword [ebx]
mov ecx, ebx
push str.ZIPRES
call dword [eax + 0x38]
push eax
call fcn.004837b6
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
mov dword [ebp - 0x634], esi
test esi, esi
je 0x489a59
push esi
call fcn.004837b6
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x630], eax
test eax, eax
jne 0x4897ec
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x489a59
xor eax, eax
mov dword [ebp - 0x654], eax
mov dword [ebp - 0x650], eax
mov dword [ebp - 0x64c], eax
push 0x6e
pop ecx
mov esi, str.Kphcp6sXq62TSq8DfJSjol7igvK3pxQNGx0tyEVKxTbEsOBMuF19IXAYfSsaJdxwgKuaXiMzmjx5wIDCMWPdzTL0x8BTQShs4hHnGQXLcR4EhFqoXstYuDP1mbnl11nw8x0beawChpHWag8QqufWltke6WtwH2TxyKyjxT6TWZCUFZcVd7t8cMrZt99far5YtvUjPO9w8xtCrmWSXRhlKWxyhjXVuexnOnp28XrYid8hJDIGyJ3ylTTVOAGXJfb7zhB5ZXJjAGG5qeyIUmKRXitsxCCWxIrBHpsNsyQvXGb23tlSKRoUAL2xWzjerS6ayKC4Nc8Sof12SxcSDvVfW2rGyrGtL4act7mPjCbah8TYuKw9Z6ohBrTABaYdnepYgzET6EF590Zf2thfYc3timheWunVrHcy7dm4MLVMTCyiSDi5UckbySI
mov byte [ebp - 4], 6
lea edi, [ebp - 0x1c8]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x1c8]
push eax
lea ecx, [ebp - 0x3dc]
call fcn.004057d0
lea eax, [ebp - 0x3dc]
mov byte [ebp - 4], 7
push eax
lea ecx, [ebp - 0x654]
call fcn.00407f90
push 0
push 1
lea ecx, [ebp - 0x3dc]
mov byte [ebp - 4], 6
call fcn.00479e2e
mov edi, dword [ebp - 0x634]
push edi
call fcn.004837b6
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test esi, esi
jne 0x489878
lea ecx, [ebp - 0x654]
call fcn.00479e80
jmp 0x489a59
push esi
call fcn.00474ddd
mov dword [0x679418], eax
pop ecx
test eax, eax
je 0x4898a4
push esi
push dword [ebp - 0x630]
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push dword [0x679418]
call fcn.004f0f60
add esp, 0xc
push 0x5c4bc8
lea ecx, [ebp - 0x3c4]
call fcn.004057d0
mov eax, dword [ebp - 0x3b4]
xor edx, edx
and dword [ebp - 0x630], edx
mov byte [ebp - 4], 8
test esi, esi
je 0x48990b
mov edi, dword [ebp - 0x630]
mov ebx, eax
cmp dword [ebp - 0x3b0], 0x10
lea eax, [ebp - 0x3c4]
mov ecx, dword [0x679418]
cmovae eax, dword [ebp - 0x3c4]
mov al, byte [edx + eax]
xor byte [edi + ecx], al
inc edx
xor eax, eax
cmp edx, ebx
cmovge edx, eax
inc edi
cmp edi, esi
jb 0x4898d2
mov ebx, dword [ebp - 0x638]
mov edi, dword [ebp - 0x634]
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
push esi
push dword [0x679418]
call fcn.004876f9
pop ecx
pop ecx
push 0
push 1
lea ecx, [ebp - 0x3c4]
call fcn.00479e2e
lea ecx, [ebp - 0x654]
mov byte [ebp - 4], 2
call fcn.00479e80
jmp 0x489972
mov eax, dword [ebx]
lea ecx, [ebp - 0x460]
push ecx
mov ecx, ebx
call dword [eax + 0x34]
push 1
mov ecx, eax
mov byte [ebp - 4], 5
call fcn.00481560
push eax
call fcn.0048775b
pop ecx
pop ecx
lea ecx, [ebp - 0x460]
mov byte [ebp - 4], 2
call fcn.00481015
call fcn.00402160
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x30]
lea ecx, [ebp - 0x460]
cmp eax, 3
mov eax, dword [ebx]
push ecx
mov ecx, ebx
jne 0x4899d4
call dword [eax + 0x28]
mov ecx, eax
mov byte [ebp - 4], 9
call fcn.00481560
push eax
call fcn.004f4f09
pop ecx
lea ecx, [ebp - 0x460]
movzx esi, ax
mov byte [ebp - 4], 2
call fcn.00481015
push 0
lea edi, [ebx + 0x38]
push edi
lea eax, [ebx + 0x34]
push eax
push 0x60bde0
push esi
lea ecx, [ebp - 0x62c]
call fcn.0049254f
mov esi, eax
jmp 0x489a0f
lea esi, [ebx + 0x34]
call dword [eax + 0x28]
push 0
lea edi, [ebx + 0x38]
mov byte [ebp - 4], 0xa
push edi
push esi
push 0
mov ecx, eax
call fcn.00481560
push ecx
mov ecx, esp
mov dword [ecx], eax
lea ecx, [ebp - 0x62c]
call fcn.0049254f
lea ecx, [ebp - 0x460]
mov byte [ebp - 4], 2
mov esi, eax
call fcn.00481015
test esi, esi
jne 0x489a2e
push 0x10
push str.Duilib
push 0x60bdf8
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.00402160
push esi
mov ecx, edi
call fcn.00482c42
call fcn.00402160
lea eax, [ebx + 0x2c]
mov ecx, edi
push eax
call fcn.00482a14
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov ecx, edi
call fcn.00483b36
lea ecx, [ebp - 0x62c]
call fcn.004908f2
lea ecx, [ebp - 0x644]
call fcn.00479e80
xor eax, eax
call fcn.0051483b
ret 0x10