Function at 0x401000
Capabilities:
Accept command line arguments
Extract resource via kernel32 functions
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
push esi
mov dword [ebp - 0x108], str._id:
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movsx ecx, byte [eax]
test ecx, ecx
je 0x40103d
mov edx, dword [ebp - 4]
movsx eax, byte [edx]
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp eax, 0x20
je 0x40103d
jmp 0x40101d
mov edx, dword [ebp - 4]
movsx eax, byte [edx]
test eax, eax
je 0x40105d
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx]
cmp edx, 0x20
jne 0x40105d
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
jmp 0x40103d
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x108]
push ecx
mov edx, dword [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov eax, dword [ebp - 4]
push eax
push 0x20000
push 0x800
call dword [sym.imp.KERNEL32.dll_CompareStringA]
cmp eax, 2
jne 0x401272
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
mov edx, dword [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp esi, eax
jle 0x4010d0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
mov ecx, dword [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 0x100
cmp esi, eax
jle 0x4010da
mov eax, 0x57
jmp 0x401277
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x110], 0
push 0x104
push 0x408ab0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x408ab0
push 0
push 0x406038
push 0x408ab0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push str.BINARY
push 0x6e
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x10c], eax
mov edx, dword [ebp - 0x10c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
je 0x4011a7
push 0
push 0x100
push 2
push 0
push 0
push 0x40000000
push 0x408ab0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x110], eax
push 0
lea eax, [ebp - 0x118]
push eax
mov ecx, dword [ebp - 0x10c]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
mov eax, dword [ebp - 0x114]
push eax
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x408ab0
push 0x408bb8
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str._Q__R:N
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp - 0x104]
push ecx
push 0x408bb8
call fcn.00404267
add esp, 8
mov dword [0x408cbc], eax
push str.quartz.dll
mov edx, dword [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 4]
add ecx, eax
push ecx
call fcn.00403f40
add esp, 8
push str.danim.dll
mov edx, dword [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 4]
add ecx, eax
push ecx
call fcn.00403f40
add esp, 8
push str.ddrawex.dll
mov edx, dword [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 4]
add ecx, eax
push ecx
call fcn.00403f40
add esp, 8
push 0
push 0x4000000
push 2
push 0
push 0
push 0x40000000
push 0x408ab0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x110], eax
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x408cbc]
pop esi
mov esp, ebp
pop ebp
ret 0x10