Function at 0x4556f4
Capabilities:
Extract resource via kernel32 functions
Find taskbar
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x4556fc
push ecx
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 8]
xor eax, eax
push ebp
push 0x455991
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetVersion
xor edx, edx
mov dh, al
mov dl, ah
mov dword [ebp - 8], edx
cmp dword [edi], 0x501
jl 0x455966
xor ebx, ebx
push 0x4559a0
call sub.user32.dll_RegisterWindowMessageA
mov dword [esi + 0x2fa0], eax
push 0
push 0x4559b8
call sub.user32.dll_FindWindowA
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_IsWindow
test eax, eax
jne 0x45576f
xor eax, eax
mov dword [esi + 0x2fa0], eax
jmp 0x455966
xor eax, eax
push ebp
push 0x45595f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0xffffad23
mov eax, dword [esi + 0x2fa0]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_SendMessageA
cmp eax, 0xffffd8ef
jne 0x4557df
push 0
push 0xffffad1f
mov eax, dword [esi + 0x2fa0]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_SendMessageA
cmp eax, 3
setl bl
test bl, bl
je 0x4557d5
push 1
push 0xffffad20
mov eax, dword [esi + 0x2fa0]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_SendMessageA
jmp 0x4557df
call fcn.004034fc
jmp 0x455966
lea eax, [ebp - 4]
mov edx, 0x400
call fcn.00403f48
push 0x400
mov eax, dword [ebp - 4]
call fcn.00403ddc
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, eax
lea eax, [ebp - 4]
call fcn.00403f48
xor eax, eax
mov dword [edi], eax
push ebp
lea edx, [ebp - 0x24]
mov eax, dword [edi]
call fcn.0045559c
pop ecx
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 0x18]
call fcn.00403a34
inc dword [edi]
mov eax, dword [ebp - 0x18]
call fcn.0040759c
test al, al
je 0x455843
test bl, bl
jne 0x455843
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0x18]
call fcn.00452ef8
jmp 0x45584b
mov eax, dword [ebp - 0x18]
call fcn.00407690
test bl, bl
je 0x45585b
mov eax, dword [ebp - 0x18]
call fcn.0040759c
test al, al
jne 0x45580d
push 0xa
push 0x4559c8
mov eax, dword [0x4738fc]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_FindResourceA
mov dword [edi], eax
mov eax, dword [edi]
push eax
mov eax, dword [0x4738fc]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_LoadResource
mov ebx, eax
mov eax, dword [edi]
push eax
mov eax, dword [0x4738fc]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_SizeofResource
mov ecx, eax
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00403a80
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
call fcn.00403d28
je 0x4558fa
mov eax, dword [ebp - 0x18]
call fcn.00455634
test al, al
je 0x4558ed
xor eax, eax
push ebp
push 0x4558db
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
call fcn.00455534
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4558ed
cmp dword [ebp - 0x18], 0
jne 0x4558fa
call fcn.004034fc
jmp 0x455966
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov eax, dword [ebp - 0x20]
push eax
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x45594a
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.00455128
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x455951
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x455998
lea eax, [ebp - 0x24]
call fcn.0040399c
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.004039c0
lea eax, [ebp - 4]
call fcn.0040399c
ret