Function at 0x4131c4
Capabilities:
Enumerate files on windows
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x274
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov esi, dword [sym.imp.SHLWAPI.dll_StrCmpIW]
mov edi, eax
push 0x491a4c
push edi
call esi
test eax, eax
je 0x4137c8
push str..mum
push edi
call esi
test eax, eax
je 0x4137c8
push 0x490c48
push edi
call esi
test eax, eax
je 0x4137c8
push str..msu
push edi
call esi
test eax, eax
jne 0x413319
call fcn.0043c5cd
push eax
lea ecx, [esp + 0x10]
call fcn.0043ac50
lea ecx, [esp + 0xc]
call dword [sym.imp.CBSHost.dll_CbsCreateTempDirectory2]
mov edi, eax
test edi, edi
jne 0x413306
mov edx, dword [esp + 0xc]
mov ecx, ebx
call fcn.004105a1
mov edi, eax
test edi, edi
jne 0x4132fa
push 0x491a70
lea edx, [esp + 0x10]
lea ecx, [esp + 0x1c]
call fcn.0043ab55
pop ecx
lea ecx, [esp + 0x30]
push ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ecx, dword [esp + 0x18]
mov ebx, eax
add ecx, 0xfffffff0
call fcn.0043c924
cmp ebx, 0xffffffff
jne 0x413299
call fcn.0044bc4b
mov edi, eax
jmp 0x4132fa
test byte [esp + 0x30], 0x10
jne 0x4132b0
push str.WSUSSCAN.cab
lea eax, [esp + 0x60]
push eax
call esi
test eax, eax
jne 0x4132c2
lea eax, [esp + 0x30]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x413299
jmp 0x4132f3
lea eax, [esp + 0x5c]
push eax
lea edx, [esp + 0x10]
lea ecx, [esp + 0x14]
call fcn.0043ab55
pop ecx
push dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
push dword [ebp + 0x10]
mov edx, dword [eax]
call fcn.0041be9b
mov ecx, dword [esp + 0x10]
mov edi, eax
lea ecx, [ecx - 0x10]
call fcn.0043c924
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0xc]
xor edx, edx
inc edx
call fcn.0044bfcd
mov ecx, dword [esp + 0xc]
lea ecx, [ecx - 0x10]
call fcn.0043c924
mov eax, edi
jmp 0x4137d8
push str..exe
push edi
call esi
test eax, eax
jne 0x4137c3
push 2
xor edi, edi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
mov dword [esp + 0x24], esi
test esi, esi
jne 0x41334b
call fcn.0044bc4b
mov ebx, eax
jmp 0x4137b6
call fcn.0043c5cd
push eax
lea ecx, [esp + 0x10]
call fcn.0043ac50
lea ecx, [esp + 0xc]
call dword [sym.imp.CBSHost.dll_CbsCreateTempDirectory2]
mov ebx, eax
test ebx, ebx
jne 0x4137aa
push 0xb
pop ebx
push str.TASKSCHEDULEFILE
push 0x138a
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4135ce
push edi
lea edx, [esp + 0x14]
mov dword [esp + 0x14], edi
mov ecx, esi
mov dword [esp + 0x18], edi
call fcn.0044c908
mov ebx, dword [ebp + 8]
pop ecx
cmp dword [ebx + 0x10], edi
je 0x4133c1
cmp dword [ebx + 0x10], 9
je 0x4133b7
mov ebx, 0x80004001
jmp 0x41379e
mov edx, 0x1b5d
lea ecx, [edx + 1]
jmp 0x4133c9
mov edx, 0x1775
lea ecx, [edx + 1]
mov eax, dword [ebx + 0xc]
sub eax, 0x60000
je 0x4133da
sub eax, 1
je 0x4133dc
jmp 0x4133ad
mov ecx, edx
cmp dword [esp + 0x14], 0x90000
je 0x413529
cmp dword [esp + 0x14], 0xa0000
je 0x4133fe
cmp dword [esp + 0x14], 0xb0000
jne 0x4133ad
movzx eax, cx
lea edx, [esp + 0xc]
push str.Temp.cab
lea ecx, [esp + 0x14]
mov dword [esp + 0x1c], eax
call fcn.0043ab55
pop ecx
push dword [ebp + 0x14]
mov ecx, dword [esp + 0x1c]
push dword [ebp + 0x10]
mov edx, dword [eax]
push esi
push 0xa
pop edi
movzx ecx, cx
push edi
push ecx
mov ecx, ebx
call fcn.00413151
mov ecx, dword [esp + 0x24]
add esp, 0x14
mov ebx, eax
lea ecx, [ecx - 0x10]
call fcn.0043c924
test ebx, ebx
jne 0x41379e
push str.Temp.cab
lea edx, [esp + 0x10]
lea ecx, [esp + 0x14]
call fcn.0043ab55
pop ecx
push dword [ebp + 0x14]
mov ecx, dword [esp + 0x1c]
push dword [ebp + 0x10]
mov edx, dword [eax]
add ecx, 4
push esi
movzx ecx, cx
push edi
push ecx
mov ecx, dword [ebp + 8]
call fcn.00413151
mov ecx, dword [esp + 0x24]
add esp, 0x14
mov ebx, eax
lea ecx, [ecx - 0x10]
call fcn.0043c924
test ebx, ebx
je 0x41349e
cmp ebx, 0x716
jne 0x41379e
push str.Temp.msu
lea edx, [esp + 0x10]
lea ecx, [esp + 0x14]
call fcn.0043ab55
pop ecx
push dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
push dword [ebp + 0x10]
mov edx, dword [eax]
push esi
push edi
push 0x157d
call fcn.00413151
mov ecx, dword [esp + 0x24]
add esp, 0x14
mov ebx, eax
lea ecx, [ecx - 0x10]
call fcn.0043c924
test ebx, ebx
je 0x4134e6
cmp ebx, 0x50
jne 0x41379e
push str.Temp.msu
lea edx, [esp + 0x10]
lea ecx, [esp + 0x14]
call fcn.0043ab55
pop ecx
push dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
push dword [ebp + 0x10]
mov edx, dword [eax]
push esi
push edi
push 0x157e
call fcn.00413151
mov ecx, dword [esp + 0x24]
add esp, 0x14
mov ebx, eax
lea ecx, [ecx - 0x10]
call fcn.0043c924
cmp ebx, 0x50
jmp 0x4135c1
movzx eax, cx
lea edx, [esp + 0xc]
mov edi, str.Temp.cab
mov dword [esp + 0x18], eax
push edi
lea ecx, [esp + 0x14]
call fcn.0043ab55
pop ecx
push dword [ebp + 0x14]
mov ecx, dword [esp + 0x1c]
push dword [ebp + 0x10]
mov edx, dword [eax]
push esi
movzx ecx, cx
push str.PACKAGES
push ecx
mov ecx, ebx
call fcn.00413151
mov ecx, dword [esp + 0x24]
add esp, 0x14
mov ebx, eax
lea ecx, [ecx - 0x10]
call fcn.0043c924
test ebx, ebx
jne 0x41379e
push edi
lea edx, [esp + 0x10]
lea ecx, [esp + 0x14]
call fcn.0043ab55
pop ecx
push dword [ebp + 0x14]
mov ecx, dword [esp + 0x1c]
push dword [ebp + 0x10]
mov edx, dword [eax]
add ecx, 4
push esi
movzx ecx, cx
push str.PACKAGES
push ecx
mov ecx, dword [ebp + 8]
call fcn.00413151
mov ecx, dword [esp + 0x24]
add esp, 0x14
mov ebx, eax
lea ecx, [ecx - 0x10]
call fcn.0043c924
cmp ebx, 0x716
jne 0x41379e
xor ebx, ebx
jmp 0x41379e
push 0xa
pop edi
push edi
push str.CABINET
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [esp + 0x10], eax
test eax, eax
je 0x4136dc
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x413604
call fcn.0044bc4b
mov ebx, eax
jmp 0x41379e
push dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], edi
call fcn.00430d93
lea edx, [esp + 0x28]
lea ecx, [esp + 0x10]
call fcn.0041f38a
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [eax]
call fcn.0041f3b1
pop ecx
mov ecx, dword [esp + 0x10]
lea ecx, [ecx - 0x10]
call fcn.0043c924
mov edi, dword [esp + 0x1c]
mov esi, dword [edi]
mov dword [esp + 0x18], esi
jmp 0x413678
push str..cab
push dword [esi + 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionA]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x41367e
lea ecx, [esp + 0x18]
call fcn.0042f6ed
mov esi, dword [esp + 0x18]
cmp esi, edi
jne 0x413652
jmp 0x4136c5
push str.Temp.cab
lea edx, [esp + 0x10]
lea ecx, [esp + 0x14]
call fcn.0043ab55
mov edx, dword [esi + 0x14]
mov esi, dword [esp + 0x14]
pop ecx
mov ecx, esi
push dword [edx]
mov edx, dword [edx + 4]
call fcn.0044b3a9
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x4136bd
push dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov edx, esi
push dword [ebp + 0x10]
call fcn.0041be9b
mov ebx, eax
lea ecx, [esi - 0x10]
call fcn.0043c924
lea ecx, [esp + 0x1c]
call fcn.0041f343
lea ecx, [esp + 0x1c]
call fcn.0043a534
jmp 0x41379e
push edi
push 0x3e9
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [esp + 0x10], eax
test eax, eax
je 0x413732
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4135f8
push str.Temp.cab
lea edx, [esp + 0x10]
lea ecx, [esp + 0x1c]
call fcn.0043ab55
pop ecx
push dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, dword [esp + 0x18]
lea edx, [edi + 0x418]
sub eax, 0x41c
jmp 0x413775
push edi
push 0x67
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x41379e
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x4135f8
push str.Temp.cab
lea edx, [esp + 0x10]
lea ecx, [esp + 0x14]
call fcn.0043ab55
pop ecx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, dword [esp + 0x10]
mov edx, ebx
push eax
mov ecx, esi
call fcn.0044b3a9
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x413796
push dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov edx, esi
push dword [ebp + 0x10]
call fcn.0041be9b
mov ebx, eax
lea ecx, [esi - 0x10]
call fcn.0043c924
mov ecx, dword [esp + 0xc]
xor edx, edx
inc edx
call fcn.0044bfcd
mov ecx, dword [esp + 0xc]
lea ecx, [ecx - 0x10]
call fcn.0043c924
lea ecx, [esp + 0x24]
call fcn.0043879e
mov eax, ebx
jmp 0x4137d8
push 0xb
pop eax
jmp 0x4137d8
push dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov edx, ebx
push dword [ebp + 0x10]
call fcn.0041be9b
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10