Function at 0x401ba0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401bb9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x401bcd
pop esi
pop edi
xor eax, eax
pop ebx
ret
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x401bee
cmp esi, eax
jae 0x401bc7
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401be0
cmp esi, eax
jae 0x401bc7
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x407df8
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x43ac70
call fcn.0040a1a4
mov edi, 0x94
mov eax, edi
call fcn.00408530
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x449090], ecx
mov eax, dword [esi + 4]
mov dword [0x44909c], eax
mov edx, dword [esi + 8]
mov dword [0x4490a0], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x449094], esi
cmp ecx, 2
je 0x407e58
or esi, 0x8000
mov dword [0x449094], esi
shl eax, 8
add eax, edx
mov dword [0x449098], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x407e93
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x407e93
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x407eab
cmp eax, 0x20b
je 0x407e98
mov dword [ebp - 0x1c], esi
jmp 0x407ebf
cmp dword [ecx + 0x84], 0xe
jbe 0x407e93
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x407eb9
cmp dword [ecx + 0x74], 0xe
jbe 0x407e93
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.0040cc96
pop ecx
test eax, eax
jne 0x407ed3
push 0x1c
call fcn.00407dd4
pop ecx
call fcn.0040a6a4
test eax, eax
jne 0x407ee4
push 0x10
call fcn.00407dd4
pop ecx
call fcn.0040e270
mov dword [ebp - 4], esi
call fcn.0040e072
test eax, eax
jge 0x407efd
push 0x1b
call fcn.00407daf
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x44a9f0], eax
call fcn.0040df50
mov dword [0x449080], eax
call fcn.0040deae
test eax, eax
jge 0x407f23
push 8
call fcn.00407daf
pop ecx
call fcn.0040dc7b
test eax, eax
jge 0x407f34
push 9
call fcn.00407daf
pop ecx
call fcn.00408b9e
mov dword [ebp - 0x20], eax
cmp eax, esi
je 0x407f47
push eax
call fcn.00407daf
pop ecx
mov dword [ebp - 0x38], esi
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.0040dc12
mov dword [ebp - 0x68], eax
test byte [ebp - 0x38], 1
je 0x407f68
movzx eax, word [ebp - 0x34]
jmp 0x407f6b
push 0xa
pop eax
push eax
push dword [ebp - 0x68]
push esi
push esi
call edi
push eax
call fcn.00414cb0
mov edi, eax
mov dword [ebp - 0x6c], edi
cmp dword [ebp - 0x1c], esi
jne 0x407f89
push edi
call fcn.00408cd6
call fcn.00408cf8
jmp 0x407fbb
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.0040a1df
ret