Function at 0x4011b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4011c9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x4011dd
pop esi
pop edi
xor eax, eax
pop ebx
ret
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x4011fe
cmp esi, eax
jae 0x4011d7
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4011f0
cmp esi, eax
jae 0x4011d7
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x403993
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x4157d0
call fcn.00406780
mov edi, 0x94
mov eax, edi
call fcn.004037a0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x41c624], ecx
mov eax, dword [esi + 4]
mov dword [0x41c630], eax
mov edx, dword [esi + 8]
mov dword [0x41c634], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x41c628], esi
cmp ecx, 2
je 0x4039f3
or esi, 0x8000
mov dword [0x41c628], esi
shl eax, 8
add eax, edx
mov dword [0x41c62c], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x403a2e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x403a2e
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x403a46
cmp eax, 0x20b
je 0x403a33
mov dword [ebp - 0x1c], esi
jmp 0x403a5a
cmp dword [ecx + 0x84], 0xe
jbe 0x403a2e
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x403a54
cmp dword [ecx + 0x74], 0xe
jbe 0x403a2e
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.00405c09
pop ecx
test eax, eax
jne 0x403a6e
push 0x1c
call fcn.0040396f
pop ecx
call fcn.004059ca
test eax, eax
jne 0x403a7f
push 0x10
call fcn.0040396f
pop ecx
call fcn.00407159
mov dword [ebp - 4], esi
call fcn.00406f5b
test eax, eax
jge 0x403a98
push 0x1b
call fcn.0040394a
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x41de90], eax
call fcn.00406e39
mov dword [0x41c614], eax
call fcn.00406d97
test eax, eax
jge 0x403abe
push 8
call fcn.0040394a
pop ecx
call fcn.00406b64
test eax, eax
jge 0x403acf
push 9
call fcn.0040394a
pop ecx
call fcn.00404248
mov dword [ebp - 0x20], eax
cmp eax, esi
je 0x403ae2
push eax
call fcn.0040394a
pop ecx
mov dword [ebp - 0x38], esi
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00406afb
mov dword [ebp - 0x68], eax
test byte [ebp - 0x38], 1
je 0x403b03
movzx eax, word [ebp - 0x34]
jmp 0x403b06
push 0xa
pop eax
push eax
push dword [ebp - 0x68]
push esi
push esi
call edi
push eax
call fcn.0040c040
mov edi, eax
mov dword [ebp - 0x6c], edi
cmp dword [ebp - 0x1c], esi
jne 0x403b24
push edi
call fcn.00404380
call fcn.004043a2
jmp 0x403b56
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.004067bb
ret