Function at 0x463200
Capabilities:
Copy file
Extract resource via kernel32 functions
Set current directory
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x21c
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov ebx, ecx
push edi
mov dword [esp + 0x14], ebx
mov edx, esi
nop word [eax + eax]
mov al, byte [edx]
cmp al, 0x20
je 0x46322a
cmp al, 9
jne 0x46322d
inc edx
jmp 0x463220
test al, al
je 0x463271
cmp al, 0x2d
je 0x463239
cmp al, 0x2b
jne 0x463240
lea eax, [edx + 1]
mov edx, eax
mov al, byte [eax]
cmp al, 0x30
jne 0x463271
mov al, byte [edx + 1]
cmp al, 0x78
je 0x46324f
cmp al, 0x58
jne 0x463271
movsx eax, byte [edx + 2]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isxdigit]
add esp, 4
test eax, eax
je 0x463271
push 0x10
push 0
push esi
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtol]
add esp, 0xc
jmp 0x46327b
push esi
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
add esp, 4
cmp dword [0x4d99e4], 0
mov esi, eax
je 0x4633ed
cmp esi, 1
mov esi, dword [ebp + 0xc]
je 0x4632d1
mov ecx, esi
call fcn.0047be30
test al, al
je 0x4632d1
mov eax, dword [0x4d70f4]
test byte [eax + 0xe0], 1
jne 0x4632ca
mov ecx, dword [0x4d995c]
push 1
push 0
push 0xffffffffffffffff
push 0x4c40b0
call fcn.004b04f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, ebx
jmp 0x463483
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x46329d
mov edx, dword [ebp + 8]
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4632f6
sub ecx, esi
mov eax, 0x103
cmp ecx, 0x104
cmovae ecx, eax
lea eax, [ecx + 1]
push eax
push edx
lea eax, [esp + 0x20]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsupr]
add esp, 4
lea eax, [esp + 0x18]
push 0xa
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebx, eax
test ebx, ebx
je 0x4633e2
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4633e2
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4633e2
cmp dword [esi], 0x4034b50
mov eax, dword [sym.imp.KERNEL32.dll_SizeofResource]
jne 0x4633bf
push 0
push ebx
push 0
call eax
push eax
lea edx, [esp + 0x14]
mov ecx, esi
call fcn.004af6e0
add esp, 8
test eax, eax
je 0x4633ba
mov esi, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push 0
push ecx
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
push esi
setne bl
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x46344a
mov eax, dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0
lea ecx, [esp + 0x14]
push ecx
push ebx
push 0
call eax
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
push edi
setne bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x46344a
push edi
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x46344a
push 0
lea eax, [esp + 0x124]
push eax
push 0x104
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
push dword [0x4dc0b4]
mov edi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
call edi
xor eax, eax
cmp esi, 1
setne al
push eax
lea eax, [esp + 0x124]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
mov ecx, 0x4c3c29
mov eax, dword [0x4d8ae0]
setne bl
test eax, eax
je 0x463447
mov eax, dword [eax]
test eax, eax
cmovne ecx, eax
push ecx
call edi
test bl, bl
je 0x46346d
mov ecx, dword [0x4d995c]
push 1
push 0
push 0xffffffffffffffff
push 0x4c3cb0
call fcn.004b04f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [0x4d70f4]
test byte [eax + 0xe0], 1
je 0x4632ab
mov ecx, dword [esp + 0x14]
push 0x4c3c29
push 0
push 0x4c40b0
call fcn.0044d1f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc