Function at 0x41b920
Capabilities:
Extract resource via kernel32 functions
Query environment variable
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x70e00c]
xor eax, ebp
mov dword [ebp - 4], eax
movups xmm0, xmmword [str._0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ]
push esi
push 0x6ea0a0
movups xmmword [ebp - 0x44], xmm0
movzx eax, cx
movups xmm0, xmmword [0x6ea070]
push eax
push 0
movups xmmword [ebp - 0x34], xmm0
mov dword [ebp - 0x4c], 0
movups xmm0, xmmword [0x6ea080]
movups xmmword [ebp - 0x24], xmm0
movups xmm0, xmmword [0x6ea090]
movups xmmword [ebp - 0x14], xmm0
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
mov esi, eax
test esi, esi
jne 0x41b98d
lea eax, [esi - 2]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aa758
mov esp, ebp
pop ebp
ret
push ebx
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov ebx, eax
mov dword [ebp - 0x50], ebx
test ebx, ebx
jne 0x41b9b3
lea eax, [ebx - 0xc]
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aa758
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov dword [ebp - 0x58], eax
test eax, eax
jne 0x41b9dd
push ebx
call dword [sym.imp.KERNEL32.DLL_FreeResource]
pop ebx
mov eax, 0xffffffe4
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aa758
mov esp, ebp
pop ebp
ret
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
push 0x104
push 0x72c688
push str._SystemRoot_System32drivers
mov dword [ebp - 0x54], eax
call dword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsA]
mov dword [ebp - 0x48], eax
test eax, eax
je 0x41bb87
cmp eax, 0x104
ja 0x41bb87
push edi
call fcn.00619e9d
mov edi, eax
and edi, reloc.WS2_32.dll_getsockopt
jns 0x41ba29
dec edi
or edi, 0xfffffff8
inc edi
add edi, 8
xor esi, esi
test edi, edi
jle 0x41ba60
lea ebx, [esi + 0x3f]
call fcn.00619e9d
xor edx, edx
div ebx
mov al, byte [ebp + edx - 0x44]
mov byte [esi + 0x72c7c0], al
cbw
mov word [esi*2 + 0x72c9f0], ax
inc esi
cmp esi, edi
jl 0x41ba35
cmp esi, 0x20
jae 0x41bba3
mov byte [esi + 0x72c7c0], 0
add esi, esi
cmp esi, 0x40
jae 0x41bba3
mov edx, 0x72c688
xor eax, eax
mov word [esi + 0x72c9f0], ax
lea edi, [edx - 1]
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x41ba83
mov ax, word [0x6e9fec]
mov ebx, 0x72c7c0
mov word [edi], ax
mov esi, ebx
nop dword [eax]
mov al, byte [ebx]
inc ebx
test al, al
jne 0x41baa0
sub ebx, esi
lea edi, [edx - 1]
nop dword [eax]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x41bab0
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
dec edx
rep movsb byte es:[edi], byte [esi]
mov al, byte [edx + 1]
lea edx, [edx + 1]
test al, al
jne 0x41bac7
mov eax, dword [str..sys]
mov dword [edx], eax
mov al, byte [0x6ea0cc]
mov byte [edx + 4], al
lea eax, [ebp - 0x4c]
push eax
call fcn.00404160
add esp, 4
mov esi, eax
push 0
push 0x80
push 1
push 0
push 0
push 0x40000000
push 0x72c688
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov edi, eax
test esi, esi
je 0x41bb1c
push dword [ebp - 0x4c]
call fcn.004041c0
add esp, 4
cmp edi, 0xffffffff
jne 0x41bb40
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.DLL_FreeResource]
pop edi
pop ebx
mov eax, 0xfffffffb
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aa758
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x54]
push dword [ebp - 0x58]
push edi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov ecx, dword [ebp - 0x48]
test eax, eax
mov edx, 0xfffffff3
cmove ecx, edx
push edi
mov dword [ebp - 0x48], ecx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.DLL_FreeResource]
mov eax, dword [ebp - 0x48]
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aa758
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.KERNEL32.DLL_FreeResource]
mov ecx, dword [ebp - 4]
mov eax, 0xffffffe9
pop ebx
xor ecx, ebp
pop esi
call fcn.004aa758
mov esp, ebp
pop ebp
ret
call fcn.004aaf06
int3