Function at 0x4458cc
Capabilities:
Extract resource via kernel32 functions
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor edx, edx
push ebp
push 0x445f57
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xb0]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x445934
inc ebx
xor esi, esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xb0]
mov edx, esi
call fcn.00419898
mov edi, eax
mov edx, dword [ebp - 8]
mov eax, dword [edi + 4]
call dword [edi]
test al, al
je 0x445930
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x445f6c
inc esi
dec ebx
jne 0x445905
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00445780
mov ebx, dword [ebp - 8]
mov ebx, dword [ebx]
mov eax, ebx
cmp eax, 0x53
jg 0x4459f6
je 0x445e7a
cmp eax, 0x11
jg 0x4459b4
je 0x445c9f
cmp eax, 0x10
ja case.0x445969.1
jmp dword [eax*4 + 0x445970]
cmp eax, 0x1c
jg 0x4459df
je 0x445b70
sub eax, 0x14
je 0x445b27
sub eax, 2
je 0x445c83
sub eax, 4
je 0x445ef8
jmp case.0x445969.1
sub eax, 0x1d
je 0x445f1e
sub eax, 0x1a
je 0x445b3c
jmp case.0x445969.1
cmp eax, 0xb017
jg 0x445a4c
je 0x445cf1
cmp eax, 0xb000
jg 0x445a33
je 0x445d8a
sub eax, 0x112
je 0x445a8e
add eax, 0xffffffe0
sub eax, 7
jb 0x445c57
sub eax, 0x1e1
je 0x445f31
jmp case.0x445969.1
sub eax, 0xb001
je 0x445e03
sub eax, 0x15
je 0x445ccf
jmp case.0x445969.1
cmp eax, 0xb020
jg 0x445a72
je 0x445e94
sub eax, 0xb01a
je 0x445e3c
sub eax, 5
je 0x445e7a
jmp case.0x445969.1
sub eax, 0xb031
je 0x445ecd
add eax, 0xfffffff2
sub eax, 2
jb 0x445cae
jmp case.0x445969.1
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
and eax, 0xfff0
sub eax, 0xf020
je 0x445aa9
sub eax, 0x100
je 0x445ab6
jmp 0x445ac3
mov eax, dword [ebp - 4]
call fcn.00445f90
jmp 0x445f4d
mov eax, dword [ebp - 4]
call fcn.00446070
jmp 0x445f4d
push ebp
call fcn.00445844
pop ecx
jmp 0x445f4d
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 1
jne 0x445f4d
mov byte [0x499c2c], 1
jmp 0x445f4d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
test eax, eax
je 0x445f4d
call fcn.00442a04
jmp 0x445f4d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
call fcn.0043b75c
test eax, eax
je 0x445b1b
push ebp
call fcn.00445880
pop ecx
jmp 0x445f4d
push ebp
call fcn.00445844
pop ecx
jmp 0x445f4d
mov eax, dword [ebp - 8]
mov dword [eax], 0x27
push ebp
call fcn.00445844
pop ecx
jmp 0x445f4d
mov eax, dword [ebp - 4]
call fcn.00445f74
mov edx, dword [ebp - 8]
mov dword [edx + 0xc], eax
jmp 0x445f4d
push 0
push 0
push 0xb01a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
push eax
call sub.KERNEL32.DLL_GetVersion
push ebp
call fcn.00445844
pop ecx
jmp 0x445f4d
push ebp
call fcn.00445844
pop ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 1
sbb eax, eax
inc eax
mov edx, dword [ebp - 4]
mov byte [edx + 0xa5], al
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0
je 0x445bb5
mov eax, dword [ebp - 4]
call fcn.00445490
push 0
push 0
push 0xb000
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
push eax
call sub.KERNEL32.DLL_GetVersion
jmp 0x445f4d
mov eax, dword [ebp - 4]
call fcn.00445430
push 0
push 0
push 0xb001
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
push eax
call sub.KERNEL32.DLL_GetVersion
jmp 0x445f4d
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0
je 0x445c1a
cmp byte [0x492520], 0
jne 0x445c0e
mov eax, dword [ebp - 4]
call fcn.00445490
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x445c0e
call fcn.0043b9e4
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0xb4], edx
push ebp
call fcn.00445844
pop ecx
jmp 0x445f4d
push ebp
call fcn.00445844
pop ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0xb4], 0
jne 0x445c4a
cmp byte [0x492520], 0
jne 0x445c4a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
call fcn.0043b920
mov edx, dword [ebp - 4]
mov dword [edx + 0xb4], eax
mov eax, dword [ebp - 4]
call fcn.00445438
jmp 0x445f4d
mov esi, dword [ebp - 8]
mov esi, dword [esi + 8]
push esi
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
push eax
mov eax, dword [ebp - 8]
add ebx, 0xbc00
push ebx
mov eax, dword [ebp - 8]
push esi
call sub.KERNEL32.DLL_HeapFree
mov edx, dword [ebp - 8]
mov dword [edx + 0xc], eax
jmp 0x445f4d
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0
je 0x445f4d
call fcn.0040f320
call fcn.00405388
jmp 0x445f4d
mov eax, dword [ebp - 8]
mov dword [eax + 0xc], 1
jmp 0x445f4d
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 8]
mov eax, dword [ebp - 8]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00447c6c
and eax, 0x7f
mov edx, dword [ebp - 8]
mov dword [edx + 0xc], eax
jmp 0x445f4d
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0044641c
test al, al
je 0x445f4d
mov eax, dword [ebp - 8]
mov dword [eax + 0xc], 1
jmp 0x445f4d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
test eax, eax
je 0x445f4d
mov ebx, eax
mov eax, ebx
call fcn.004585f8
test eax, eax
je 0x445f4d
mov eax, ebx
call fcn.004585f8
push eax
call sub.KERNEL32.DLL_GetExitCodeProcess
test eax, eax
je 0x445f4d
mov eax, ebx
call fcn.004585f8
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
test eax, eax
je 0x445f4d
mov byte [0x492508], 0
call sub.KERNEL32.DLL_GetStartupInfoA
mov esi, eax
mov eax, ebx
call fcn.004585f8
push eax
call sub.KERNEL32.DLL_LockResource
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
push eax
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 4]
mov edx, 0x112
mov eax, ebx
call fcn.00451b4c
push esi
call sub.KERNEL32.DLL_LockResource
mov byte [0x492508], 1
mov eax, dword [ebp - 8]
mov dword [eax + 0xc], 1
jmp 0x445f4d
mov eax, dword [ebp - 4]
cmp word [eax + 0x13a], 0
je 0x445da9
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x13c]
call dword [ebx + 0x138]
mov eax, dword [0x499c1c]
cmp dword [eax + 0x44], 0
je 0x445df7
mov eax, dword [0x499c1c]
call fcn.0044821c
test al, al
je 0x445df7
mov eax, dword [0x499c1c]
mov eax, dword [eax + 0x44]
call fcn.004585f8
push eax
call sub.KERNEL32.DLL_GetExitCodeProcess
test eax, eax
jne 0x445df7
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
call fcn.004585f8
cmp eax, dword [0x499c44]
je 0x445df7
mov eax, dword [0x499c44]
push eax
call sub.KERNEL32.DLL_LockResource
xor eax, eax
mov dword [0x499c44], eax
jmp 0x445f4d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
push eax
call sub.KERNEL32.DLL_CompareStringA
mov dword [0x499c44], eax
mov eax, dword [ebp - 4]
cmp word [eax + 0x132], 0
je 0x445f4d
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x134]
call dword [ebx + 0x130]
jmp 0x445f4d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
call fcn.0043b75c
test eax, eax
jne 0x445f4d
call sub.KERNEL32.DLL_GetStartupInfoA
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x30]
jne 0x445f4d
xor eax, eax
call fcn.0043ba80
test eax, eax
je 0x445f4d
push eax
call sub.KERNEL32.DLL_LockResource
jmp 0x445f4d
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 8]
mov edx, dword [ebp - 8]
movzx edx, word [edx + 4]
mov eax, dword [ebp - 4]
call fcn.00446a88
jmp 0x445f4d
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0
jne 0x445eb5
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
push dword [eax + 4]
push dword [eax]
mov eax, dword [ebp - 4]
call fcn.0044665c
jmp 0x445f4d
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
push dword [eax + 4]
push dword [eax]
mov eax, dword [ebp - 4]
call fcn.004466b8
jmp 0x445f4d
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 1
jne 0x445ee7
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xb8]
mov edx, dword [ebp - 8]
mov dword [edx + 0xc], eax
jmp 0x445f4d
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 4]
mov dword [edx + 0xb8], eax
jmp 0x445f4d
mov edx, dword [ebp - 8]
mov edx, dword [edx + 4]
mov eax, dword [0x494cac]
mov eax, dword [eax]
call fcn.0045d684
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004457d8
push ebp
call fcn.00445844
pop ecx
jmp 0x445f4d
mov eax, dword [0x499c20]
call fcn.004449c4
push ebp
call fcn.00445844
pop ecx
jmp 0x445f4d
call fcn.00432228
call fcn.0043238c
jmp 0x445f4d
xor eax, eax
call fcn.0041f7b4
jmp 0x445f4d
push ebp
call fcn.00445844
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x445f6c
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret