Function at 0x401be0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401bf9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x401c0d
pop esi
pop edi
xor eax, eax
pop ebx
ret
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x401c2e
cmp esi, eax
jae 0x401c07
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401c20
cmp esi, eax
jae 0x401c07
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x407eab
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x43ac70
call fcn.0040a254
mov edi, 0x94
mov eax, edi
call fcn.004085e0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x449090], ecx
mov eax, dword [esi + 4]
mov dword [0x44909c], eax
mov edx, dword [esi + 8]
mov dword [0x4490a0], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x449094], esi
cmp ecx, 2
je 0x407f0b
or esi, 0x8000
mov dword [0x449094], esi
shl eax, 8
add eax, edx
mov dword [0x449098], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x407f46
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x407f46
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x407f5e
cmp eax, 0x20b
je 0x407f4b
mov dword [ebp - 0x1c], esi
jmp 0x407f72
cmp dword [ecx + 0x84], 0xe
jbe 0x407f46
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x407f6c
cmp dword [ecx + 0x74], 0xe
jbe 0x407f46
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.0040cd36
pop ecx
test eax, eax
jne 0x407f86
push 0x1c
call fcn.00407e87
pop ecx
call fcn.0040a754
test eax, eax
jne 0x407f97
push 0x10
call fcn.00407e87
pop ecx
call fcn.0040e310
mov dword [ebp - 4], esi
call fcn.0040e112
test eax, eax
jge 0x407fb0
push 0x1b
call fcn.00407e62
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x44a9f0], eax
call fcn.0040dff0
mov dword [0x449080], eax
call fcn.0040df4e
test eax, eax
jge 0x407fd6
push 8
call fcn.00407e62
pop ecx
call fcn.0040dd1b
test eax, eax
jge 0x407fe7
push 9
call fcn.00407e62
pop ecx
call fcn.00408c4e
mov dword [ebp - 0x20], eax
cmp eax, esi
je 0x407ffa
push eax
call fcn.00407e62
pop ecx
mov dword [ebp - 0x38], esi
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.0040dcb2
mov dword [ebp - 0x68], eax
test byte [ebp - 0x38], 1
je 0x40801b
movzx eax, word [ebp - 0x34]
jmp 0x40801e
push 0xa
pop eax
push eax
push dword [ebp - 0x68]
push esi
push esi
call edi
push eax
call fcn.00414d50
mov edi, eax
mov dword [ebp - 0x6c], edi
cmp dword [ebp - 0x1c], esi
jne 0x40803c
push edi
call fcn.00408d86
call fcn.00408da8
jmp 0x40806e
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.0040a28f
ret