Function at 0x4043aa
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x498
add byte [eax], al
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x284], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x284], eax
push 0x2348
push 0x68
mov eax, dword [ebp - 0x284]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0
jne 0x4043fc
xor eax, eax
jmp 0x404671
mov ecx, dword [ebp - 0x234]
push ecx
mov edx, dword [ebp - 0x284]
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x404420
xor eax, eax
jmp 0x404671
je 0x404425
jne 0x404425
jmp 0x4043b1
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x40443f
xor eax, eax
jmp 0x404671
mov ecx, dword [ebp - 0x234]
push ecx
mov edx, dword [ebp - 0x284]
push edx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x24]
push eax
call fcn.00409710
add esp, 4
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.0040a77c
add esp, 4
mov dword [ebp - 0x490], eax
mov edx, dword [ebp - 0x490]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x24]
push eax
call fcn.00409690
add esp, 0x10
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x48c]
push ecx
push 0x200
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edx, [ebp - 0x48c]
push edx
call fcn.0040a910
add esp, 4
mov dword [ebp - 0x27c], eax
mov eax, dword [ebp - 0x27c]
movsx ecx, byte [ebp + eax - 0x48d]
cmp ecx, 0x5c
je 0x4044e7
push 0x417770
lea edx, [ebp - 0x48c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.yztapp.exe
lea eax, [ebp - 0x48c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.00404385
add esp, 4
push 0
push 0
push 2
push 0
push 0
push 0xc0000000
lea edx, [ebp - 0x48c]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 0xffffffff
jne 0x404564
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x494], eax
mov ecx, dword [ebp - 0x494]
push ecx
call fcn.0040a771
add esp, 4
lea edx, [ebp - 0x48c]
push edx
call fcn.0040432e
add esp, 4
test eax, eax
jne 0x404562
xor eax, eax
jmp 0x404671
jmp 0x4045af
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x280]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40458a
xor eax, eax
jmp 0x404671
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x498], ecx
mov edx, dword [ebp - 0x498]
push edx
call fcn.0040a771
add esp, 4
mov eax, dword [ebp - 0x280]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x104
lea ecx, [ebp - 0x230]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call sub.PSAPI.DLL_GetModuleFileNameExA
push 0x417780
lea edx, [ebp - 0x48c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x48c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x417784
lea edx, [ebp - 0x48c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x44
push 0
lea eax, [ebp - 0x278]
push eax
call fcn.0040a790
add esp, 0xc
mov dword [ebp - 0x278], 0x44
push 0x10
push 0
lea ecx, [ebp - 0x10]
push ecx
call fcn.0040a790
add esp, 0xc
mov word [ebp - 0x248], 5
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x278]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x48c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40466c
xor eax, eax
jmp 0x404671
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret