Function at 0x404684
Capabilities:
Create process on windows
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x14c
mov dword [esp + 8], str.zzzzzzzz
mov dword [esp + 4], 0
mov dword [esp], 0x1f0001
call sub.KERNEL32.dll_OpenMutexA
sub esp, 0xc
test eax, eax
je 0x4046c0
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret 0x10
mov dword [esp + 8], str.zzzzzzzz
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.KERNEL32.dll_CreateMutexA
sub esp, 0xc
xor ebx, ebx
lea esi, [esi]
mov dword [esp + 4], 0xc
mov dword [esp], 0
call sub.KERNEL32.dll_LocalAlloc
sub esp, 8
inc ebx
cmp ebx, 0x14508
jne 0x4046e4
xor ebx, ebx
nop
mov dword [esp + 4], 0xc
mov dword [esp], 0
call sub.KERNEL32.dll_LocalAlloc
sub esp, 8
inc ebx
cmp ebx, 0x14508
jne 0x404708
xor ebx, ebx
nop
mov dword [esp + 4], 0xc
mov dword [esp], 0
call sub.KERNEL32.dll_LocalAlloc
sub esp, 8
inc ebx
cmp ebx, 0x14508
jne 0x40472c
xor ebx, ebx
nop
mov dword [esp + 4], 0xc
mov dword [esp], 0
call sub.KERNEL32.dll_LocalAlloc
sub esp, 8
inc ebx
cmp ebx, 0x14508
jne 0x404750
xor ebx, ebx
nop
mov dword [esp + 4], 0xc
mov dword [esp], 0
call sub.KERNEL32.dll_LocalAlloc
sub esp, 8
inc ebx
cmp ebx, 0x14508
jne 0x404774
xor ebx, ebx
nop
mov dword [esp + 4], 0xc
mov dword [esp], 0
call sub.KERNEL32.dll_LocalAlloc
sub esp, 8
inc ebx
cmp ebx, 0x14508
jne 0x404798
xor ebx, ebx
nop
mov dword [esp + 4], 0xc
mov dword [esp], 0
call sub.KERNEL32.dll_LocalAlloc
sub esp, 8
inc ebx
cmp ebx, 0x14508
jne 0x4047bc
xor ebx, ebx
nop
mov dword [esp + 4], 0xc
mov dword [esp], 0
call sub.KERNEL32.dll_LocalAlloc
sub esp, 8
inc ebx
cmp ebx, 0x14508
jne 0x4047e0
xor ebx, ebx
nop
mov dword [esp + 4], 0xc
mov dword [esp], 0
call sub.KERNEL32.dll_LocalAlloc
sub esp, 8
inc ebx
cmp ebx, 0x14508
jne 0x404804
xor ebx, ebx
nop
mov dword [esp + 4], 0xc
mov dword [esp], 0
call sub.KERNEL32.dll_LocalAlloc
sub esp, 8
inc ebx
cmp ebx, 0x14508
jne 0x404828
xor ebx, ebx
nop
mov dword [esp + 4], 0xc
mov dword [esp], 0
call sub.KERNEL32.dll_LocalAlloc
sub esp, 8
inc ebx
cmp ebx, 0x14508
jne 0x40484c
xor ebx, ebx
nop
mov dword [esp + 4], 0xc
mov dword [esp], 0
call sub.KERNEL32.dll_LocalAlloc
sub esp, 8
inc ebx
cmp ebx, 0x14508
jne 0x404870
xor ebx, ebx
nop
mov dword [esp + 4], 0xc
mov dword [esp], 0
call sub.KERNEL32.dll_LocalAlloc
sub esp, 8
inc ebx
cmp ebx, 0x14508
jne 0x404894
xor ebx, ebx
nop
mov dword [esp + 4], 0xc
mov dword [esp], 0
call sub.KERNEL32.dll_LocalAlloc
sub esp, 8
inc ebx
cmp ebx, 0x14508
jne 0x4048b8
xor ebx, ebx
nop
mov dword [esp + 4], 0xc
mov dword [esp], 0
call sub.KERNEL32.dll_LocalAlloc
sub esp, 8
inc ebx
cmp ebx, 0x14508
jne 0x4048dc
xor ebx, ebx
nop
mov dword [esp + 4], 0xc
mov dword [esp], 0
call sub.KERNEL32.dll_LocalAlloc
sub esp, 8
inc ebx
cmp ebx, 0x14508
jne 0x404900
xor ebx, ebx
nop
mov dword [esp + 4], 0xc
mov dword [esp], 0
call sub.KERNEL32.dll_LocalAlloc
sub esp, 8
inc ebx
cmp ebx, 0x14508
jne 0x404924
xor ebx, ebx
nop
mov dword [esp + 4], 0xc
mov dword [esp], 0
call sub.KERNEL32.dll_LocalAlloc
sub esp, 8
inc ebx
cmp ebx, 0x14508
jne 0x404948
xor ebx, ebx
nop
mov dword [esp + 4], 0xc
mov dword [esp], 0
call sub.KERNEL32.dll_LocalAlloc
sub esp, 8
inc ebx
cmp ebx, 0x14508
jne 0x40496c
xor ebx, ebx
nop
mov dword [esp + 4], 0xc
mov dword [esp], 0
call sub.KERNEL32.dll_LocalAlloc
sub esp, 8
inc ebx
cmp ebx, 0x14508
jne 0x404990
xor ebx, ebx
nop
mov dword [esp + 4], 0xc
mov dword [esp], 0
call sub.KERNEL32.dll_LocalAlloc
sub esp, 8
inc ebx
cmp ebx, 0x14508
jne 0x4049b4
xor ebx, ebx
nop
mov dword [esp + 4], 0xc
mov dword [esp], 0
call sub.KERNEL32.dll_LocalAlloc
sub esp, 8
inc ebx
cmp ebx, 0x14508
jne 0x4049d8
xor ebx, ebx
nop
mov dword [esp + 4], 0xc
mov dword [esp], 0
call sub.KERNEL32.dll_LocalAlloc
sub esp, 8
jmp loc.004898a8