Function at 0x41be28
Capabilities:
Extract resource via kernel32 functions
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 9
push 0
push 0
dec ecx
jne 0x41be31
xchg dword [ebp - 4], ecx
push ebx
push esi
mov byte [ebp - 6], cl
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x41c316
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 7], 0
mov byte [ebp - 0x1d], 0
mov eax, dword [0x42c488]
cmp dword [eax], 0
jbe 0x41c2ee
mov eax, dword [0x42c488]
mov eax, dword [eax]
dec eax
test eax, eax
jl 0x41c2ee
inc eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x14], 0
cmp byte [ebp - 5], 0
je 0x41be97
cmp dword [ebp - 4], 0xffffffff
jg 0x41c2e2
jmp 0x41bea1
cmp dword [ebp - 4], 0xffffffff
je 0x41c2e2
mov eax, dword [0x42c488]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x14]
mov eax, dword [eax + edx*4]
cmp eax, dword [ebp - 4]
jne 0x41c2e2
cmp byte [ebp - 0x1d], 0
jne 0x41bf1a
mov eax, dword [0x42c438]
cmp byte [eax], 0
je 0x41bf12
cmp byte [ebp - 6], 0
je 0x41bf02
mov eax, dword [0x42c3fc]
mov edx, 0x41c330
call fcn.00403280
call fcn.00401f8c
call fcn.00401350
mov eax, dword [0x42c3fc]
mov edx, 0x41c34c
call fcn.00403280
call fcn.00401f8c
call fcn.00401350
jmp 0x41bf12
cmp byte [ebp - 6], 0
je 0x41bf12
mov eax, 0x41c330
call fcn.00414abc
mov byte [ebp - 7], 1
mov byte [ebp - 0x1d], 1
mov dl, 1
mov eax, dword [0x416818]
call fcn.00402468
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x41c2db
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xa
mov eax, dword [ebp - 0x14]
inc eax
cdq
push edx
push eax
lea eax, [ebp - 0x2c]
call fcn.004066d8
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
mov edx, 0x41c368
call fcn.00402f44
mov eax, dword [ebp - 0x28]
call fcn.004030f0
push eax
mov eax, dword [0x42d67c]
push eax
call sub.kernel32.dll_FindResourceA
mov esi, eax
push esi
mov eax, dword [0x42d67c]
push eax
call sub.kernel32.dll_LoadResource
mov ebx, eax
test ebx, ebx
je 0x41bfaf
push ebx
call sub.kernel32.dll_LockResource
mov dword [ebp - 0x10], eax
push esi
mov eax, dword [0x42d67c]
push eax
call sub.kernel32.dll_SizeofResource
mov ecx, eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.00416c30
mov eax, ebx
call fcn.0040460c
push ebx
call sub.kernel32.dll_FreeResource
lea eax, [ebp - 0x18]
call fcn.00402ca4
mov eax, dword [0x42c488]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0x14]
cmp dword [eax + edx*4], 0
jne 0x41bff8
lea edx, [ebp - 0x34]
xor eax, eax
call fcn.00401558
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x30]
call fcn.004067d4
mov edx, dword [ebp - 0x30]
mov eax, dword [0x42c488]
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [eax + ecx*4]
lea eax, [ebp - 0x18]
call fcn.00402f44
jmp 0x41c047
mov eax, dword [0x42c488]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0x14]
mov eax, dword [eax + edx*4]
lea edx, [ebp - 0x18]
call fcn.0041b684
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0x18]
call fcn.00406550
mov edx, dword [ebp - 0x38]
lea eax, [ebp - 0x18]
call fcn.00402d3c
push dword [ebp - 0x18]
push 0x41c374
mov eax, dword [0x42c488]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x14]
push dword [eax + edx*4]
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00402fb8
mov eax, dword [ebp - 0x18]
call fcn.00406880
test al, al
je 0x41c10a
mov eax, dword [0x42c488]
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 0x14]
cmp byte [eax + edx], 0
je 0x41c099
push 0x34
mov eax, dword [0x42c488]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x14]
mov eax, dword [eax + edx*4]
call fcn.004030f0
mov ecx, eax
mov edx, 0x41c378
mov eax, dword [0x42c44c]
mov eax, dword [eax]
call fcn.004194f4
cmp eax, 7
je 0x41c2c5
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.00416e68
mov eax, dword [0x42c438]
cmp byte [eax], 0
jne 0x41c0d6
mov eax, dword [0x42c488]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x14]
mov edx, dword [eax + edx*4]
lea eax, [ebp - 0x3c]
mov ecx, 0x41c3b8
call fcn.00402f44
mov eax, dword [ebp - 0x3c]
call fcn.00414abc
jmp 0x41c176
mov eax, dword [0x42c488]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x14]
mov edx, dword [eax + edx*4]
lea eax, [ebp - 0x40]
mov ecx, 0x41c3b8
call fcn.00402f44
mov edx, dword [ebp - 0x40]
mov eax, dword [0x42c3fc]
call fcn.00403280
call fcn.00401f8c
call fcn.00401350
jmp 0x41c176
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.00416e68
mov eax, dword [0x42c438]
cmp byte [eax], 0
jne 0x41c144
mov eax, dword [0x42c488]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x14]
mov edx, dword [eax + edx*4]
lea eax, [ebp - 0x44]
mov ecx, 0x41c3b8
call fcn.00402f44
mov eax, dword [ebp - 0x44]
call fcn.00414abc
jmp 0x41c176
mov eax, dword [0x42c488]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x14]
mov edx, dword [eax + edx*4]
lea eax, [ebp - 0x48]
mov ecx, 0x41c3b8
call fcn.00402f44
mov edx, dword [ebp - 0x48]
mov eax, dword [0x42c3fc]
call fcn.00403280
call fcn.00401f8c
call fcn.00401350
mov eax, dword [0x42c488]
mov eax, dword [eax + 0x1c]
mov edx, dword [ebp - 0x14]
mov ebx, dword [eax + edx*4]
test ebx, ebx
jle 0x41c287
mov eax, dword [0x42c488]
push ebx
mov eax, dword [ebp - 0x18]
call fcn.004030f0
push eax
call sub.kernel32.dll_SetFileAttributesA
test eax, eax
je 0x41c287
mov eax, dword [0x42c488]
mov eax, dword [eax + 0x1c]
mov edx, dword [ebp - 0x14]
mov eax, dword [eax + edx*4]
cmp eax, 7
ja case.0x41c1bf.0
jmp dword [eax*4 + 0x41c1c6]
lea eax, [ebp - 0x1c]
mov edx, 0x41c3cc
call fcn.00402d3c
jmp case.0x41c1bf.0
lea eax, [ebp - 0x1c]
mov edx, 0x41c3e4
call fcn.00402d3c
jmp case.0x41c1bf.0
lea eax, [ebp - 0x1c]
mov edx, 0x41c3f8
call fcn.00402d3c
jmp case.0x41c1bf.0
lea eax, [ebp - 0x1c]
mov edx, 0x41c418
call fcn.00402d3c
jmp case.0x41c1bf.0
lea eax, [ebp - 0x1c]
mov edx, 0x41c42c
call fcn.00402d3c
jmp case.0x41c1bf.0
lea eax, [ebp - 0x1c]
mov edx, 0x41c44c
call fcn.00402d3c
jmp case.0x41c1bf.0
lea eax, [ebp - 0x1c]
mov edx, 0x41c46c
call fcn.00402d3c
mov eax, dword [0x42c438]
cmp byte [eax], 0
je 0x41c287
mov eax, dword [0x42c488]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x14]
mov edx, dword [eax + edx*4]
lea eax, [ebp - 0x4c]
mov ecx, dword [ebp - 0x1c]
call fcn.00402f44
mov edx, dword [ebp - 0x4c]
mov eax, dword [0x42c3fc]
call fcn.00403280
call fcn.00401f8c
call fcn.00401350
mov eax, dword [0x42c488]
mov eax, dword [eax + 0x14]
mov edx, dword [ebp - 0x14]
cmp byte [eax + edx], 0
je 0x41c2c5
push 1
push 0
mov eax, dword [0x42c488]
mov eax, dword [eax + 0x18]
mov edx, dword [ebp - 0x14]
mov eax, dword [eax + edx*4]
call fcn.004030f0
push eax
mov eax, dword [ebp - 0x18]
call fcn.004030f0
push eax
push 0x41c48c
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41c2e2
mov eax, dword [ebp - 0xc]
call fcn.00402498
ret
inc dword [ebp - 0x14]
dec dword [ebp - 0x24]
jne 0x41be85
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41c31d
lea eax, [ebp - 0x4c]
mov edx, 0xa
call fcn.00402cc8
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00402cc8
ret