Function at 0x45db80
Capabilities:
Extract resource via kernel32 functions
Query environment variable
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb8
mov eax, dword [0x70e00c]
xor eax, ebp
mov dword [ebp - 4], eax
xorps xmm0, xmm0
mov byte [ebp - 0x24], 0
movups xmmword [ebp - 0x23], xmm0
xor eax, eax
cmp dword [0x72c7bc], 0x40
movq qword [ebp - 0x13], xmm0
movups xmm0, xmmword [str._0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ]
push esi
sete al
mov dword [ebp - 0xb], 0
movups xmmword [ebp - 0x64], xmm0
push 0x6ea0a0
movups xmm0, xmmword [0x6ea070]
add eax, 0x81
mov word [ebp - 7], 0
push eax
movups xmmword [ebp - 0x54], xmm0
push 0
movups xmm0, xmmword [0x6ea080]
mov byte [ebp - 5], 0
mov dword [ebp - 0xac], 0
movups xmmword [ebp - 0x44], xmm0
movups xmm0, xmmword [0x6ea090]
movups xmmword [ebp - 0x34], xmm0
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
mov esi, eax
test esi, esi
jne 0x45dc22
lea eax, [esi - 2]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aa758
mov esp, ebp
pop ebp
ret
push ebx
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov ebx, eax
mov dword [ebp - 0xb0], ebx
test ebx, ebx
jne 0x45dc4b
lea eax, [ebx - 0xc]
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aa758
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov dword [ebp - 0xb8], eax
test eax, eax
jne 0x45dc78
push ebx
call dword [sym.imp.KERNEL32.DLL_FreeResource]
pop ebx
mov eax, 0xffffffe4
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aa758
mov esp, ebp
pop ebp
ret
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
push 0x104
push 0x746390
push str._SystemRoot_System32drivers
mov dword [ebp - 0xb4], eax
call dword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsA]
mov dword [ebp - 0xa8], eax
test eax, eax
je 0x45de48
cmp eax, 0x104
ja 0x45de48
push edi
push 0
call fcn.0061a074
push eax
call fcn.00619ebe
add esp, 8
call fcn.00619e9d
mov edi, eax
and edi, reloc.WS2_32.dll_getsockopt
jns 0x45dcda
dec edi
or edi, 0xfffffff8
inc edi
add edi, 8
xor esi, esi
test edi, edi
jle 0x45dd01
call fcn.00619e9d
and eax, 0x3f
mov al, byte [ebp + eax - 0x64]
mov byte [ebp + esi - 0x24], al
inc esi
cmp esi, edi
jl 0x45dce3
cmp esi, 0x20
jae 0x45de64
mov byte [ebp + esi - 0x24], 0
add esi, esi
cmp esi, 0x40
jae 0x45de64
mov edx, 0x746390
lea edi, [edx - 1]
nop dword [eax]
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x45dd20
mov ax, word [0x6e9fec]
lea ebx, [ebp - 0x24]
mov word [edi], ax
mov esi, ebx
mov al, byte [ebx]
inc ebx
test al, al
jne 0x45dd38
sub ebx, esi
lea edi, [edx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x45dd44
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
dec edx
rep movsb byte es:[edi], byte [esi]
nop dword [eax + eax]
mov al, byte [edx + 1]
lea edx, [edx + 1]
test al, al
jne 0x45dd60
mov eax, dword [str..sys]
mov dword [edx], eax
mov al, byte [0x6ea0cc]
mov byte [edx + 4], al
lea eax, [ebp - 0xac]
push eax
call fcn.00404160
add esp, 4
mov esi, eax
push 0
push 0x80
push 1
push 0
push 0
push 0x40000000
push 0x746390
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov edi, eax
test esi, esi
je 0x45ddbb
push dword [ebp - 0xac]
call fcn.004041c0
add esp, 4
cmp edi, 0xffffffff
jne 0x45dde2
push dword [ebp - 0xb0]
call dword [sym.imp.KERNEL32.DLL_FreeResource]
pop edi
pop ebx
mov eax, 0xfffffffb
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aa758
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 0xa8]
push eax
push dword [ebp - 0xb4]
push dword [ebp - 0xb8]
push edi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov ecx, dword [ebp - 0xa8]
test eax, eax
mov edx, 0xfffffff3
cmove ecx, edx
push edi
mov dword [ebp - 0xa8], ecx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push dword [ebp - 0xb0]
call dword [sym.imp.KERNEL32.DLL_FreeResource]
mov eax, dword [ebp - 0xa8]
pop edi
pop ebx
mov dword [0x746380], 0x746390
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aa758
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.KERNEL32.DLL_FreeResource]
mov ecx, dword [ebp - 4]
mov eax, 0xffffffe9
pop ebx
xor ecx, ebp
pop esi
call fcn.004aa758
mov esp, ebp
pop ebp
ret
call fcn.004aaf06
int3