Function at 0x405dd0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x208
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x4083a0
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
lea esi, [ebp + 0x10]
movzx eax, word [ebp + 8]
push dword [ebp + 0xc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x405ea9
mov ebx, eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x405f11
mov dword [ebp - 0x60], eax
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x406216
mov dword [ebp - 0x50], eax
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x40627e
mov dword [ebp - 0x4c], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x20], esi
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x48], ecx
mov edx, 0x405cc766
mov ecx, 0x543c3cb3
nop dword [eax]
cmp edx, 0x289b0054
je 0x405f79
cmp edx, 0x543c3cb3
je 0x405e9d
cmp edx, 0x405cc766
jne 0x405e70
cmp dword [eax + 0x1c], 0xf
mov edx, 0x289b0054
cmova edx, ecx
mov edi, dword [ebp - 0x48]
jmp 0x405e70
mov edx, dword [ebp - 0x20]
mov edi, dword [edx]
mov edx, 0x289b0054
jmp 0x405e70
push str.JNVFSKJV
call fcn.004063f0
add esp, 4
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x214]
push 0xe
push eax
call fcn.004013c0
add esp, 8
lea ecx, [ebp - 0x214]
call fcn.00406460
lea eax, [ebp - 0x1fc]
push 0x16
push eax
call fcn.004013c0
add esp, 8
lea ecx, [ebp - 0x1fc]
call fcn.00406460
lea eax, [ebp - 0x1e4]
push 0x26
push eax
call fcn.004013c0
add esp, 8
lea ecx, [ebp - 0x1e4]
jmp 0x4063a8
push str.zBJNJJSK
call fcn.004063f0
add esp, 4
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x1cc]
push 0x13
push eax
call fcn.004013c0
add esp, 8
lea ecx, [ebp - 0x1cc]
call fcn.00406460
lea eax, [ebp - 0x1b4]
push 0x39
push eax
call fcn.004013c0
add esp, 8
lea ecx, [ebp - 0x1b4]
call fcn.00406460
lea eax, [ebp - 0x19c]
push 0x56
push eax
call fcn.004013c0
add esp, 8
lea ecx, [ebp - 0x19c]
jmp 0x4063a8
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x20], esi
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x48], edx
mov esi, 0x405cc766
nop word [eax + eax]
cmp esi, 0x289b0054
je 0x405fd0
cmp esi, 0x543c3cb3
je 0x405fc1
cmp esi, 0x405cc766
jne 0x405f90
cmp dword [eax + 0x1c], 0xf
mov esi, 0x289b0054
mov edx, 0x543c3cb3
cmova esi, edx
mov edx, dword [ebp - 0x48]
mov dword [ebp - 0x28], edx
jmp 0x405f90
mov esi, dword [ebp - 0x20]
mov esi, dword [esi]
mov dword [ebp - 0x28], esi
mov esi, 0x289b0054
jmp 0x405f90
add edi, ecx
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x34], 0xf
mov dword [ebp - 0x38], 0
mov byte [ebp - 0x48], 0
sub edi, dword [ebp - 0x28]
mov eax, 0xcddc7f3d
mov ecx, 0x8aebd29
cmove ecx, eax
mov dword [ebp - 0x5c], ecx
mov eax, 0x948dc8c9
lea ecx, [ebp - 0x48]
nop word cs:[eax + eax]
cmp eax, 0x948dc8c9
je 0x40612e
cmp eax, 0xcddc7f3d
je 0x406140
cmp eax, 0x8aebd29
jne 0x406010
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x64], eax
mov edx, 0x2754b97c
nop
cmp edx, 0x2754b97b
jg 0x406060
cmp edx, 0x9d3c801c
je 0x406084
cmp edx, 0x13d68678
jne 0x406040
jmp 0x406136
cmp edx, 0x5c04b1de
je 0x4060bd
cmp edx, 0x2754b97c
jne 0x406040
mov eax, dword [ebp - 0x64]
cmp eax, edi
mov edx, 0x5c04b1de
mov eax, 0x9d3c801c
cmovb edx, eax
jmp 0x406040
mov dword [ebp - 0x10], 0
sub esp, 0xc
mov al, byte [ebp - 0x2c]
mov byte [esp + 4], al
mov eax, dword [ebp - 0x28]
mov dword [esp + 8], eax
mov dword [esp], edi
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], edi
call fcn.004065c0
mov edx, 0x13d68678
lea ecx, [ebp - 0x48]
mov edi, dword [ebp - 0x54]
mov ebx, dword [ebp - 0x58]
jmp 0x406040
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x20], ecx
mov ecx, 0x405cc766
nop
cmp ecx, 0x289b0054
je 0x40610a
cmp ecx, 0x543c3cb3
je 0x4060fe
cmp ecx, 0x405cc766
jne 0x4060d0
cmp dword [eax + 0x14], 0xf
mov ecx, 0x289b0054
mov edx, 0x543c3cb3
cmova ecx, edx
mov esi, dword [ebp - 0x20]
jmp 0x4060d0
mov ecx, dword [ebp - 0x24]
mov esi, dword [ecx]
mov ecx, 0x289b0054
jmp 0x4060d0
mov eax, dword [ebp - 0x30]
mov dword [eax + 0x10], edi
push edi
push dword [ebp - 0x28]
push esi
call fcn.0040a110
add esp, 0xc
mov byte [esi + edi], 0
mov edx, 0x13d68678
lea ecx, [ebp - 0x48]
jmp 0x406040
mov eax, dword [ebp - 0x5c]
jmp 0x406010
mov eax, 0xcddc7f3d
jmp 0x406010
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x34], 0xf
mov ecx, 0xc706ac1
mov eax, 0x30343b2c
cmova eax, ecx
mov edx, 0xd04c4db5
nop
cmp edx, 0x30343b2c
je 0x40618b
cmp edx, 0xc706ac1
je 0x40617f
cmp edx, 0xd04c4db5
jne 0x406160
mov ecx, dword [ebp - 0x20]
mov edx, eax
jmp 0x406160
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ecx]
mov edx, 0x30343b2c
jmp 0x406160
sub esp, 0x1c
movaps xmm0, xmmword [0x41c080]
movups xmmword [esp + 4], xmm0
mov dword [esp], ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
lea edi, [ebp - 0x48]
mov ecx, edi
call fcn.00406460
test esi, esi
je 0x4062e6
mov dword [ebp - 0x48], 0
push 0
push edi
push dword [ebp - 0x60]
push dword [ebp - 0x4c]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
sete cl
mov edi, dword [ebp - 0x48]
test edi, edi
sete dl
or edi, eax
je 0x40634b
xor cl, dl
jne 0x40634b
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call edi
push dword [ebp - 0x50]
call edi
push ebx
call edi
mov esi, 1
jmp 0x4063af
push str.SOIJVIUS
call fcn.004063f0
add esp, 4
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x184]
push 0x5c
push eax
call fcn.004013c0
add esp, 8
lea ecx, [ebp - 0x184]
call fcn.00406460
lea eax, [ebp - 0x16c]
push 0x22
push eax
call fcn.004013c0
add esp, 8
lea ecx, [ebp - 0x16c]
call fcn.00406460
lea eax, [ebp - 0x154]
push 0x15
push eax
call fcn.004013c0
add esp, 8
lea ecx, [ebp - 0x154]
jmp 0x4063a8
push str.BOUNIUDS
call fcn.004063f0
add esp, 4
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x13c]
push 0x2f
push eax
call fcn.004013c0
add esp, 8
lea ecx, [ebp - 0x13c]
call fcn.00406460
lea eax, [ebp - 0x124]
push 0x3b
push eax
call fcn.004013c0
add esp, 8
lea ecx, [ebp - 0x124]
call fcn.00406460
lea eax, [ebp - 0x10c]
push 0x40
push eax
call fcn.004013c0
add esp, 8
lea ecx, [ebp - 0x10c]
jmp 0x4063a8
push str.BOIFDNI
call fcn.004063f0
add esp, 4
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0xf4]
push 0x4e
push eax
call fcn.004013c0
add esp, 8
lea ecx, [ebp - 0xf4]
call fcn.00406460
lea eax, [ebp - 0xdc]
push 0x19
push eax
call fcn.004013c0
add esp, 8
lea ecx, [ebp - 0xdc]
call fcn.00406460
lea eax, [ebp - 0xc4]
push 0x29
push eax
call fcn.004013c0
add esp, 8
lea ecx, [ebp - 0xc4]
jmp 0x4063a8
push str.IUWBNVW
call fcn.004063f0
add esp, 4
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0xac]
push 0x5f
push eax
call fcn.004013c0
add esp, 8
lea ecx, [ebp - 0xac]
call fcn.00406460
lea eax, [ebp - 0x94]
push 0x2a
push eax
call fcn.004013c0
add esp, 8
lea ecx, [ebp - 0x94]
call fcn.00406460
lea eax, [ebp - 0x7c]
push 0xf
push eax
call fcn.004013c0
add esp, 8
lea ecx, [ebp - 0x7c]
call fcn.00406460
xor esi, esi
lea ecx, [ebp + 0x10]
call fcn.00406460
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x208
pop esi
pop edi
pop ebx
pop ebp
ret