Function at 0x48c9b0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00405a64
xor eax, eax
push ebp
push 0x48cc35
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0048c9a4
test al, al
je 0x48ca0e
lea edx, [ebp - 0x28]
xor eax, eax
call fcn.004037b4
mov edx, dword [ebp - 0x28]
mov eax, ebx
mov ecx, dword [ebp - 4]
call fcn.004058fc
jmp 0x48cc0a
push 0xa
push 0x48cc48
mov eax, dword [0x5867f8]
push eax
call sub.kernel32.dll_FindResourceA
mov esi, eax
push esi
mov eax, dword [0x5867f8]
push eax
call sub.kernel32.dll_LoadResource
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_LockResource
mov edi, eax
push esi
mov eax, dword [0x5867f8]
push eax
call sub.kernel32.dll_SizeofResource
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
call fcn.0040320c
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
mov eax, edi
mov ecx, dword [ebp - 0x14]
call fcn.004035b8
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_FreeResource
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x3c]
add eax, dword [ebp - 0x18]
mov edx, eax
add edx, 0xf8
mov dword [ebp - 0x1c], edx
mov edx, dword [ebp - 8]
mov dword [eax + 0x34], edx
mov edx, dword [eax + 0x50]
cmp edx, dword [ebp - 0xc]
jae 0x48caa6
mov ecx, dword [ebp - 0xc]
sub ecx, edx
mov edx, ecx
add dword [eax + 0x50], edx
movzx eax, word [eax + 6]
lea eax, [eax + eax*4]
mov ecx, dword [ebp - 0x1c]
add dword [ecx + eax*8 - 0x20], edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ebx
xor eax, eax
call fcn.004037b4
mov eax, dword [ebx]
mov dword [ebp - 0x2c], eax
mov esi, dword [ebp - 0x2c]
test esi, esi
je 0x48caf4
sub esi, 4
mov esi, dword [esi]
lea eax, [ebp - 0x30]
push eax
mov ecx, esi
sub ecx, 4
mov eax, dword [ebx]
mov edx, 1
call fcn.00405adc
mov edx, dword [ebp - 0x30]
mov eax, ebx
mov ecx, 0x48cc5c
call fcn.004058fc
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp esi, 0xa
jae 0x48cbf8
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebx]
call fcn.00405a74
push eax
call sub.kernel32.dll_CreateFileA_1
mov edi, eax
test edi, edi
jge 0x48cbd3
mov eax, dword [ebx]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x48cb96
mov eax, dword [ebp - 0x24]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x34]
push eax
mov ecx, dword [ebp - 0x24]
sub ecx, 3
mov eax, dword [ebx]
mov edx, 1
call fcn.00405adc
push dword [ebp - 0x34]
push 0x48cc6c
lea eax, [ebp - 0x38]
mov edx, esi
add dl, 0x30
call fcn.004057cc
push dword [ebp - 0x38]
mov eax, ebx
mov edx, 3
call fcn.00405978
inc esi
jmp 0x48cbef
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push edi
call sub.kernel32.dll_WriteFile_1
push edi
call sub.kernel32.dll_CloseHandle_1
jmp 0x48cbf8
cmp esi, 0xa
jb 0x48cb41
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.004058b0
mov eax, dword [ebp - 0x18]
call fcn.00403228
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48cc3c
lea eax, [ebp - 0x38]
mov edx, 3
call fcn.00405608
lea eax, [ebp - 0x28]
call fcn.004055e4
lea eax, [ebp - 4]
call fcn.004055e4
ret