Function at 0x487450
Capabilities:
Check os version
Create thread
Extract resource via kernel32 functions
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x244
mov eax, dword [0x5bd344]
xor eax, esp
mov dword [esp + 0x240], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0x10], edi
mov dword [0x5f0394], edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
movzx eax, ax
movzx ecx, al
shl cx, 8
shr ax, 8
push 0x5e97f8
or cx, ax
push 0x104
mov word [0x5f02ec], cx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x104
lea eax, [esp + 0x44]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 0x8001
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x487330
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov eax, 0x500
cmp word [0x5f02ec], ax
jae 0x487536
push 0
push 0
lea eax, [esp + 0x14]
push eax
push 0x400
push 0x47e
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push 0x30
push 0x41f730
push dword [esp + 0x14]
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x487876
call fcn.004730d0
mov dword [0x5e9fb8], eax
call fcn.00467330
call fcn.00480520
call fcn.00481950
call fcn.00481b30
mov ecx, 0x5e8d50
call fcn.00481cd0
call fcn.004814c0
call fcn.00473080
cmp dword [0x5e97e8], 0
je 0x48757d
xor ecx, ecx
call fcn.00458f80
jmp 0x487876
cmp dword [0x5e9fb8], 0
mov esi, dword [sym.imp.SHLWAPI.dll_StrCatW]
je 0x487598
push 0x41f74c
push str.Notepad2
call esi
cmp dword [0x5e9b80], 0
je 0x4875ad
push 0x41d154
push str.Notepad2
call esi
call fcn.00483e30
test eax, eax
jne 0x487876
call fcn.00483c30
test eax, eax
jne 0x487876
call fcn.00483660
test eax, eax
jne 0x487876
push eax
call dword [sym.imp.ole32.dll_OleInitialize]
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 8
push eax
mov dword [esp + 0x1c], 0x6ff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push 0x41f750
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
push 0x41f3f4
mov dword [0x5e9b7c], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, edi
mov dword [0x5e8f7c], eax
call fcn.00497360
call fcn.0047eb60
movaps xmm0, xmmword [0x44de50]
lea ecx, [esp + 0x1c]
xor esi, esi
mov dword [esp + 0x3c], 9
movups xmmword [esp + 0x1c], xmm0
mov dword [esp + 0xc], ecx
movaps xmm0, xmmword [0x44de80]
movups xmmword [esp + 0x2c], xmm0
lea ebx, [esi - 3]
nop
xor eax, eax
test esi, esi
js 0x487683
mov edi, ecx
test eax, eax
je 0x487670
cmp eax, esi
je 0x487670
lea ecx, [ebx + eax]
mov ecx, dword [esp + ecx*4 + 0x18]
lea edx, [ebx + eax]
add ecx, dword [esp + edx*4 + 0x1c]
jmp 0x487675
mov ecx, 1
mov dword [edi], ecx
inc eax
add edi, 4
cmp eax, esi
jle 0x487658
mov ecx, dword [esp + 0xc]
add ecx, 0xc
add ebx, 3
inc esi
mov dword [esp + 0xc], ecx
cmp ebx, 6
jl 0x487650
mov ebx, dword [esp + 0x10]
push ebx
call fcn.0054616e
add esp, 4
push 0x420c84
push 0x1170
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x4876f3
push esi
call fcn.005436a1
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4876ec
push esi
call fcn.005436a1
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x4876ec
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
call fcn.00546391
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
push dword [ebp + 0x14]
call fcn.00486780
add esp, 4
test eax, eax
je 0x487876
mov esi, dword [sym.imp.USER32.dll_LoadAcceleratorsW]
push 0x64
push ebx
call esi
push 0x65
push ebx
call esi
push 0
push 0
push 0
push 0x486400
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.005450d6
push 0xca8
call fcn.0057eb4e
add esp, 4
push 0xca8
push eax
call fcn.0057eb7e
mov ax, word [0x5eaff4]
xor ecx, ecx
mov edi, dword [sym.imp.USER32.dll_UnregisterClassW]
add esp, 8
cmp cx, ax
je 0x487779
push dword [0x5eaffc]
movzx eax, ax
push eax
call edi
xor eax, eax
mov word [0x5eaff4], ax
mov ax, word [0x5eaff8]
xor ecx, ecx
cmp cx, ax
je 0x48779a
push dword [0x5eaffc]
movzx eax, ax
push eax
call edi
xor eax, eax
mov word [0x5eaff8], ax
mov ecx, dword [0x5eb00c]
test ecx, ecx
je 0x4877b4
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [0x5eb00c], 0
mov ecx, dword [0x5eb004]
test ecx, ecx
je 0x4877ce
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [0x5eb004], 0
mov ecx, dword [0x5eb008]
test ecx, ecx
je 0x4877e8
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [0x5eb008], 0
mov ecx, dword [0x5eb000]
test ecx, ecx
je 0x487802
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [0x5eb000], 0
mov eax, dword [0x5ec948]
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
test eax, eax
je 0x48781e
push eax
call esi
mov dword [0x5ec948], 0
mov eax, dword [0x5ec924]
test eax, eax
je 0x487834
push eax
call esi
mov dword [0x5ec924], 0
mov eax, dword [0x5ec920]
test eax, eax
je 0x487844
push eax
call dword [sym.imp.USER32.dll_DestroyCursor]
push dword [0x5ec91c]
push 0x4175e0
call edi
push 0x5ec928
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push ebx
push str.Notepad2
call edi
mov eax, dword [0x5e8f7c]
test eax, eax
je 0x487870
push eax
call esi
call dword [sym.imp.ole32.dll_OleUninitialize]
mov ecx, dword [esp + 0x24c]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0057e93d
mov esp, ebp
pop ebp
ret 0x10