Function at 0x4620b0
Capabilities:
Check if file exists
Delete file
Extract resource via kernel32 functions
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x592ded
mov eax, dword fs:[0]
push eax
mov eax, 0x1238
call fcn.00555270
mov eax, dword [0x5deba8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4620fb
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x462102
xor al, al
jmp 0x462d28
push 0
push 0x80
push 3
push 0
push 1
push SHChangeNotifyDeregister
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x1034], eax
cmp dword [ebp - 0x1034], 0xffffffff
jne 0x4621a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1124], eax
lea ecx, [ebp - 0x1128]
call fcn.0041d970
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x1124]
push eax
push 0x5b1228
lea ecx, [ebp - 0x1128]
push ecx
call fcn.00423c30
add esp, 0xc
push 0
push 0x5b1248
lea ecx, [ebp - 0x1128]
call fcn.0041e1e0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov byte [ebp - 0x11f5], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1128]
call fcn.0041dab0
mov al, byte [ebp - 0x11f5]
jmp 0x462d28
push 0
lea edx, [ebp - 0x1120]
push edx
push 0x40
lea eax, [ebp - 0x1014]
push eax
mov ecx, dword [ebp - 0x1034]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4621e9
push 0x5b1250
call fcn.005726f5
add esp, 4
mov edx, dword [ebp - 0x1034]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x462d28
movzx eax, word [ebp - 0x1014]
cmp eax, 0x5a4d
je 0x46220b
mov ecx, dword [ebp - 0x1034]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x462d28
push 0
push 0
mov edx, dword [ebp - 0xfd8]
push edx
mov eax, dword [ebp - 0x1034]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x46223c
mov ecx, dword [ebp - 0x1034]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x462d28
push 0
lea edx, [ebp - 0x1120]
push edx
push 4
lea eax, [ebp - 0x1018]
push eax
mov ecx, dword [ebp - 0x1034]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x462280
push 0x5b126c
call fcn.005726f5
add esp, 4
mov edx, dword [ebp - 0x1034]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x462d28
cmp dword [ebp - 0x1018], 0x4550
je 0x4622ad
push 0x5b1284
call fcn.005726f5
add esp, 4
mov eax, dword [ebp - 0x1034]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x462d28
push 0
lea ecx, [ebp - 0x1120]
push ecx
push 0x14
lea edx, [ebp - 0x1030]
push edx
mov eax, dword [ebp - 0x1034]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4622f1
push 0x5b1294
call fcn.005726f5
add esp, 4
mov ecx, dword [ebp - 0x1034]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x462d28
push 0
lea edx, [ebp - 0x1120]
push edx
push 0xe0
lea eax, [ebp - 0x111c]
push eax
mov ecx, dword [ebp - 0x1034]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x462338
push 0x5b12b0
call fcn.005726f5
add esp, 4
mov edx, dword [ebp - 0x1034]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x462d28
push 0
push 0
push 0
mov eax, dword [ebp - 0x1034]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x462364
mov ecx, dword [ebp - 0x1034]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x462d28
mov edx, dword [ebp - 0x1034]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x101c], 0
mov ecx, 0x5eda84
call fcn.00463ec0
push 2
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 0x1034], eax
push 0
push 0x461ea0
push 0xe
mov ecx, dword [ebp - 0x1034]
push ecx
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
test eax, eax
setne dl
mov byte [ebp - 0x1035], dl
movzx eax, byte [ebp - 0x1035]
test eax, eax
jne 0x4623d1
xor al, al
jmp 0x462d28
mov ecx, 0x5eda84
call fcn.00463e70
mov dword [ebp - 0x112c], eax
lea ecx, [ebp - 0x1130]
call fcn.00463f60
mov byte [ebp - 0x1155], 0
push 0x5b12cc
lea ecx, [ebp - 0x1154]
call fcn.0041d9b0
mov dword [ebp - 4], 1
mov dword [ebp - 0x1150], 0
push 0x5b1112
lea ecx, [ebp - 0x114c]
call fcn.0045fb10
mov byte [ebp - 4], 2
cmp dword [ebp + 0x10], 0xffffffff
je 0x462671
mov ecx, 0x5eda84
call fcn.00463e70
cmp dword [ebp + 0x10], eax
jge 0x462671
lea ecx, [ebp - 0x11fc]
push ecx
mov ecx, 0x5eda84
call fcn.00463e10
mov edx, dword [eax]
mov dword [ebp - 0x1130], edx
jmp 0x462474
push 0
lea eax, [ebp - 0x1200]
push eax
lea ecx, [ebp - 0x1130]
call fcn.00463fa0
lea ecx, [ebp - 0x1204]
push ecx
mov ecx, 0x5eda84
call fcn.00463e40
push eax
lea ecx, [ebp - 0x1130]
call fcn.00463ff0
movzx edx, al
test edx, edx
je 0x462618
lea ecx, [ebp - 0x1130]
call fcn.00463f80
push eax
lea ecx, [ebp - 0x114c]
call fcn.00460140
mov dword [ebp - 0x115c], 0
lea ecx, [ebp - 0x114c]
call fcn.0041e510
push eax
lea ecx, [ebp - 0x1160]
call fcn.0041da30
mov byte [ebp - 4], 3
cmp dword [ebp + 0x10], 0xffffffff
je 0x4625a6
cmp dword [ebp + 0x10], 0
jge 0x4625a6
cmp dword [ebp + 0x10], 0
jge 0x4625a4
mov eax, dword [ebp + 0x10]
push eax
call fcn.00460780
add esp, 4
mov dword [ebp - 0x1168], eax
lea ecx, [ebp - 0x1164]
call fcn.0041d970
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x1168]
push ecx
push 0x5b12d0
lea edx, [ebp - 0x1164]
push edx
call fcn.00423c30
add esp, 0xc
lea ecx, [ebp - 0x1160]
call fcn.0041e1e0
push eax
lea ecx, [ebp - 0x1164]
call fcn.0041dbd0
test eax, eax
je 0x462572
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1164]
call fcn.0041dab0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1160]
call fcn.0041dab0
jmp 0x462460
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1164]
call fcn.0041dab0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1160]
call fcn.0041dab0
jmp 0x462618
jmp 0x462604
cmp dword [ebp + 0x10], 0xffffffff
je 0x462604
cmp dword [ebp + 0x10], 0
jl 0x462604
mov eax, dword [ebp - 0x1150]
cmp eax, dword [ebp + 0x10]
je 0x4625e8
cmp dword [ebp + 0x10], 0
jl 0x4625e8
mov ecx, dword [ebp - 0x1150]
add ecx, 1
mov dword [ebp - 0x1150], ecx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1160]
call fcn.0041dab0
jmp 0x462460
mov edx, dword [ebp - 0x1150]
cmp edx, dword [ebp + 0x10]
jne 0x462604
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1160]
call fcn.0041dab0
jmp 0x462618
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1160]
call fcn.0041dab0
jmp 0x462460
lea eax, [ebp - 0x1208]
push eax
mov ecx, 0x5eda84
call fcn.00463e40
push eax
lea ecx, [ebp - 0x1130]
call fcn.00463fd0
movzx ecx, al
test ecx, ecx
je 0x46266f
mov byte [ebp - 0x1209], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x114c]
call fcn.0041e490
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1154]
call fcn.0041dab0
mov al, byte [ebp - 0x1209]
jmp 0x462d28
jmp 0x4626cd
lea edx, [ebp - 0x1210]
push edx
mov ecx, 0x5eda84
call fcn.00463e10
mov eax, dword [eax]
mov dword [ebp - 0x1130], eax
lea ecx, [ebp - 0x1130]
call fcn.00463f80
push eax
lea ecx, [ebp - 0x114c]
call fcn.00460140
mov dword [ebp - 0x116c], 0
lea ecx, [ebp - 0x114c]
call fcn.0041e510
push eax
lea ecx, [ebp - 0x1170]
call fcn.0041da30
lea ecx, [ebp - 0x1170]
call fcn.0041dab0
mov dword [ebp - 0x1174], 0
lea ecx, [ebp - 0x114c]
call fcn.0041e510
push eax
lea ecx, [ebp - 0x1178]
call fcn.0041da30
mov byte [ebp - 4], 5
push ecx
mov ecx, esp
mov dword [ebp - 0x1214], esp
lea edx, [ebp - 0x1178]
push edx
call fcn.0041d990
mov dword [ebp - 0x123c], eax
call fcn.00461df0
add esp, 4
mov byte [ebp - 0x123d], al
movzx eax, byte [ebp - 0x123d]
test eax, eax
jne 0x4627e7
lea ecx, [ebp - 0x114c]
call fcn.0041e510
push eax
call fcn.00578c75
add esp, 4
mov dword [ebp - 0x117c], eax
cmp dword [ebp - 0x117c], 0
jl 0x4627a2
cmp dword [ebp - 0x117c], 0xffff
jge 0x4627a2
push 0xe
movzx ecx, word [ebp - 0x117c]
push ecx
mov edx, dword [ebp - 0x1034]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x1174], eax
cmp dword [ebp - 0x1174], 0
jne 0x4627a0
push 0xe
lea ecx, [ebp - 0x1178]
call fcn.0041e1e0
push eax
mov eax, dword [ebp - 0x1034]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x1174], eax
jmp 0x4627e5
lea ecx, [ebp - 0x114c]
call fcn.0041e510
push eax
lea ecx, [ebp - 0x1180]
call fcn.0041da30
push 0xe
lea ecx, [ebp - 0x1180]
call fcn.0041e1e0
push eax
mov ecx, dword [ebp - 0x1034]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x1174], eax
lea ecx, [ebp - 0x1180]
call fcn.0041dab0
jmp 0x46282a
lea ecx, [ebp - 0x114c]
call fcn.0041e510
push eax
lea ecx, [ebp - 0x1184]
call fcn.0041da30
push 0xe
lea ecx, [ebp - 0x1184]
call fcn.0041e1e0
push eax
mov edx, dword [ebp - 0x1034]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x1174], eax
lea ecx, [ebp - 0x1184]
call fcn.0041dab0
cmp dword [ebp - 0x1174], 0
je 0x462c90
mov eax, dword [ebp - 0x1174]
push eax
mov ecx, dword [ebp - 0x1034]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x1188], eax
cmp dword [ebp - 0x1188], 0
je 0x462c8e
mov edx, dword [ebp - 0x1188]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x11bc], eax
push 0x18
call fcn.00553a71
add esp, 4
mov dword [ebp - 0x1218], eax
mov eax, dword [ebp - 0x1218]
mov dword [ebp - 0x1190], eax
mov ecx, dword [ebp - 0x11bc]
mov dx, word [ecx]
mov word [ebp - 0x118c], dx
mov eax, dword [ebp - 0x11bc]
mov cx, word [eax + 2]
mov word [ebp - 0x11c0], cx
mov edx, dword [ebp - 0x11bc]
mov ax, word [edx + 4]
mov word [ebp - 0x11c4], ax
mov ecx, dword [ebp - 0x1190]
mov dx, word [ebp - 0x11c4]
mov word [ecx + 4], dx
mov eax, dword [ebp - 0x1190]
mov cx, word [ebp - 0x11c0]
mov word [eax + 2], cx
mov edx, dword [ebp - 0x1190]
mov ax, word [ebp - 0x118c]
mov word [edx], ax
lea ecx, [ebp - 0x11b8]
call fcn.004619b0
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x1190]
sub esp, 0x18
mov edx, esp
mov eax, dword [ecx]
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
mov eax, dword [ecx + 8]
mov dword [edx + 8], eax
mov eax, dword [ecx + 0xc]
mov dword [edx + 0xc], eax
mov eax, dword [ecx + 0x10]
mov dword [edx + 0x10], eax
mov ecx, dword [ecx + 0x14]
mov dword [edx + 0x14], ecx
lea ecx, [ebp - 0x11b8]
call fcn.00461ae0
mov edx, dword [ebp - 0x1190]
movzx eax, word [edx + 4]
test eax, eax
je 0x462c64
mov dword [ebp - 0x11cc], 0
mov dword [ebp - 0x11c8], 0
mov dword [ebp - 0x11d8], 0
mov dword [ebp - 0x11d0], 0
mov dword [ebp - 0x11d4], 0
mov dword [ebp - 0x11dc], 0
jmp 0x462997
mov ecx, dword [ebp - 0x11dc]
add ecx, 1
mov dword [ebp - 0x11dc], ecx
mov edx, dword [ebp - 0x1190]
movzx eax, word [edx + 4]
cmp dword [ebp - 0x11dc], eax
jge 0x462c3f
mov ecx, dword [ebp - 0x11dc]
imul ecx, ecx, 0xe
mov edx, dword [ebp - 0x11bc]
lea eax, [edx + ecx + 6]
push eax
call fcn.004639d0
add esp, 4
mov dword [ebp - 0x11cc], eax
push 3
mov ecx, dword [ebp - 0x11cc]
movzx edx, word [ecx + 0xc]
push edx
mov eax, dword [ebp - 0x1034]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x11e8], eax
cmp dword [ebp - 0x11e8], 0
jne 0x462a49
mov byte [ebp - 0x1219], 0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x11b8]
call fcn.004619f0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1178]
call fcn.0041dab0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x114c]
call fcn.0041e490
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1154]
call fcn.0041dab0
mov al, byte [ebp - 0x1219]
jmp 0x462d28
mov ecx, dword [ebp - 0x11e8]
push ecx
mov edx, dword [ebp - 0x1034]
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x11e4], eax
cmp dword [ebp - 0x11e4], 0
jne 0x462abd
mov byte [ebp - 0x121a], 0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x11b8]
call fcn.004619f0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1178]
call fcn.0041dab0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x114c]
call fcn.0041e490
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1154]
call fcn.0041dab0
mov al, byte [ebp - 0x121a]
jmp 0x462d28
mov eax, dword [ebp - 0x11e4]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x11f4], eax
cmp dword [ebp - 0x11f4], 0
jne 0x462b2a
mov byte [ebp - 0x121b], 0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x11b8]
call fcn.004619f0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1178]
call fcn.0041dab0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x114c]
call fcn.0041e490
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1154]
call fcn.0041dab0
mov al, byte [ebp - 0x121b]
jmp 0x462d28
mov ecx, dword [ebp - 0x11e8]
push ecx
mov edx, dword [ebp - 0x1034]
push edx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x11e0], eax
mov eax, dword [ebp - 0x11e0]
push eax
call fcn.00553501
add esp, 4
mov dword [ebp - 0x1220], eax
mov ecx, dword [ebp - 0x1220]
mov dword [ebp - 0x11f0], ecx
mov edx, dword [ebp - 0x11e0]
push edx
mov eax, dword [ebp - 0x11f4]
push eax
mov ecx, dword [ebp - 0x11f0]
push ecx
call fcn.005544b0
add esp, 0xc
push 8
call fcn.00553a71
add esp, 4
mov dword [ebp - 0x1228], eax
cmp dword [ebp - 0x1228], 0
je 0x462bae
mov ecx, dword [ebp - 0x1228]
call fcn.00461600
mov dword [ebp - 0x1244], eax
jmp 0x462bb8
mov dword [ebp - 0x1244], 0
mov edx, dword [ebp - 0x1244]
mov dword [ebp - 0x1224], edx
mov eax, dword [ebp - 0x1224]
mov dword [ebp - 0x11ec], eax
mov ecx, dword [ebp - 0x11e0]
push ecx
mov edx, dword [ebp - 0x11f0]
push edx
mov ecx, dword [ebp - 0x11ec]
call fcn.00461700
mov eax, dword [ebp - 0x11ec]
push eax
lea ecx, [ebp - 0x11b8]
call fcn.00461b20
cmp dword [ebp - 0x11f0], 0
je 0x462c1f
mov ecx, dword [ebp - 0x11f0]
mov dword [ebp - 0x122c], ecx
mov edx, dword [ebp - 0x122c]
push edx
call fcn.00552dca
add esp, 4
mov eax, dword [ebp - 0x11cc]
mov dword [ebp - 0x1230], eax
mov ecx, dword [ebp - 0x1230]
push ecx
call fcn.00552dca
add esp, 4
jmp 0x462988
mov edx, dword [ebp + 0xc]
push edx
lea ecx, [ebp - 0x11b8]
call fcn.00461b40
movzx eax, al
test eax, eax
jne 0x462c64
mov ecx, dword [ebp + 0xc]
call fcn.0041e1e0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0x1190]
mov dword [ebp - 0x1234], ecx
mov edx, dword [ebp - 0x1234]
push edx
call fcn.00552dca
add esp, 4
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x11b8]
call fcn.004619f0
jmp 0x462cdc
mov eax, dword [ebp - 0x1034]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov byte [ebp - 0x1235], 0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1178]
call fcn.0041dab0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x114c]
call fcn.0041e490
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1154]
call fcn.0041dab0
mov al, byte [ebp - 0x1235]
jmp 0x462d28
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1178]
call fcn.0041dab0
mov ecx, dword [ebp - 0x1034]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x114c]
call fcn.0041e490
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1154]
call fcn.0041dab0
mov edx, dword [ebp - 0x1034]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055338c
mov esp, ebp
pop ebp
ret