Function at 0x40f6b0
Capabilities:
Check if file exists
Delete file
Extract resource via kernel32 functions
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c8929
mov eax, dword fs:[0]
push eax
sub esp, 0x5b8
mov eax, dword [0x64a3a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x5a8], esi
cmp dword [0x658288], 0
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x5bc], ebx
jne 0x40f700
call fcn.00409f40
mov ecx, dword [0x658288]
call fcn.0042a24b
mov edx, eax
mov dword [ebp - 0x3b0], 7
xor eax, eax
mov dword [ebp - 0x3b4], 0
mov word [ebp - 0x3c4], ax
cmp word [edx], ax
jne 0x40f733
xor ecx, ecx
jmp 0x40f755
mov ecx, edx
lea esi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40f740
sub ecx, esi
mov esi, dword [ebp - 0x5a8]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x3c4]
call fcn.00404c50
xor eax, eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x380], 7
mov dword [ebp - 0x384], 0
mov word [ebp - 0x394], ax
cmp word [ebx], ax
jne 0x40f78f
xor ecx, ecx
jmp 0x40f7a3
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40f794
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [ebp - 0x394]
call fcn.00404c50
xor eax, eax
mov byte [ebp - 4], 1
push 0xffffffffffffffff
push eax
mov word [ebp - 0x37c], ax
lea ecx, [ebp - 0x37c]
lea eax, [ebp - 0x3c4]
mov dword [ebp - 0x368], 7
push eax
mov dword [ebp - 0x36c], 0
call fcn.00404b30
xor eax, eax
mov byte [ebp - 4], 2
push 0xffffffffffffffff
push eax
mov word [ebp - 0x364], ax
lea ecx, [ebp - 0x364]
lea eax, [ebp - 0x394]
mov dword [ebp - 0x350], 7
push eax
mov dword [ebp - 0x354], 0
call fcn.00404b30
lea eax, [ebp - 0x37c]
mov byte [ebp - 4], 3
push eax
call fcn.00429c7a
lea eax, [ebp - 0x364]
push eax
call fcn.00429c7a
cmp dword [ebp - 0x350], 8
lea ecx, [ebp - 0x364]
push dword [ebp - 0x354]
cmovae ecx, dword [ebp - 0x364]
lea eax, [ebp - 0x37c]
cmp dword [ebp - 0x368], 8
push ecx
cmovae eax, dword [ebp - 0x37c]
push dword [ebp - 0x36c]
push eax
call fcn.00404520
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0x18
test eax, eax
je 0x40f897
cmp dword [ebp - 0x3b0], 8
lea eax, [ebp - 0x3c4]
cmovae eax, dword [ebp - 0x3c4]
push eax
call ebx
mov ecx, esi
call fcn.00410380
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00492030
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x218]
push eax
call fcn.0042f556
add esp, 4
mov dword [ebp - 0x338], 7
xor eax, eax
mov dword [ebp - 0x33c], 0
lea ecx, [ebp - 0x34c]
mov word [ebp - 0x34c], ax
push 1
push 0x5d9c94
call fcn.00404c50
push 0xb
push 0x5dad34
lea ecx, [ebp - 0x34c]
mov byte [ebp - 4], 4
call fcn.004047d0
push 1
push 0x5d9c94
lea ecx, [ebp - 0x34c]
call fcn.004047d0
push 1
xor eax, eax
mov dword [ebp - 0x320], 7
push 0x5d9c94
lea ecx, [ebp - 0x334]
mov dword [ebp - 0x324], 0
mov word [ebp - 0x334], ax
call fcn.00404c50
push 0xb
push str.aa9366f59ef
lea ecx, [ebp - 0x334]
mov byte [ebp - 4], 5
call fcn.004047d0
push 1
push 0x5d9c94
lea ecx, [ebp - 0x334]
call fcn.004047d0
cmp dword [ebp - 0x320], 8
lea ecx, [ebp - 0x334]
lea eax, [ebp - 0x34c]
cmovae ecx, dword [ebp - 0x334]
cmp dword [ebp - 0x338], 8
push ecx
cmovae eax, dword [ebp - 0x34c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x4101cd
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push edi
mov dword [ebp - 0x5c0], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0x1869f
push 0x2710
mov dword [ebp - 0x5a8], eax
call fcn.00430ede
cdq
push edx
push eax
lea eax, [ebp - 0x43c]
push eax
call fcn.00430e51
add esp, 0x14
lea ecx, [ebp - 0x218]
mov byte [ebp - 4], 6
add ecx, 0xfffffffe
nop
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x40fa10
mov eax, dword [str.WorthyShop]
lea edi, [ebp - 0x218]
mov dword [ecx], eax
add edi, 0xfffffffe
mov eax, dword [0x5d9ddc]
mov dword [ecx + 4], eax
mov eax, dword [0x5d9de0]
mov dword [ecx + 8], eax
mov eax, dword [0x5d9de4]
mov dword [ecx + 0xc], eax
mov eax, dword [0x5d9de8]
mov dword [ecx + 0x10], eax
mov ax, word [0x5d9dec]
mov word [ecx + 0x14], ax
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x40fa56
cmp dword [ebp - 0x428], 8
lea edx, [ebp - 0x43c]
mov eax, dword [0x5dad64]
cmovae edx, dword [ebp - 0x43c]
mov dword [edi], eax
mov esi, edx
nop
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x40fa80
lea edi, [ebp - 0x218]
sub edx, esi
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x40fa96
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x218]
add ecx, 0xfffffffe
nop dword [eax]
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x40fac0
mov eax, dword [0x5dad68]
mov dword [ecx], eax
mov eax, dword [0x5dad6c]
mov dword [ecx + 4], eax
lea eax, [ebp - 0x218]
push eax
call ebx
test eax, eax
je 0x40faf7
lea eax, [ebp - 0x218]
push eax
call fcn.00430a78
add esp, 4
push 0
push 0x80
push 1
push 0
push 1
push 0x40000000
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40fb4a
push 0
lea eax, [ebp - 0x5c4]
mov dword [ebp - 0x5c4], 0
push eax
push dword [ebp - 0x5a8]
push dword [ebp - 0x5c0]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x104
lea eax, [ebp - 0x31c]
push 0
push eax
call fcn.00492030
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00429c4b
add esp, 0x14
cmp dword [0x658288], 0
jne 0x40fb81
call fcn.00409f40
mov ecx, dword [0x658288]
call fcn.004077c0
cmp dword [0x658288], 0
jne 0x40fb9a
call fcn.00409f40
mov ecx, dword [0x658288]
call fcn.00405bd0
lea ecx, [ebp - 0x5b8]
xor ebx, ebx
cmp dword [ebp - 0x380], 8
lea eax, [ebp - 0x394]
push ecx
cmovae eax, dword [ebp - 0x394]
lea ecx, [ebp - 0x31c]
push fcn.00410320
push ecx
push eax
mov dword [ebp - 0x5b8], ebx
call fcn.004311c4
add esp, 0x10
mov dword [ebp - 0x410], 7
xor eax, eax
mov dword [ebp - 0x414], ebx
lea ecx, [ebp - 0x424]
mov word [ebp - 0x424], ax
push eax
push 0x5d9890
call fcn.00404c50
xor eax, eax
mov byte [ebp - 4], 7
push eax
push 0x5d9890
lea ecx, [ebp - 0x3ac]
mov dword [ebp - 0x398], 7
mov dword [ebp - 0x39c], ebx
mov word [ebp - 0x3ac], ax
call fcn.00404c50
push dword [ebp - 0x5bc]
lea ecx, [ebp - 0x3dc]
mov byte [ebp - 4], 8
call fcn.004020e0
push 0xb
push str.Vectrya.exe
lea ecx, [ebp - 0x3dc]
mov byte [ebp - 4], 9
call fcn.004047d0
cmp dword [0x658288], ebx
jne 0x40fc6d
call fcn.00409f40
mov ecx, dword [0x658288]
call fcn.004067c0
cmp dword [0x658288], 0
mov dword [ebp - 0x5a8], eax
jne 0x40fc8c
call fcn.00409f40
mov ecx, dword [0x658288]
call fcn.004067a0
mov edi, eax
lea ecx, [ebp - 0x58c]
push edi
call fcn.004020e0
push 2
push 0
push 0x5dad70
lea ecx, [ebp - 0x58c]
mov byte [ebp - 4], 0xa
call fcn.004085f0
cmp dword [0x658288], 0
mov dword [ebp - 0x5bc], eax
jne 0x40fcd1
call fcn.00409f40
mov ecx, dword [0x658288]
call fcn.00406780
test eax, eax
mov esi, 1
cmovne ebx, esi
cmp dword [0x658288], 0
jne 0x40fcf4
call fcn.00409f40
mov ecx, dword [0x658288]
call fcn.00406750
neg eax
mov dword [ebp - 0x5b4], 0
mov dword [ebp - 0x5b0], 0
sbb eax, eax
mov dword [ebp - 0x5ac], 0
neg eax
cmp dword [ebp + 0xc], 0
cmove esi, eax
mov ecx, dword [ebp - 0x5a8]
mov byte [ebp - 4], 0xb
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40fd37
sub ecx, edx
sar ecx, 1
je 0x40fe6b
push 0x5dad78
lea ecx, [ebp - 0x454]
call fcn.004020e0
lea eax, [ebp - 0x454]
mov byte [ebp - 4], 0xc
push eax
lea ecx, [ebp - 0x5b4]
call fcn.004053a0
mov eax, dword [ebp - 0x440]
mov byte [ebp - 4], 0xb
cmp eax, 8
jb 0x40fd94
inc eax
lea ecx, [ebp - 0x454]
push eax
push dword [ebp - 0x454]
call fcn.00404da0
push dword [ebp - 0x5a8]
lea ecx, [ebp - 0x46c]
call fcn.004020e0
lea eax, [ebp - 0x46c]
mov byte [ebp - 4], 0xd
push eax
lea ecx, [ebp - 0x5b4]
call fcn.004053a0
mov eax, dword [ebp - 0x458]
mov byte [ebp - 4], 0xb
cmp eax, 8
jb 0x40fddd
inc eax
lea ecx, [ebp - 0x46c]
push eax
push dword [ebp - 0x46c]
call fcn.00404da0
push 0x5dad80
lea ecx, [ebp - 0x3f4]
call fcn.004020e0
lea eax, [ebp - 0x3f4]
mov byte [ebp - 4], 0xe
push eax
lea ecx, [ebp - 0x5b4]
call fcn.004053a0
mov eax, dword [ebp - 0x3e0]
mov byte [ebp - 4], 0xb
cmp eax, 8
jb 0x40fe25
inc eax
lea ecx, [ebp - 0x3f4]
push eax
push dword [ebp - 0x3f4]
call fcn.00404da0
push edi
lea ecx, [ebp - 0x40c]
call fcn.004020e0
lea eax, [ebp - 0x40c]
mov byte [ebp - 4], 0xf
push eax
lea ecx, [ebp - 0x5b4]
call fcn.004053a0
mov eax, dword [ebp - 0x3f8]
mov byte [ebp - 4], 0xb
cmp eax, 8
jb 0x40fed1
inc eax
lea ecx, [ebp - 0x40c]
push eax
push dword [ebp - 0x40c]
call fcn.00404da0
jmp 0x40fed1
push 0x5dad80
lea ecx, [ebp - 0x484]
call fcn.004020e0
lea eax, [ebp - 0x484]
mov byte [ebp - 4], 0x10
push eax
lea ecx, [ebp - 0x5b4]
call fcn.004053a0
lea ecx, [ebp - 0x484]
mov byte [ebp - 4], 0xb
call fcn.00402650
push edi
lea ecx, [ebp - 0x49c]
call fcn.004020e0
lea eax, [ebp - 0x49c]
mov byte [ebp - 4], 0x11
push eax
lea ecx, [ebp - 0x5b4]
call fcn.004053a0
lea ecx, [ebp - 0x49c]
mov byte [ebp - 4], 0xb
call fcn.00402650
cmp dword [ebp - 0x5bc], 0xffffffff
je 0x40ff44
push 0x5dad88
lea ecx, [ebp - 0x4b4]
call fcn.004020e0
lea eax, [ebp - 0x4b4]
mov byte [ebp - 4], 0x12
push eax
lea ecx, [ebp - 0x5b4]
call fcn.004053a0
lea ecx, [ebp - 0x4b4]
mov byte [ebp - 4], 0xb
call fcn.00402650
push 0x5dad90
lea ecx, [ebp - 0x4cc]
call fcn.004020e0
lea eax, [ebp - 0x4cc]
mov byte [ebp - 4], 0x13
push eax
lea ecx, [ebp - 0x5b4]
call fcn.004053a0
lea ecx, [ebp - 0x4cc]
mov byte [ebp - 4], 0xb
call fcn.00402650
test esi, esi
jne 0x40ffb2
push 0x5dad9c
lea ecx, [ebp - 0x4e4]
call fcn.004020e0
lea eax, [ebp - 0x4e4]
mov byte [ebp - 4], 0x14
push eax
lea ecx, [ebp - 0x5b4]
call fcn.004053a0
lea ecx, [ebp - 0x4e4]
mov byte [ebp - 4], 0xb
call fcn.00402650
push 0x5da1a4
lea ecx, [ebp - 0x4fc]
call fcn.004020e0
lea eax, [ebp - 0x4fc]
mov byte [ebp - 4], 0x15
push eax
lea ecx, [ebp - 0x5b4]
call fcn.004053a0
lea ecx, [ebp - 0x4fc]
mov byte [ebp - 4], 0xb
call fcn.00402650
test ebx, ebx
jne 0x410020
push 0x5dada4
lea ecx, [ebp - 0x514]
call fcn.004020e0
lea eax, [ebp - 0x514]
mov byte [ebp - 4], 0x16
push eax
lea ecx, [ebp - 0x5b4]
call fcn.004053a0
lea ecx, [ebp - 0x514]
mov byte [ebp - 4], 0xb
call fcn.00402650
push 0x5da1a4
lea ecx, [ebp - 0x52c]
call fcn.004020e0
lea eax, [ebp - 0x52c]
mov byte [ebp - 4], 0x17
push eax
lea ecx, [ebp - 0x5b4]
call fcn.004053a0
lea ecx, [ebp - 0x52c]
mov byte [ebp - 4], 0xb
call fcn.00402650
cmp dword [ebp + 0xc], 0
jne 0x410090
push 0x5dadac
lea ecx, [ebp - 0x544]
call fcn.004020e0
lea eax, [ebp - 0x544]
mov byte [ebp - 4], 0x18
push eax
lea ecx, [ebp - 0x5b4]
call fcn.004053a0
lea ecx, [ebp - 0x544]
mov byte [ebp - 4], 0xb
call fcn.00402650
push 0x5da1a4
lea ecx, [ebp - 0x55c]
call fcn.004020e0
lea eax, [ebp - 0x55c]
mov byte [ebp - 4], 0x19
push eax
lea ecx, [ebp - 0x5b4]
call fcn.004053a0
lea ecx, [ebp - 0x55c]
mov byte [ebp - 4], 0xb
call fcn.00402650
push 0x5dadb4
lea ecx, [ebp - 0x574]
call fcn.004020e0
lea eax, [ebp - 0x5b4]
mov byte [ebp - 4], 0x1a
push eax
lea eax, [ebp - 0x574]
push eax
lea eax, [ebp - 0x5a4]
push eax
call fcn.004298eb
add esp, 0xc
lea ecx, [ebp - 0x3ac]
push eax
call fcn.004029e0
lea ecx, [ebp - 0x5a4]
call fcn.00402650
lea ecx, [ebp - 0x574]
mov byte [ebp - 4], 0xb
call fcn.00402650
cmp dword [ebp - 0x398], 8
lea ecx, [ebp - 0x3ac]
push 0x2710
cmovae ecx, dword [ebp - 0x3ac]
lea eax, [ebp - 0x3dc]
cmp dword [ebp - 0x3c8], 8
push 1
cmovae eax, dword [ebp - 0x3dc]
push ecx
push eax
call fcn.0042831b
mov esi, dword [ebp - 0x5b8]
mov edi, 0x64
mov ecx, edi
mov eax, 0x55555556
sub ecx, esi
imul ecx
push edi
mov eax, edx
shr eax, 0x1f
add eax, edx
add esi, eax
push esi
mov dword [ebp - 0x5b8], esi
call fcn.00410320
mov ecx, dword [ebp - 0x5b8]
mov eax, 0x55555556
sub edi, ecx
imul edi
push 0x64
mov eax, edx
shr eax, 0x1f
add eax, edx
add ecx, eax
push ecx
mov dword [ebp - 0x5b8], ecx
call fcn.00410320
add esp, 0x20
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x64
push 0x64
call fcn.00410320
add esp, 8
lea ecx, [ebp - 0x5b4]
call fcn.004026f0
lea ecx, [ebp - 0x58c]
call fcn.00402650
lea ecx, [ebp - 0x3dc]
call fcn.00402650
lea ecx, [ebp - 0x3ac]
call fcn.00402650
lea ecx, [ebp - 0x424]
call fcn.00402650
lea ecx, [ebp - 0x43c]
call fcn.00402650
mov eax, dword [ebp - 0x320]
cmp eax, 8
jb 0x4101eb
inc eax
lea ecx, [ebp - 0x334]
push eax
push dword [ebp - 0x334]
call fcn.00404da0
xor eax, eax
mov dword [ebp - 0x320], 7
mov word [ebp - 0x334], ax
mov eax, dword [ebp - 0x338]
mov dword [ebp - 0x324], 0
cmp eax, 8
jb 0x410226
inc eax
lea ecx, [ebp - 0x34c]
push eax
push dword [ebp - 0x34c]
call fcn.00404da0
xor eax, eax
mov dword [ebp - 0x338], 7
mov word [ebp - 0x34c], ax
mov eax, dword [ebp - 0x350]
mov dword [ebp - 0x33c], 0
cmp eax, 8
jb 0x410261
inc eax
lea ecx, [ebp - 0x364]
push eax
push dword [ebp - 0x364]
call fcn.00404da0
xor eax, eax
mov dword [ebp - 0x350], 7
mov word [ebp - 0x364], ax
mov eax, dword [ebp - 0x368]
mov dword [ebp - 0x354], 0
cmp eax, 8
jb 0x41029c
inc eax
lea ecx, [ebp - 0x37c]
push eax
push dword [ebp - 0x37c]
call fcn.00404da0
xor eax, eax
mov dword [ebp - 0x368], 7
mov word [ebp - 0x37c], ax
mov eax, dword [ebp - 0x380]
mov dword [ebp - 0x36c], 0
cmp eax, 8
jb 0x4102d7
inc eax
lea ecx, [ebp - 0x394]
push eax
push dword [ebp - 0x394]
call fcn.00404da0
xor eax, eax
mov dword [ebp - 0x380], 7
lea ecx, [ebp - 0x3c4]
mov dword [ebp - 0x384], 0
mov word [ebp - 0x394], ax
call fcn.00402650
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00426a9d
mov esp, ebp
pop ebp
ret 0xc