Function at 0x4030f0
Capabilities:
Extract resource via kernel32 functions
Get common file path

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x104
mov ecx, dword [eax]
push ebx
push ebp
push esi
test ecx, ecx
push edi
je 0x403114
pop edi
pop esi
pop ebp
mov eax, 0xfffffff8
pop ebx
add esp, 0x104
ret
mov ebx, dword [esp + 0x118]
test ebx, ebx
je 0x403200
mov cl, byte [0x406630]
xor eax, eax
mov byte [esp + 0x14], cl
mov ecx, 0x3f
lea edi, [esp + 0x15]
push 0x406028
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
stosb byte es:[edi], al
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4031b4
lea edx, [esp + 0x14]
push 0x100
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, 0x406028
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea edx, [esp + 0x14]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
jmp 0x4031d2
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 2
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov esi, eax
test esi, esi
mov dword [esp + 0x10], esi
jne 0x40320c
pop edi
pop esi
pop ebp
mov eax, 0xfffffffa
pop ebx
add esp, 0x104
ret
mov edx, dword [0x406894]
mov dword [esp + 0x10], edx
mov esi, edx
mov eax, dword [esp + 0x11c]
push 0xa
and eax, 0xffff
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebp, eax
test ebp, ebp
jne 0x403238
pop edi
pop esi
pop ebp
mov eax, 0xffffff9c
pop ebx
add esp, 0x104
ret
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
test ebx, ebx
jbe 0x4032ca
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40326d
push ebp
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
pop esi
pop ebp
mov eax, 0xffffff9b
pop ebx
add esp, 0x104
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
lea ecx, [ebx + 1]
mov esi, eax
push ecx
call dword [sym.imp.MSVCRT.dll_malloc]
mov edx, dword [esp + 0x124]
add esp, 4
test eax, eax
mov dword [edx], eax
jne 0x4032a7
push ebp
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
pop esi
pop ebp
mov eax, 0xfffffffd
pop ebx
add esp, 0x104
ret
mov ecx, ebx
mov edi, eax
mov eax, ecx
push ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [edx]
mov byte [ecx + ebx], 0
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0x118]
test eax, eax
je 0x4032dc
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x104
ret