Function at 0x402df0
Capabilities:
Check if file exists
Check mutex on windows
Create process on windows
Extract resource via kernel32 functions
Get common file path
Get file attributes
Read file on windows
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4d4
mov eax, dword [0x420470]
xor eax, esp
mov dword [esp + 0x4d0], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, 1
push 0x10
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], esi
mov dword [0x4224b8], edi
call fcn.00406c2b
add esp, 4
mov dword [0x4224c4], eax
mov ecx, str.KHLauncher.log
mov edx, eax
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
add ecx, edi
add edx, edi
test al, al
jne 0x402e40
call fcn.004018c0
call fcn.00401960
push str.KHLauncher
call fcn.00401a20
push str.Global956D107D_429F_4757_A6DA_0C99CDE7A9E6KHSafeLauncher.exe
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x402e8f
push 0x41d1b4
call fcn.00401a20
jmp 0x403981
push 0x41d1cc
mov dword [esp + 0x14], edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
je 0x402eae
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x402ffe
push 0x41d1d4
push str.DLL_VFS
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
cmp esi, ebx
jne 0x402ee8
push 0x41d1e0
call fcn.00401a20
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x4d0]
xor ecx, esp
call fcn.00406f52
mov esp, ebp
pop ebp
ret 0x10
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [esp + 0xc], eax
cmp eax, ebx
jne 0x402f1b
push 0x41d20c
call fcn.00401a20
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x4d0]
xor ecx, esp
call fcn.00406f52
mov esp, ebp
pop ebp
ret 0x10
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0x41d238
push str..VFS.dll
mov edi, eax
call fcn.00408778
mov esi, eax
add esp, 8
cmp esi, ebx
jne 0x402fe3
push 0x103
lea ecx, [esp + 0x2cd]
push ebx
push ecx
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x2d4], bl
call fcn.0040ea90
add esp, 0xc
push 0x104
lea edx, [esp + 0x2cc]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [esp + 0x2c8]
dec eax
lea ecx, [ecx]
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x402f80
mov ecx, dword [0x41d248]
mov edx, dword [0x41d24c]
mov dword [eax], ecx
mov cl, byte [0x41d250]
mov dword [eax + 4], edx
lea edx, [esp + 0x2c8]
push 0x41d238
push edx
mov byte [eax + 8], cl
call fcn.00408778
mov esi, eax
add esp, 8
cmp esi, ebx
jne 0x402fe3
push 0x41d254
call fcn.00401a20
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x4d0]
xor ecx, esp
call fcn.00406f52
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [esp + 0xc]
push esi
push 1
push edi
push eax
call fcn.00408df6
push esi
call fcn.004090d9
mov esi, dword [esp + 0x30]
add esp, 0x14
push 0x103
lea ecx, [esp + 0x3d5]
push ebx
push ecx
mov byte [esp + 0x3dc], bl
call fcn.0040ea90
mov eax, dword [esp + 0x20]
add esp, 0xc
push 0x104
lea edx, [esp + 0x3d4]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 7
push str.0.0.0.0
mov ecx, 0x4215ac
call fcn.00404fd0
mov eax, esi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x403050
sub eax, edx
je 0x40307a
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x403060
sub eax, edx
push eax
push esi
mov ecx, 0x4215ac
call fcn.00404fd0
jmp 0x4030ff
lea ecx, [esp + 0x3d0]
push 0x41d288
push ecx
call fcn.00408778
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x4030ff
push 2
push 0xfffffffffffffffc
push esi
call fcn.00408f27
add esp, 0xc
push esi
push 1
lea edx, [esp + 0x14]
push 4
push edx
call fcn.00408ada
push esi
call fcn.004090d9
mov eax, dword [0x4215ac]
add esp, 0x14
cmp dword [0x4215c0], 0x10
mov dword [0x4215bc], ebx
jae 0x4030d3
mov eax, 0x4215ac
mov byte [eax], bl
movzx eax, byte [esp + 0xf]
movzx ecx, byte [esp + 0xe]
push eax
mov eax, dword [esp + 0x10]
push ecx
movzx edx, ah
push edx
movzx eax, al
push eax
push str._d._d._d._d
push 0x4215ac
call fcn.00404760
add esp, 0x18
push 0x104
lea ecx, [esp + 0x15c]
push ebx
push ecx
call fcn.0040ea90
mov eax, 0xf
add esp, 0xc
lea ecx, [esp + 0x158]
mov dword [esp + 0x134], eax
mov dword [esp + 0x130], ebx
mov byte [esp + 0x120], bl
mov dword [esp + 0xc4], eax
mov dword [esp + 0xc0], ebx
mov byte [esp + 0xb0], bl
mov dword [esp + 0xa8], eax
mov dword [esp + 0xa4], ebx
mov byte [esp + 0x94], bl
mov dword [esp + 0x8c], eax
mov dword [esp + 0x88], ebx
mov byte [esp + 0x78], bl
call fcn.00402180
lea eax, [esp + 0x158]
dec eax
nop
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x403180
mov edx, dword [str.KHLauncher.ini]
mov ecx, dword [0x41d29c]
mov dword [eax], edx
mov edx, dword [0x41d2a0]
mov dword [eax + 4], ecx
mov cx, word [0x41d2a4]
mov dword [eax + 8], edx
mov dl, byte [0x41d2a6]
mov word [eax + 0xc], cx
mov byte [eax + 0xe], dl
lea eax, [esp + 0x120]
push eax
mov ebx, str.CBin
mov edi, 0x41d2b0
lea esi, [esp + 0x15c]
call fcn.004020e0
lea ecx, [esp + 0xb0]
push ecx
mov ebx, str.KHSafe
mov edi, str.Path
call fcn.004020e0
lea edx, [esp + 0x94]
push edx
mov ebx, str.IntranetClient.exe
mov edi, str.Exec
call fcn.004020e0
cmp dword [0x4215c0], 0x10
mov ebx, dword [0x4215ac]
jae 0x403216
mov ebx, 0x4215ac
lea eax, [esp + 0x78]
push eax
mov edi, 0x41d2e8
lea esi, [esp + 0x15c]
call fcn.004020e0
cmp dword [esp + 0x8c], 0x10
mov edx, dword [esp + 0x78]
jae 0x40323e
lea edx, [esp + 0x78]
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403243
sub eax, esi
push eax
push edx
mov ecx, 0x4215ac
call fcn.00404fd0
mov eax, dword [0x4215ac]
mov edi, 0x10
cmp dword [0x4215c0], edi
jae 0x40326f
mov eax, 0x4215ac
push str.0.0.0.0
push eax
call fcn.004070e1
add esp, 8
test eax, eax
jne 0x40336a
mov eax, dword [0x4215ac]
cmp dword [0x4215c0], edi
jae 0x403297
mov eax, 0x4215ac
push eax
push 0x41d2ec
mov ebx, 0x4224b8
call fcn.00401c20
add esp, 8
cmp dword [esp + 0x8c], edi
jb 0x4032c0
mov ecx, dword [esp + 0x78]
push ecx
call fcn.00408c1f
add esp, 4
xor ebx, ebx
mov esi, 0xf
mov dword [esp + 0x8c], esi
mov dword [esp + 0x88], ebx
mov byte [esp + 0x78], bl
cmp dword [esp + 0xa8], edi
jb 0x4032f2
mov edx, dword [esp + 0x94]
push edx
call fcn.00408c1f
add esp, 4
mov dword [esp + 0xa8], esi
mov dword [esp + 0xa4], ebx
mov byte [esp + 0x94], bl
cmp dword [esp + 0xc4], edi
jb 0x403320
mov eax, dword [esp + 0xb0]
push eax
call fcn.00408c1f
add esp, 4
mov dword [esp + 0xc4], esi
mov dword [esp + 0xc0], ebx
mov byte [esp + 0xb0], bl
cmp dword [esp + 0x134], edi
jb 0x40334e
mov ecx, dword [esp + 0x120]
push ecx
call fcn.00408c1f
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x4d0]
xor ecx, esp
call fcn.00406f52
mov esp, ebp
pop ebp
ret 0x10
call dword [sym.imp.VFS.dll_start_client]
mov edi, dword [sym.imp.VFS.dll_client_connect]
xor ebx, ebx
mov dword [esp + 0xc], ebx
xor esi, esi
mov edi, edi
cmp dword [0x4215c0], 0x10
mov eax, dword [0x4215ac]
jae 0x403393
mov eax, 0x4215ac
push 0xbb8
push 0x3494
push eax
call edi
mov dword [0x4224b4], eax
cmp eax, ebx
jne 0x4033da
cmp dword [0x4215c0], 0x10
mov eax, dword [0x4215ac]
jae 0x4033bc
mov eax, 0x4215ac
push esi
push eax
push 0x41d318
mov ebx, 0x4224b8
call fcn.00401c20
inc esi
add esp, 0xc
xor ebx, ebx
cmp esi, 0x14
jl 0x403380
jmp 0x4033e2
mov dword [esp + 0xc], 1
lea edx, [esp + 0x3d0]
push 0x5c
push edx
call fcn.004086a5
add esp, 8
mov byte [eax + 1], bl
cmp dword [esp + 0xc], ebx
jne 0x4034ef
mov eax, dword [0x4215ac]
mov edi, 0x10
cmp dword [0x4215c0], edi
jae 0x403418
mov eax, 0x4215ac
push eax
push 0x41d338
mov ebx, 0x4224b8
call fcn.00401c20
add esp, 8
cmp dword [esp + 0x8c], edi
jb 0x403441
mov eax, dword [esp + 0x78]
push eax
call fcn.00408c1f
add esp, 4
xor ebx, ebx
mov esi, 0xf
mov dword [esp + 0x8c], esi
mov dword [esp + 0x88], ebx
mov byte [esp + 0x78], bl
cmp dword [esp + 0xa8], edi
jb 0x403473
mov ecx, dword [esp + 0x94]
push ecx
call fcn.00408c1f
add esp, 4
mov dword [esp + 0xa8], esi
mov dword [esp + 0xa4], ebx
mov byte [esp + 0x94], bl
cmp dword [esp + 0xc4], edi
jb 0x4034a1
mov edx, dword [esp + 0xb0]
push edx
call fcn.00408c1f
add esp, 4
mov dword [esp + 0xc4], esi
mov dword [esp + 0xc0], ebx
mov byte [esp + 0xb0], bl
cmp dword [esp + 0x134], edi
jb 0x40334e
mov eax, dword [esp + 0x120]
push eax
call fcn.00408c1f
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x4d0]
xor ecx, esp
call fcn.00406f52
mov esp, ebp
pop ebp
ret 0x10
push 1
mov edi, 0xf
push 0x41d144
lea ecx, [esp + 0x144]
mov dword [esp + 0x158], edi
mov dword [esp + 0x154], ebx
mov byte [esp + 0x144], bl
call fcn.00404fd0
push ebx
lea ecx, [esp + 0x124]
push ecx
or eax, 0xffffffff
lea esi, [esp + 0x144]
call fcn.00404c00
mov dword [esp + 0xe0], edi
mov dword [esp + 0xdc], ebx
mov byte [esp + 0xcc], bl
cmp dword [esp + 0x10], ebx
je 0x40359f
lea eax, [esp + 0x3d0]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x403560
sub eax, edx
push eax
lea edx, [esp + 0x3d4]
push edx
lea ecx, [esp + 0xd4]
call fcn.00404fd0
push ebx
lea eax, [esp + 0xb4]
push eax
or eax, 0xffffffff
lea esi, [esp + 0xd4]
call fcn.00404c00
push 1
mov eax, 0x41d144
jmp 0x403605
push 0x103
lea ecx, [esp + 0x2cd]
push ebx
push ecx
mov byte [esp + 0x2d4], bl
call fcn.0040ea90
add esp, 0xc
push 0x104
lea edx, [esp + 0x2cc]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [esp + 0x2c8]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4035e0
sub eax, edx
push eax
lea eax, [esp + 0x2cc]
push eax
lea ecx, [esp + 0xd4]
call fcn.00404fd0
push 8
mov eax, str.KHSafe_
lea ecx, [esp + 0xd0]
call fcn.00404cf0
mov eax, dword [0x4224b4]
lea ecx, [esp + 0xcc]
push ecx
lea edx, [esp + 0x140]
push edx
push eax
call fcn.00402550
mov eax, dword [esp + 0xa0]
mov edi, 0x10
add esp, 0xc
cmp dword [esp + 0xa8], edi
jae 0x40364b
lea eax, [esp + 0x94]
mov ecx, eax
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
cmp dl, bl
jne 0x403650
sub ecx, esi
push ecx
lea ecx, [esp + 0xd0]
call fcn.00404cf0
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0xd4]
push ecx
mov esi, 0xf
lea ecx, [esp + 0x110]
mov dword [esp + 0x124], esi
mov dword [esp + 0x120], ebx
mov byte [esp + 0x110], bl
call fcn.00404ee0
push 1
push 0x41d358
lea ecx, [esp + 0xf0]
mov dword [esp + 0x104], esi
mov dword [esp + 0x100], ebx
mov byte [esp + 0xf0], bl
call fcn.00404fd0
mov eax, dword [esp + 0x104]
cmp dword [esp + 0x118], edi
jae 0x4036d6
lea eax, [esp + 0x104]
mov ecx, eax
lea esi, [ecx + 1]
jmp 0x4036e0
mov dl, byte [ecx]
inc ecx
cmp dl, bl
jne 0x4036e0
sub ecx, esi
push ecx
lea ecx, [esp + 0xec]
call fcn.00404cf0
push 2
mov eax, 0x41d35c
lea ecx, [esp + 0xec]
call fcn.00404cf0
mov eax, dword [esp + 0x78]
cmp dword [esp + 0x8c], edi
jae 0x40371a
lea eax, [esp + 0x78]
mov ecx, eax
lea esi, [ecx + 1]
nop
mov dl, byte [ecx]
inc ecx
cmp dl, bl
jne 0x403720
sub ecx, esi
push ecx
lea ecx, [esp + 0xec]
call fcn.00404cf0
mov eax, dword [esp + 0x104]
cmp dword [esp + 0x118], edi
jae 0x40374d
lea eax, [esp + 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x403813
push 0x40
lea edx, [esp + 0x38]
push ebx
push edx
call fcn.0040ea90
mov esi, dword [esp + 0x24]
add esp, 0xc
push esi
mov dword [esp + 0x34], 0x44
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov eax, dword [esp + 0xe8]
cmp dword [esp + 0xfc], edi
jae 0x4037a0
lea eax, [esp + 0xe8]
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x34]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4037cc
mov eax, dword [esp + 0x24]
push eax
call esi
mov ecx, dword [esp + 0x20]
push ecx
call esi
jmp 0x403827
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x63
lea edx, [esp + 0x265]
push ebx
push edx
mov esi, eax
mov byte [esp + 0x26c], bl
call fcn.0040ea90
add esp, 0xc
push esi
lea eax, [esp + 0x264]
push 0x41d360
push eax
call fcn.00407224
add esp, 0xc
lea ecx, [esp + 0x260]
push ecx
call fcn.00401a20
jmp 0x403827
push 0x41d380
mov ebx, 0x4224b8
call fcn.00401c20
add esp, 4
xor ebx, ebx
cmp dword [esp + 0xfc], edi
jb 0x403840
mov edx, dword [esp + 0xe8]
push edx
call fcn.00408c1f
add esp, 4
mov esi, 0xf
mov dword [esp + 0xfc], esi
mov dword [esp + 0xf8], ebx
mov byte [esp + 0xe8], bl
cmp dword [esp + 0x118], edi
jb 0x403873
mov eax, dword [esp + 0x104]
push eax
call fcn.00408c1f
add esp, 4
mov dword [esp + 0x118], esi
mov dword [esp + 0x114], ebx
mov byte [esp + 0x104], bl
cmp dword [esp + 0xe0], edi
jb 0x4038a1
mov ecx, dword [esp + 0xcc]
push ecx
call fcn.00408c1f
add esp, 4
mov dword [esp + 0xe0], esi
mov dword [esp + 0xdc], ebx
mov byte [esp + 0xcc], bl
cmp dword [esp + 0x150], edi
jb 0x4038cf
mov edx, dword [esp + 0x13c]
push edx
call fcn.00408c1f
add esp, 4
mov dword [esp + 0x150], esi
mov dword [esp + 0x14c], ebx
mov byte [esp + 0x13c], bl
cmp dword [esp + 0x8c], edi
jb 0x4038fa
mov eax, dword [esp + 0x78]
push eax
call fcn.00408c1f
add esp, 4
mov dword [esp + 0x8c], esi
mov dword [esp + 0x88], ebx
mov byte [esp + 0x78], bl
cmp dword [esp + 0xa8], edi
jb 0x403925
mov ecx, dword [esp + 0x94]
push ecx
call fcn.00408c1f
add esp, 4
mov dword [esp + 0xa8], esi
mov dword [esp + 0xa4], ebx
mov byte [esp + 0x94], bl
cmp dword [esp + 0xc4], edi
jb 0x403953
mov edx, dword [esp + 0xb0]
push edx
call fcn.00408c1f
add esp, 4
mov dword [esp + 0xc4], esi
mov dword [esp + 0xc0], ebx
mov byte [esp + 0xb0], bl
cmp dword [esp + 0x134], edi
jb 0x403981
mov eax, dword [esp + 0x120]
push eax
call fcn.00408c1f
add esp, 4
mov ecx, dword [esp + 0x4dc]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00406f52
mov esp, ebp
pop ebp
ret 0x10