Function at 0x406050
Capabilities:
Delete file
Extract resource via kernel32 functions
Get common file path
Write file on windows

Disassembly:
sub esp, 0x244
mov eax, dword [0x41c060]
xor eax, esp
mov dword [esp + 0x240], eax
xor eax, eax
push esi
mov esi, dword [esp + 0x24c]
push 0x103
push eax
mov dword [esp + 0x25], eax
mov dword [esp + 0x29], eax
mov dword [esp + 0x2d], eax
mov dword [esp + 0x31], eax
mov dword [esp + 0x35], eax
mov dword [esp + 0x39], eax
mov dword [esp + 0x3d], eax
mov word [esp + 0x41], ax
mov byte [esp + 0x43], al
mov byte [esp + 0x44], al
lea eax, [esp + 0x45]
push eax
mov dword [esp + 0x1c], esi
mov dword [esp + 0x10], 0x80004005
mov byte [esp + 0x28], 0
call fcn.004075f0
push 0x103
lea ecx, [esp + 0x151]
push 0
push ecx
mov byte [esp + 0x158], 0
call fcn.004075f0
add esp, 0x18
test esi, esi
mov dword [esp + 8], 0
je 0x40635e
mov esi, dword [sym.imp.KERNEL32.dll_FindResourceA]
push ebx
push ebp
push edi
push 0xa
push 0x417edc
push 0
call esi
push 0xa
push 0x417ed8
push 0
mov edi, eax
call esi
push 0xa
push 0x417ed4
push 0
mov ebp, eax
call esi
test edi, edi
mov ebx, eax
je 0x40638e
test ebp, ebp
je 0x40638e
test ebx, ebx
je 0x40638e
mov esi, dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push 0
call esi
push ebp
push 0
mov dword [esp + 0x28], eax
call esi
push ebx
push 0
mov dword [esp + 0x2c], eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadResource]
push edi
push 0
mov dword [esp + 0x20], eax
call esi
push ebp
push 0
mov edi, eax
call esi
push ebx
push 0
mov ebp, eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_LockResource]
push edi
mov ebx, eax
call esi
push ebp
mov edi, eax
call esi
push ebx
mov ebp, eax
call esi
test edi, edi
mov esi, eax
je 0x406378
cmp dword [esp + 0x20], 0
jbe 0x406378
test ebp, ebp
je 0x406378
mov ebx, dword [esp + 0x24]
test ebx, ebx
jbe 0x406378
test esi, esi
je 0x406378
mov edi, dword [esp + 0x18]
test edi, edi
jbe 0x406378
push ebx
push ebp
call fcn.00405650
add esp, 8
test eax, eax
jne 0x4061e1
push 0x30
push str.Error
push str.Encrypt_File_Failed_
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40635b
push ebx
push ebp
push 0
call fcn.00405550
push eax
lea edx, [esp + 0x38]
push 0x417e7c
push edx
call fcn.00409727
push edi
lea eax, [esp + 0x44]
push eax
push esi
call fcn.00409710
add esp, 0x24
test eax, eax
je 0x406244
push 0x30
push str.Error
push esi
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call esi
push 0x30
push str.Error
lea ecx, [esp + 0x30]
push ecx
push 0
call esi
push 0x30
push str.Error
push str.Check_sum_failed_
push 0
call esi
jmp 0x40635b
lea edx, [esp + 0x14c]
push edx
push 0x104
call fcn.00405ef0
add esp, 8
test eax, eax
jne 0x406275
push 0x30
push str.Error
push str.GetTempPath_failed_
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40635b
lea eax, [esp + 0x48]
push eax
push 0
push 0x417eb8
lea ecx, [esp + 0x158]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x4062ab
push 0x30
push str.Error
push str.GetWinTempPath_failed_
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40635b
lea edx, [esp + 0x48]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 0x48]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4062c0
sub eax, edx
cmp eax, 4
jb 0x40635b
push 0
push 0xa0
push 2
lea eax, [esp + eax + 0x54]
push 0
mov cl, 0x45
push 1
mov byte [eax - 4], 0x2e
mov byte [eax - 3], cl
mov byte [eax - 2], 0x58
mov byte [eax - 1], cl
push 0x40000000
lea eax, [esp + 0x60]
push eax
mov dword [esp + 0x2c], 1
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
test esi, esi
je 0x40635b
cmp esi, 0xffffffff
je 0x406354
push 0
lea ecx, [esp + 0x18]
push ecx
push ebx
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x406354
cmp dword [esp + 0x14], ebx
jne 0x406354
mov edx, dword [esp + 0x25c]
mov ecx, dword [esp + 0x1c]
push edx
lea eax, [esp + 0x4c]
push eax
push ecx
call fcn.00407ae1
add esp, 0xc
mov dword [esp + 0x10], 0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x244]
mov eax, dword [esp + 4]
pop esi
xor ecx, esp
call fcn.004075d4
add esp, 0x244
ret
push 0x30
push str.Error
push 0x417e50
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40635b
push 0x30
push str.Error
push str.One_Resource_is_Lost_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40635b