Function at 0x403650
Capabilities:
Check if file exists
Check mutex on windows
Create process on windows
Delete file
Get file attributes
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x417f70
mov eax, dword fs:[0]
push eax
sub esp, 0x758
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0x10]
push str.WinMain
call dword [sym.imp.VMProtectSDK32.dll_VMProtectBegin]
push str.vuahaitac_568play
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ebx, eax
mov dword [ebp - 0x750], ebx
test ebx, ebx
je 0x403764
cmp ebx, 0xffffffff
je 0x403764
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x403764
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004096f0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
dec eax
cmp word [ebp + eax*2 - 0x218], 0x5c
je 0x40371c
nop dword [eax + eax]
dec eax
cmp word [ebp + eax*2 - 0x218], 0x5c
jne 0x403710
lea eax, [eax*2 + 2]
cmp eax, 0x208
jae 0x403bde
xor ecx, ecx
mov word [ebp + eax - 0x218], cx
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push ecx
call fcn.00403350
add esp, 4
test eax, eax
jne 0x403784
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.META_INF_AIR_appeasy
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040802b
mov esp, ebp
pop ebp
ret 0x10
push 0x7c
lea eax, [ebp - 0x6a4]
push 0
push eax
call fcn.004096f0
lea eax, [ebp - 0x6e8]
mov dword [ebp - 0x6ec], 0
mov dword [ebp - 0x6b4], eax
add esp, 0xc
lea eax, [ebp - 0x6d4]
mov dword [ebp - 0x6e4], 0
mov dword [ebp - 0x6f0], eax
xorps xmm0, xmm0
mov dword [ebp - 0x6c0], eax
lea eax, [ebp - 0x6b4]
push 0x41e318
mov dword [ebp - 0x6e8], eax
lea eax, [ebp - 0x73c]
push str.META_INF_AIR_application.xml
push eax
mov dword [ebp - 0x6e0], 0
mov dword [ebp - 0x6d8], 0
mov dword [ebp - 0x6dc], 0x7fec
movups xmmword [ebp - 0x6d0], xmm0
mov dword [ebp - 0x6bc], 0
mov dword [ebp - 0x6b8], 0
mov dword [ebp - 0x6d4], 0x1401
mov dword [ebp - 0x6b0], 0x7fec
mov dword [ebp - 0x6ac], 0
mov dword [ebp - 0x6a8], 0
mov dword [ebp - 0x73c], 0
call fcn.0040b732
mov edx, dword [ebp - 0x6f0]
lea ecx, [ebp - 0x764]
add esp, 0xc
xor esi, esi
test eax, eax
lea eax, [ebp - 0x6ec]
cmove esi, dword [ebp - 0x73c]
push eax
sub esp, 8
push esi
call fcn.00406c00
add esp, 0x10
test esi, esi
je 0x403893
push esi
call fcn.0040b89e
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x764], 0
je 0x403928
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.META_INF_AIR_appeasy
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x6ec]
test eax, eax
je 0x4038d6
push eax
call fcn.0040bcaf
add esp, 4
mov dword [ebp - 0x6ec], 0
mov ecx, dword [ebp - 0x6f0]
mov esi, dword [ecx + 0x2c]
test esi, esi
je 0x4038ff
mov eax, dword [esi]
test eax, eax
je 0x4038f2
push eax
call fcn.0040bcaf
add esp, 4
mov esi, dword [esi + 4]
test esi, esi
jne 0x4038e3
mov ecx, dword [ebp - 0x6f0]
mov eax, dword [ecx]
shr eax, 8
sub ecx, eax
mov eax, dword [ecx + 8]
test eax, eax
je 0x403764
mov esi, dword [eax + 8]
push eax
call fcn.0040bcaf
add esp, 4
mov eax, esi
test esi, esi
jne 0x403911
jmp 0x403764
mov eax, dword [ebp - 0x6f0]
test eax, eax
je 0x403935
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x73c], eax
lea ecx, [ebp - 0x73c]
push str.content
lea eax, [ebp - 0x754]
push eax
push str.initialWindow
lea eax, [ebp - 0x758]
push eax
call fcn.00406d70
mov ecx, eax
call fcn.00406d70
mov edx, dword [eax]
test edx, edx
je 0x4039a5
mov edx, dword [edx + 0x10]
test edx, edx
je 0x4039a5
mov ecx, dword [edx]
and ecx, 0xf
cmp ecx, 3
je 0x403992
mov eax, edx
cmp ecx, 4
je 0x403992
cmp ecx, 5
je 0x403992
cmp ecx, 6
je 0x403992
cmp ecx, 8
jne 0x4039a5
push 0x14
push str.META_INF_AIR_appeasy
push ecx
lea ecx, [edx + 8]
call fcn.00407b10
add esp, 0xc
sub esp, 0x10
lea ecx, [ebp - 0x6f0]
call fcn.004072e0
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.004096f0
mov ecx, edi
add esp, 0xc
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4039d0
push 0x104
lea eax, [ebp - 0x420]
sub ecx, edx
push eax
push ecx
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0x208
lea eax, [ebp - 0x628]
push 0
push eax
call fcn.004096f0
add esp, 0xc
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x628]
push 0x41e2b0
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x738]
mov ecx, 0x44
nop
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x403a30
mov dword [ebp - 0x738], 0x44
lea eax, [ebp - 0x74c]
mov ecx, 0x10
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x403a50
lea eax, [ebp - 0x74c]
push eax
lea eax, [ebp - 0x738]
push eax
push ecx
push ecx
push 0x20
push ecx
push ecx
push ecx
lea eax, [ebp - 0x628]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x403acf
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push str.META_INF_AIR_appeasy
call ebx
cmp eax, 0xffffffff
je 0x403ab3
test al, 0x10
jne 0x403ab3
push 0x3e8
inc esi
call edi
cmp esi, 0xa
jb 0x403a96
push dword [ebp - 0x74c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x748]
call esi
mov ebx, dword [ebp - 0x750]
mov eax, dword [ebp - 0x6f0]
test eax, eax
je 0x403adc
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x750], eax
lea ecx, [ebp - 0x750]
push str.content
lea eax, [ebp - 0x758]
push eax
push str.initialWindow
lea eax, [ebp - 0x754]
push eax
call fcn.00406d70
mov ecx, eax
call fcn.00406d70
mov edx, dword [eax]
test edx, edx
je 0x403b4c
mov edx, dword [edx + 0x10]
test edx, edx
je 0x403b4c
mov ecx, dword [edx]
and ecx, 0xf
cmp ecx, 3
je 0x403b39
mov eax, edx
cmp ecx, 4
je 0x403b39
cmp ecx, 5
je 0x403b39
cmp ecx, 6
je 0x403b39
cmp ecx, 8
jne 0x403b4c
push 0xb
push str.Vua_H
push ecx
lea ecx, [edx + 8]
call fcn.00407b10
add esp, 0xc
sub esp, 0x10
lea ecx, [ebp - 0x6f0]
call fcn.004072e0
push ebx
call esi
push str.META_INF_AIR_appeasy
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call dword [sym.imp.VMProtectSDK32.dll_VMProtectEnd]
mov eax, dword [ebp - 0x6ec]
test eax, eax
je 0x403b8b
push eax
call fcn.0040bcaf
add esp, 4
mov dword [ebp - 0x6ec], 0
mov ecx, dword [ebp - 0x6f0]
mov esi, dword [ecx + 0x2c]
test esi, esi
je 0x403bb4
mov eax, dword [esi]
test eax, eax
je 0x403ba7
push eax
call fcn.0040bcaf
add esp, 4
mov esi, dword [esi + 4]
test esi, esi
jne 0x403b98
mov ecx, dword [ebp - 0x6f0]
mov eax, dword [ecx]
shr eax, 8
sub ecx, eax
mov eax, dword [ecx + 8]
test eax, eax
je 0x403bd4
mov esi, dword [eax + 8]
push eax
call fcn.0040bcaf
add esp, 4
mov eax, esi
test esi, esi
jne 0x403bc2
mov eax, 1
jmp 0x403766
call fcn.0040815c
int3