Function at 0x401410
Capabilities:
Check if file exists
Delete file
Extract resource via kernel32 functions
Move file
Set file attributes
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x408c7b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x31c
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
call fcn.004017f0
mov eax, dword [esp + 0x340]
mov ecx, dword [esp + 0x33c]
mov dword [eax], 0
mov dword [ecx], 0x21
lea ecx, [esp + 0x10]
call fcn.00402770
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x21]
mov byte [esp + 0x20], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x125]
mov byte [esp + 0x124], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [esp + 0x334], 0
mov ebx, str...SuperKiller.exe
stosb byte es:[edi], al
jmp 0x4014a3
mov esi, dword [esp + 0x14]
xor edx, edx
push 0x41043c
mov dx, word [ebx - 0x108]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x401735
lea eax, [esp + 0x124]
push 0x104
push eax
mov ecx, esi
call fcn.00401d00
push edi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x401735
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebp, eax
test ebp, ebp
je 0x401735
push 0x410430
push ebx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x401545
lea ecx, [esp + 0x124]
push 0x104
push ecx
call fcn.00401a00
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendA]
add esp, 8
lea edx, [esp + 0x124]
push 0x410430
push edx
call esi
lea eax, [esp + 0x124]
push 0x410420
push eax
call esi
jmp 0x401554
lea ecx, [esp + 0x124]
push ebx
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea edx, [esp + 0x124]
lea eax, [esp + 0x228]
push edx
push str._s.xmp
push 0x104
push eax
call fcn.00401fd0
add esp, 0x10
lea ecx, [esp + 0x228]
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x401735
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
xor edi, edi
lea edx, [esp + 0x1c]
push edi
push edx
push eax
push ebp
push esi
mov dword [esp + 0x30], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x124]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x4015da
mov edi, 1
mov ebp, dword [esp + 0x14]
lea ecx, [esp + 0x20]
push 0x104
push ecx
mov ecx, ebp
call fcn.00401d00
lea edx, [esp + 0x20]
push ebx
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
mov ecx, 0x104
lea eax, [esp + 0x20]
cmp byte [eax], 0
je 0x40160f
inc eax
dec ecx
jne 0x401604
jmp 0x401657
test ecx, ecx
je 0x401657
lea eax, [esp + 0x18]
test eax, eax
je 0x401628
mov eax, 0x104
sub eax, ecx
mov dword [esp + 0x18], eax
jmp 0x40162c
mov eax, dword [esp + 0x18]
mov edx, 0x104
sub edx, eax
lea eax, [esp + eax + 0x20]
je 0x401657
mov esi, str.Cvg.7Zip
sub esi, eax
mov cl, byte [esi + eax]
test cl, cl
je 0x40164f
mov byte [eax], cl
inc eax
dec edx
jne 0x401640
jmp 0x401653
test edx, edx
jne 0x401654
dec eax
mov byte [eax], 0
lea ecx, [esp + 0x20]
lea edx, [esp + 0x228]
push ecx
push edx
call fcn.004028c0
add esp, 8
test eax, eax
je 0x40177b
lea eax, [esp + 0x124]
lea ecx, [esp + 0x20]
push eax
push ecx
mov ecx, ebp
call fcn.00401e30
test eax, eax
jg 0x401690
test edi, edi
je 0x4016f4
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [esp + 0x124]
push 0x80
push edx
call esi
lea eax, [esp + 0x124]
push 1
lea ecx, [esp + 0x24]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
push 0x80
je 0x4017a2
lea edx, [esp + 0x24]
push edx
call esi
lea eax, [esp + 0x228]
push 0x80
push eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x20]
push ecx
call esi
lea edx, [esp + 0x228]
push edx
jmp 0x40172a
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [esp + 0x20]
push 0x80
push eax
call esi
lea ecx, [esp + 0x228]
push 0x80
push ecx
call esi
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [esp + 0x20]
push edx
call esi
lea eax, [esp + 0x228]
push eax
call esi
mov eax, dword [esp + 0x340]
inc dword [eax]
add ebx, 0x20c
cmp ebx, 0x410514
jb 0x40149f
lea ecx, [esp + 0x10]
mov dword [esp + 0x334], 0xffffffff
call fcn.004027a0
mov eax, 1
mov ecx, dword [esp + 0x32c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x328
ret 8
lea ecx, [esp + 0x20]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [esp + 0x20]
push edx
call esi
lea eax, [esp + 0x228]
push eax
jmp 0x4017d3
lea ecx, [esp + 0x24]
push ecx
call esi
lea edx, [esp + 0x228]
push 0x80
push edx
call esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 0x20]
push eax
call esi
lea ecx, [esp + 0x228]
push ecx
call esi
lea ecx, [esp + 0x10]
mov dword [esp + 0x334], 0xffffffff
call fcn.004027a0
xor eax, eax
jmp 0x401760