Function at 0x40b58b
Capabilities:
Check if file exists
Copy file
Encrypt data using rc4 ksa
Extract resource via kernel32 functions
Get common file path
Get file attributes

Disassembly:
mov eax, 0x438380
call fcn.0041cf48
sub esp, 0x784
mov eax, dword [0x44e670]
push ebx
xor ebx, ebx
xor eax, ebp
push esi
mov dword [ebp - 0x10], eax
push edi
mov dword [ebp - 0x704], ebx
mov dword [ebp - 0x700], ebx
mov dword [ebp - 0x6fc], ebx
mov dword [ebp - 4], ebx
xor edi, edi
xor esi, esi
lea eax, [ebp - 0x6d8]
push eax
push esi
push edi
call fcn.00411b2d
add esp, 0xc
test eax, eax
jne 0x40b66f
mov eax, dword [ebp - 0x6d8]
mov dword [ebp - 0x6dc], eax
lea eax, [ebp - 0x6dc]
push eax
lea ecx, [ebp - 0x708]
call fcn.0040b54b
inc esi
cmp esi, 7
jb 0x40b5c3
inc edi
cmp edi, 7
jb 0x40b5c1
mov dword [ebp - 0x6f4], ebx
mov dword [ebp - 0x6f0], ebx
mov dword [ebp - 0x6ec], ebx
lea eax, [ebp - 0x72c]
push eax
lea eax, [ebp - 0x618]
push eax
mov byte [ebp - 4], 1
call fcn.00411bd9
lea eax, [ebp - 0x70c]
push eax
call fcn.00411c2d
lea eax, [ebp - 0x6e8]
push eax
lea eax, [ebp - 0x6e0]
push eax
call fcn.00411c69
mov eax, dword [ebp - 0x70c]
add esp, 0x14
cmp eax, 0xffffffff
push dword [ebp + 0xc]
je 0x40b6a5
inc eax
cmp byte [ebp + 8], bl
lea ecx, [ebp - 0x618]
je 0x40b687
push 1
jmp 0x40b688
push ebx
push str.GetNum
push 0xb5
call fcn.00403c8a
add esp, 0xc
jmp 0x40bb01
push ebx
push dword [ebp - 0x6e4]
push dword [ebp - 0x6e8]
push dword [ebp - 0x6e0]
push ecx
lea ecx, [ebp - 0x6f8]
push ecx
push eax
jmp 0x40b6d1
cmp byte [ebp + 8], bl
lea eax, [ebp - 0x618]
je 0x40b6b4
push 1
jmp 0x40b6b5
push ebx
push dword [ebp - 0x6e4]
push dword [ebp - 0x6e8]
push dword [ebp - 0x6e0]
push eax
lea eax, [ebp - 0x6f8]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x708]
push eax
call fcn.00412375
add esp, 0x24
call fcn.0040adb5
push eax
lea ecx, [ebp - 0x650]
call fcn.004046ce
mov byte [ebp - 4], 2
call fcn.00411949
mov eax, dword [eax]
mov dword [ebp - 0x71c], eax
call fcn.00411949
mov eax, dword [eax + 4]
mov dword [ebp - 0x718], eax
call fcn.00411949
mov eax, dword [eax + 8]
mov dword [ebp - 0x714], eax
call fcn.00411949
cmp dword [ebp - 0x638], 0x10
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x710], eax
mov eax, dword [ebp - 0x64c]
jae 0x40b741
lea eax, [ebp - 0x64c]
push eax
lea ecx, [ebp - 0x6d8]
call fcn.0040ac70
push ebx
push ebx
lea ecx, [ebp - 0x6d8]
mov byte [ebp - 4], 3
call fcn.0040ac99
mov edi, eax
push edi
call fcn.0042ae65
pop ecx
mov esi, eax
push edi
push esi
lea ecx, [ebp - 0x6d8]
call fcn.0040ac99
lea ecx, [ebp - 0x70c]
push ecx
lea ecx, [ebp - 0x71c]
lea eax, [esi + edi]
push ecx
push eax
push esi
mov dword [ebp - 0x6dc], eax
call fcn.0040ac24
push esi
mov edi, eax
call fcn.0042ae6a
add esp, 0x14
cmp edi, dword [ebp - 0x6dc]
jne 0x40b7d7
push ebx
push 0x43b3d0
push 0xb5
call fcn.00403c8a
add esp, 0xc
cmp dword [ebp - 0x6d8], ebx
je 0x40bae8
push dword [ebp - 0x6d8]
call fcn.0041d5a3
pop ecx
jmp 0x40bae8
sub edi, esi
cmp dword [ebp - 0x6d8], ebx
mov dword [ebp - 0x6dc], edi
je 0x40b7f3
push dword [ebp - 0x6d8]
call fcn.0041d5a3
pop ecx
xor esi, esi
push ebx
lea ecx, [ebp - 0x634]
inc esi
mov dword [ebp - 0x61c], 0xf
call fcn.004040c6
mov byte [ebp - 4], 4
push esi
lea ecx, [ebp - 0x790]
call fcn.0040245f
push eax
lea eax, [ebp - 0x650]
push eax
lea eax, [ebp - 0x728]
push eax
call fcn.0040b0d6
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x634]
mov byte [ebp - 4], 5
call fcn.0040446c
push ebx
push 1
lea ecx, [ebp - 0x728]
mov byte [ebp - 4], 4
call fcn.004041b4
mov eax, dword [ebp - 0x630]
push 0x10
pop edi
cmp dword [ebp - 0x61c], edi
jae 0x40b86f
lea eax, [ebp - 0x630]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40b87e
inc esi
jmp 0x40b810
cmp dword [ebp - 0x61c], edi
mov ecx, dword [ebp - 0x630]
jae 0x40b892
lea ecx, [ebp - 0x630]
cmp dword [ebp - 0x638], edi
mov eax, dword [ebp - 0x64c]
jae 0x40b8a6
lea eax, [ebp - 0x64c]
push 1
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x40b8cc
push ebx
push 0x43b3c0
push 0xb5
call fcn.00403c8a
add esp, 0xc
jmp 0x40bada
cmp dword [ebp - 0x61c], edi
mov eax, dword [ebp - 0x630]
jae 0x40b8e0
lea eax, [ebp - 0x630]
push eax
lea ecx, [ebp - 0x6a0]
call fcn.0040b311
cmp dword [ebp - 0x6f4], ebx
mov byte [ebp - 4], 6
jne 0x40b8fc
xor eax, eax
jmp 0x40b908
mov eax, dword [ebp - 0x6f0]
sub eax, dword [ebp - 0x6f4]
push eax
push dword [ebp - 0x6f4]
lea ecx, [ebp - 0x6a0]
push ebx
push dword [ebp - 0x6dc]
call fcn.0040ae7f
cmp dword [ebp - 0x70c], ebx
jne 0x40b98f
call fcn.004023a9
xor edx, edx
mov ecx, 0x500001
div ecx
lea esi, [edx + 0x500000]
shr esi, 0xc
shl esi, 0xc
push esi
call fcn.0042ae65
xor edi, edi
cmp esi, ebx
pop ecx
mov dword [ebp - 0x6d8], eax
jbe 0x40b96e
call fcn.004023a9
mov ecx, dword [ebp - 0x6d8]
and eax, 0xff
mov byte [edi + ecx], al
inc edi
cmp edi, esi
jb 0x40b956
push esi
push dword [ebp - 0x6d8]
lea ecx, [ebp - 0x6a0]
push 2
push ebx
call fcn.0040ae7f
push dword [ebp - 0x6d8]
call fcn.0042ae6a
pop ecx
push 0x6f
push 0x84
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
cmp esi, ebx
jne 0x40b9bb
push ebx
push 0x43b3a8
push 0xb5
call fcn.00403c8a
add esp, 0xc
jmp 0x40bacf
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x114]
push eax
push ebx
push 0x43b3a4
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push 1
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x6d4]
call fcn.0040b2ae
push esi
push edi
lea ecx, [ebp - 0x6d4]
mov byte [ebp - 4], 7
call fcn.0040ae2b
mov esi, 0x43b384
push esi
lea ecx, [ebp - 0x66c]
call fcn.004046ce
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x634]
push eax
lea ecx, [ebp - 0x66c]
mov byte [ebp - 4], 8
call fcn.0040af54
push 0x43b3a0
lea ecx, [ebp - 0x66c]
call fcn.0040b079
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x650]
push eax
lea ecx, [ebp - 0x66c]
call fcn.0040af54
push esi
lea ecx, [ebp - 0x66c]
call fcn.0040b079
cmp dword [ebp - 0x654], 0x10
mov eax, dword [ebp - 0x668]
jae 0x40ba90
lea eax, [ebp - 0x668]
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.0040b124
test al, al
pop ecx
pop ecx
push ebx
jne 0x40bab7
push 0x43b38c
push 0xb5
call fcn.00403c8a
add esp, 0xc
push ebx
lea ecx, [ebp - 0x66c]
push 1
call fcn.004041b4
lea ecx, [ebp - 0x6d4]
call fcn.0040aef6
lea ecx, [ebp - 0x6a0]
call fcn.0040aef6
push ebx
lea ecx, [ebp - 0x634]
push 1
call fcn.004041b4
push ebx
lea ecx, [ebp - 0x650]
push 1
call fcn.004041b4
lea ecx, [ebp - 0x6f8]
call fcn.0040af10
lea ecx, [ebp - 0x708]
call fcn.0040af10
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
xor ecx, ebp
pop ebx
call fcn.0041c33e
leave
ret