Function at 0x40fef0
Capabilities:
Check if file exists
Delete file
Extract resource via kernel32 functions
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ab469
mov eax, dword fs:[0]
push eax
sub esp, 0x5bc
mov eax, dword [0x4d82a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x5ac], ecx
cmp dword [0x4dd440], 0
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
jne 0x40ff38
call fcn.00409450
mov ecx, dword [0x4dd440]
call fcn.004503bd
mov edx, eax
mov dword [ebp - 0x368], 7
xor eax, eax
mov dword [ebp - 0x36c], 0
mov word [ebp - 0x37c], ax
cmp word [edx], ax
jne 0x40ff6b
xor ecx, ecx
jmp 0x40ff7f
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40ff70
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x37c]
call fcn.00407de0
xor eax, eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x350], 7
mov dword [ebp - 0x354], 0
mov word [ebp - 0x364], ax
cmp word [ebx], ax
jne 0x40ffb9
xor ecx, ecx
jmp 0x40ffcf
mov ecx, ebx
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40ffc0
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [ebp - 0x364]
call fcn.00407de0
xor eax, eax
mov byte [ebp - 4], 1
push 0xffffffffffffffff
push eax
mov word [ebp - 0x334], ax
lea ecx, [ebp - 0x334]
lea eax, [ebp - 0x37c]
mov dword [ebp - 0x320], 7
push eax
mov dword [ebp - 0x324], 0
call fcn.00407cc0
xor eax, eax
mov byte [ebp - 4], 2
push 0xffffffffffffffff
push eax
mov word [ebp - 0x34c], ax
lea ecx, [ebp - 0x34c]
lea eax, [ebp - 0x364]
mov dword [ebp - 0x338], 7
push eax
mov dword [ebp - 0x33c], 0
call fcn.00407cc0
lea eax, [ebp - 0x334]
mov byte [ebp - 4], 3
push eax
call fcn.00456d61
lea eax, [ebp - 0x34c]
push eax
call fcn.00456d61
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x334]
add esp, 8
mov byte [ebp - 0x5a5], 1
cmp dword [ebp - 0x320], 8
cmovae eax, dword [ebp - 0x334]
push eax
call esi
test eax, eax
je 0x4100aa
mov ecx, dword [ebp - 0x5ac]
lea eax, [ebp - 0x334]
push eax
call fcn.00410ea0
test al, al
sete byte [ebp - 0x5a5]
cmp dword [ebp - 0x338], 8
lea ecx, [ebp - 0x34c]
push dword [ebp - 0x33c]
cmovae ecx, dword [ebp - 0x34c]
lea eax, [ebp - 0x334]
cmp dword [ebp - 0x320], 8
push ecx
cmovae eax, dword [ebp - 0x334]
push dword [ebp - 0x324]
push eax
call fcn.004076b0
add esp, 0x10
test eax, eax
je 0x41012e
cmp dword [ebp - 0x368], 8
lea eax, [ebp - 0x37c]
cmovae eax, dword [ebp - 0x37c]
push eax
call esi
test eax, eax
je 0x41012e
cmp dword [ebp - 0x368], 8
lea eax, [ebp - 0x37c]
cmovae eax, dword [ebp - 0x37c]
sub esp, 0x18
mov ecx, esp
push eax
call fcn.00404610
call fcn.0045643f
add esp, 0x18
cmp byte [ebp - 0x5a5], 0
jne 0x41015c
cmp dword [0x4dd440], 0
jne 0x410145
call fcn.00409450
mov ecx, dword [0x4dd440]
push 1
push 0x4b19c4
push str.AppSetting
call fcn.0045149f
push ebx
call esi
test eax, eax
je 0x410176
sub esp, 0x18
mov ecx, esp
push ebx
call fcn.00404610
call fcn.0045643f
add esp, 0x18
mov ecx, dword [ebp - 0x5ac]
call fcn.00410bf0
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00462120
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x218]
push eax
call fcn.00455eb7
add esp, 4
push str.ZZZZ
push str.SoftData
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x410aa1
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push edi
mov dword [ebp - 0x5c0], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0x1869f
push 0x2710
mov dword [ebp - 0x5ac], eax
call fcn.004586e1
cdq
push edx
push eax
lea eax, [ebp - 0x424]
push eax
call fcn.00458654
add esp, 0x14
lea ecx, [ebp - 0x218]
mov byte [ebp - 4], 4
add ecx, 0xfffffffe
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x410224
mov eax, dword [0x4af848]
lea edi, [ebp - 0x218]
mov dword [ecx], eax
add edi, 0xfffffffe
mov eax, dword [str.nSuZip]
mov dword [ecx + 4], eax
mov eax, dword [0x4af850]
mov dword [ecx + 8], eax
mov eax, dword [0x4af854]
mov dword [ecx + 0xc], eax
mov ax, word [0x4af858]
mov word [ecx + 0x10], ax
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x410262
cmp dword [ebp - 0x410], 8
lea edx, [ebp - 0x424]
mov eax, dword [0x4b19f0]
cmovae edx, dword [ebp - 0x424]
mov dword [edi], eax
mov esi, edx
nop dword [eax + eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x410290
lea edi, [ebp - 0x218]
sub edx, esi
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4102a6
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x218]
add ecx, 0xfffffffe
nop dword [eax]
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x4102d0
mov eax, dword [0x4b19f4]
mov dword [ecx], eax
mov eax, dword [0x4b19f8]
mov dword [ecx + 4], eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41030b
lea eax, [ebp - 0x218]
push eax
call fcn.0045827b
add esp, 4
push 0
push 0x80
push 1
push 0
push 1
push 0x40000000
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x41035e
push 0
lea eax, [ebp - 0x5c8]
mov dword [ebp - 0x5c8], 0
push eax
push dword [ebp - 0x5ac]
push dword [ebp - 0x5c0]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x104
lea eax, [ebp - 0x31c]
push 0
push eax
call fcn.00462120
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00456d32
add esp, 0x14
cmp dword [0x4dd440], 0
jne 0x410395
call fcn.00409450
mov ecx, dword [0x4dd440]
call fcn.00406760
cmp dword [0x4dd440], 0
jne 0x4103ae
call fcn.00409450
mov ecx, dword [0x4dd440]
call fcn.00404b70
lea ecx, [ebp - 0x5bc]
xor esi, esi
cmp dword [ebp - 0x350], 8
lea eax, [ebp - 0x364]
push ecx
cmovae eax, dword [ebp - 0x364]
lea ecx, [ebp - 0x31c]
push fcn.00410b90
push ecx
push eax
mov dword [ebp - 0x5bc], esi
call fcn.00458964
add esp, 0x10
mov dword [ebp - 0x3f8], 7
xor eax, eax
mov dword [ebp - 0x3fc], esi
lea ecx, [ebp - 0x40c]
mov word [ebp - 0x40c], ax
push eax
push 0x4af804
call fcn.00407de0
xor eax, eax
mov byte [ebp - 4], 5
push eax
push 0x4af804
lea ecx, [ebp - 0x394]
mov dword [ebp - 0x380], 7
mov dword [ebp - 0x384], esi
mov word [ebp - 0x394], ax
call fcn.00407de0
push ebx
lea ecx, [ebp - 0x3ac]
mov byte [ebp - 4], 6
call fcn.00404610
push 0xb
push str.Yematou.exe
lea ecx, [ebp - 0x3ac]
mov byte [ebp - 4], 7
call fcn.00407960
cmp dword [0x4dd440], esi
jne 0x41047c
call fcn.00409450
mov ecx, dword [0x4dd440]
call fcn.00405770
cmp dword [0x4dd440], 0
mov dword [ebp - 0x5ac], eax
jne 0x41049b
call fcn.00409450
mov ecx, dword [0x4dd440]
call fcn.00405750
mov ebx, eax
lea ecx, [ebp - 0x58c]
push ebx
call fcn.00404610
push 2
push 0
push 0x4b19fc
lea ecx, [ebp - 0x58c]
mov byte [ebp - 4], 8
call fcn.004084e0
cmp dword [0x4dd440], 0
mov dword [ebp - 0x5c0], eax
jne 0x4104e0
call fcn.00409450
mov ecx, dword [0x4dd440]
call fcn.00405720
test eax, eax
mov edi, 1
cmovne esi, edi
cmp dword [0x4dd440], 0
mov dword [ebp - 0x5c4], esi
jne 0x410509
call fcn.00409450
mov ecx, dword [0x4dd440]
call fcn.004056f0
neg eax
sbb eax, eax
neg eax
cmp dword [ebp + 0xc], 0
cmove edi, eax
cmp dword [0x4dd440], 0
jne 0x41052f
call fcn.00409450
mov ecx, dword [0x4dd440]
call fcn.00405730
mov esi, eax
mov dword [ebp - 0x5b8], 0
neg esi
mov dword [ebp - 0x5b4], 0
mov dword [ebp - 0x5b0], 0
sbb esi, esi
and esi, 1
mov ecx, dword [ebp - 0x5ac]
mov byte [ebp - 4], 9
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x410570
sub ecx, edx
sar ecx, 1
je 0x4106a6
push str.7787
lea ecx, [ebp - 0x43c]
call fcn.00404610
lea eax, [ebp - 0x43c]
mov byte [ebp - 4], 0xa
push eax
lea ecx, [ebp - 0x5b8]
call fcn.004085d0
mov eax, dword [ebp - 0x428]
mov byte [ebp - 4], 9
cmp eax, 8
jb 0x4105cd
inc eax
lea ecx, [ebp - 0x43c]
push eax
push dword [ebp - 0x43c]
call fcn.00407fb0
push dword [ebp - 0x5ac]
lea ecx, [ebp - 0x454]
call fcn.00404610
lea eax, [ebp - 0x454]
mov byte [ebp - 4], 0xb
push eax
lea ecx, [ebp - 0x5b8]
call fcn.004085d0
mov eax, dword [ebp - 0x440]
mov byte [ebp - 4], 9
cmp eax, 8
jb 0x410616
inc eax
lea ecx, [ebp - 0x454]
push eax
push dword [ebp - 0x454]
call fcn.00407fb0
push str.0ba0
lea ecx, [ebp - 0x46c]
call fcn.00404610
lea eax, [ebp - 0x46c]
mov byte [ebp - 4], 0xc
push eax
lea ecx, [ebp - 0x5b8]
call fcn.004085d0
mov eax, dword [ebp - 0x458]
mov byte [ebp - 4], 9
cmp eax, 8
jb 0x41065e
inc eax
lea ecx, [ebp - 0x46c]
push eax
push dword [ebp - 0x46c]
call fcn.00407fb0
push ebx
lea ecx, [ebp - 0x3c4]
call fcn.00404610
lea eax, [ebp - 0x3c4]
mov byte [ebp - 4], 0xd
push eax
lea ecx, [ebp - 0x5b8]
call fcn.004085d0
mov eax, dword [ebp - 0x3b0]
mov byte [ebp - 4], 9
cmp eax, 8
jb 0x410732
inc eax
lea ecx, [ebp - 0x3c4]
push eax
push dword [ebp - 0x3c4]
jmp 0x41072d
push str.0ba0
lea ecx, [ebp - 0x3dc]
call fcn.00404610
lea eax, [ebp - 0x3dc]
mov byte [ebp - 4], 0xe
push eax
lea ecx, [ebp - 0x5b8]
call fcn.004085d0
mov eax, dword [ebp - 0x3c8]
mov byte [ebp - 4], 9
cmp eax, 8
jb 0x4106ee
inc eax
lea ecx, [ebp - 0x3dc]
push eax
push dword [ebp - 0x3dc]
call fcn.00407fb0
push ebx
lea ecx, [ebp - 0x3f4]
call fcn.00404610
lea eax, [ebp - 0x3f4]
mov byte [ebp - 4], 0xf
push eax
lea ecx, [ebp - 0x5b8]
call fcn.004085d0
mov eax, dword [ebp - 0x3e0]
mov byte [ebp - 4], 9
cmp eax, 8
jb 0x410732
inc eax
lea ecx, [ebp - 0x3f4]
push eax
push dword [ebp - 0x3f4]
call fcn.00407fb0
cmp dword [ebp - 0x5c0], 0xffffffff
je 0x4107a5
push str.2d64
lea ecx, [ebp - 0x484]
call fcn.00404610
lea eax, [ebp - 0x484]
mov byte [ebp - 4], 0x10
push eax
lea ecx, [ebp - 0x5b8]
call fcn.004085d0
lea ecx, [ebp - 0x484]
mov byte [ebp - 4], 9
call fcn.0040bda0
push 0x4b1a28
lea ecx, [ebp - 0x49c]
call fcn.00404610
lea eax, [ebp - 0x49c]
mov byte [ebp - 4], 0x11
push eax
lea ecx, [ebp - 0x5b8]
call fcn.004085d0
lea ecx, [ebp - 0x49c]
mov byte [ebp - 4], 9
call fcn.0040bda0
test edi, edi
jne 0x410813
push str.bd5b
lea ecx, [ebp - 0x4b4]
call fcn.00404610
lea eax, [ebp - 0x4b4]
mov byte [ebp - 4], 0x12
push eax
lea ecx, [ebp - 0x5b8]
call fcn.004085d0
lea ecx, [ebp - 0x4b4]
mov byte [ebp - 4], 9
call fcn.0040bda0
push 0x4b0298
lea ecx, [ebp - 0x4cc]
call fcn.00404610
lea eax, [ebp - 0x4cc]
mov byte [ebp - 4], 0x13
push eax
lea ecx, [ebp - 0x5b8]
call fcn.004085d0
lea ecx, [ebp - 0x4cc]
mov byte [ebp - 4], 9
call fcn.0040bda0
cmp dword [ebp - 0x5c4], 0
jne 0x410886
push str.71e5
lea ecx, [ebp - 0x4e4]
call fcn.00404610
lea eax, [ebp - 0x4e4]
mov byte [ebp - 4], 0x14
push eax
lea ecx, [ebp - 0x5b8]
call fcn.004085d0
lea ecx, [ebp - 0x4e4]
mov byte [ebp - 4], 9
call fcn.0040bda0
push 0x4b0298
lea ecx, [ebp - 0x4fc]
call fcn.00404610
lea eax, [ebp - 0x4fc]
mov byte [ebp - 4], 0x15
push eax
lea ecx, [ebp - 0x5b8]
call fcn.004085d0
lea ecx, [ebp - 0x4fc]
mov byte [ebp - 4], 9
call fcn.0040bda0
cmp dword [ebp + 0xc], 0
jne 0x4108f6
push str.b475
lea ecx, [ebp - 0x514]
call fcn.00404610
lea eax, [ebp - 0x514]
mov byte [ebp - 4], 0x16
push eax
lea ecx, [ebp - 0x5b8]
call fcn.004085d0
lea ecx, [ebp - 0x514]
mov byte [ebp - 4], 9
call fcn.0040bda0
push 0x4b0298
lea ecx, [ebp - 0x52c]
call fcn.00404610
lea eax, [ebp - 0x52c]
mov byte [ebp - 4], 0x17
push eax
lea ecx, [ebp - 0x5b8]
call fcn.004085d0
lea ecx, [ebp - 0x52c]
mov byte [ebp - 4], 9
call fcn.0040bda0
test esi, esi
jne 0x410964
push str.2788
lea ecx, [ebp - 0x544]
call fcn.00404610
lea eax, [ebp - 0x544]
mov byte [ebp - 4], 0x18
push eax
lea ecx, [ebp - 0x5b8]
call fcn.004085d0
lea ecx, [ebp - 0x544]
mov byte [ebp - 4], 9
call fcn.0040bda0
push 0x4b0298
lea ecx, [ebp - 0x55c]
call fcn.00404610
lea eax, [ebp - 0x55c]
mov byte [ebp - 4], 0x19
push eax
lea ecx, [ebp - 0x5b8]
call fcn.004085d0
lea ecx, [ebp - 0x55c]
mov byte [ebp - 4], 9
call fcn.0040bda0
push 0x4b1a64
lea ecx, [ebp - 0x574]
call fcn.00404610
lea eax, [ebp - 0x5b8]
mov byte [ebp - 4], 0x1a
push eax
lea eax, [ebp - 0x574]
push eax
lea eax, [ebp - 0x5a4]
push eax
call fcn.004567dd
add esp, 0xc
lea ecx, [ebp - 0x394]
push eax
call fcn.0040a220
lea ecx, [ebp - 0x5a4]
call fcn.0040bda0
lea ecx, [ebp - 0x574]
mov byte [ebp - 4], 9
call fcn.0040bda0
cmp dword [ebp - 0x380], 8
lea ecx, [ebp - 0x394]
push 0x2710
cmovae ecx, dword [ebp - 0x394]
lea eax, [ebp - 0x3ac]
cmp dword [ebp - 0x398], 8
push 1
cmovae eax, dword [ebp - 0x3ac]
push ecx
push eax
call fcn.0045704c
mov esi, dword [ebp - 0x5bc]
mov edi, 0x64
mov ecx, edi
mov eax, 0x55555556
sub ecx, esi
imul ecx
push edi
mov eax, edx
shr eax, 0x1f
add eax, edx
add esi, eax
push esi
mov dword [ebp - 0x5bc], esi
call fcn.00410b90
mov ecx, dword [ebp - 0x5bc]
mov eax, 0x55555556
sub edi, ecx
imul edi
push 0x64
mov eax, edx
shr eax, 0x1f
add eax, edx
add ecx, eax
push ecx
mov dword [ebp - 0x5bc], ecx
call fcn.00410b90
add esp, 0x20
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x64
push 0x64
call fcn.00410b90
add esp, 8
lea ecx, [ebp - 0x5b8]
call fcn.00404880
lea ecx, [ebp - 0x58c]
call fcn.0040bda0
lea ecx, [ebp - 0x3ac]
call fcn.0040bda0
lea ecx, [ebp - 0x394]
call fcn.0040bda0
lea ecx, [ebp - 0x40c]
call fcn.0040bda0
lea ecx, [ebp - 0x424]
call fcn.0040bda0
mov eax, dword [ebp - 0x338]
cmp eax, 8
jb 0x410abf
inc eax
lea ecx, [ebp - 0x34c]
push eax
push dword [ebp - 0x34c]
call fcn.00407fb0
xor eax, eax
mov dword [ebp - 0x338], 7
mov word [ebp - 0x34c], ax
mov eax, dword [ebp - 0x320]
mov dword [ebp - 0x33c], 0
cmp eax, 8
jb 0x410afa
inc eax
lea ecx, [ebp - 0x334]
push eax
push dword [ebp - 0x334]
call fcn.00407fb0
xor eax, eax
mov dword [ebp - 0x320], 7
mov word [ebp - 0x334], ax
mov eax, dword [ebp - 0x350]
mov dword [ebp - 0x324], 0
cmp eax, 8
jb 0x410b35
inc eax
lea ecx, [ebp - 0x364]
push eax
push dword [ebp - 0x364]
call fcn.00407fb0
xor eax, eax
mov dword [ebp - 0x350], 7
mov word [ebp - 0x364], ax
mov eax, dword [ebp - 0x368]
mov dword [ebp - 0x354], 0
cmp eax, 8
jb 0x410b70
inc eax
lea ecx, [ebp - 0x37c]
push eax
push dword [ebp - 0x37c]
call fcn.00407fb0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00413a09
mov esp, ebp
pop ebp
ret 0xc