Function at 0x40b35e
Capabilities:
Check if file exists
Copy file
Encrypt data using rc4 ksa
Extract resource via kernel32 functions
Get common file path
Get file attributes

Disassembly:
mov eax, 0x438061
call fcn.0041cc58
sub esp, 0x784
mov eax, dword [0x44e660]
push ebx
xor ebx, ebx
xor eax, ebp
push esi
mov dword [ebp - 0x10], eax
push edi
mov dword [ebp - 0x704], ebx
mov dword [ebp - 0x700], ebx
mov dword [ebp - 0x6fc], ebx
mov dword [ebp - 4], ebx
xor edi, edi
xor esi, esi
lea eax, [ebp - 0x6d8]
push eax
push esi
push edi
call fcn.004118fd
add esp, 0xc
test eax, eax
jne 0x40b442
mov eax, dword [ebp - 0x6d8]
mov dword [ebp - 0x6dc], eax
lea eax, [ebp - 0x6dc]
push eax
lea ecx, [ebp - 0x708]
call fcn.0040b31e
inc esi
cmp esi, 7
jb 0x40b396
inc edi
cmp edi, 7
jb 0x40b394
mov dword [ebp - 0x6f4], ebx
mov dword [ebp - 0x6f0], ebx
mov dword [ebp - 0x6ec], ebx
lea eax, [ebp - 0x72c]
push eax
lea eax, [ebp - 0x618]
push eax
mov byte [ebp - 4], 1
call fcn.004119a9
lea eax, [ebp - 0x70c]
push eax
call fcn.004119fd
lea eax, [ebp - 0x6e8]
push eax
lea eax, [ebp - 0x6e0]
push eax
call fcn.00411a39
mov eax, dword [ebp - 0x70c]
add esp, 0x14
cmp eax, 0xffffffff
push dword [ebp + 0xc]
je 0x40b478
inc eax
cmp byte [ebp + 8], bl
lea ecx, [ebp - 0x618]
je 0x40b45a
push 1
jmp 0x40b45b
push ebx
push str.GetNum
push 0xb5
call fcn.00403bc5
add esp, 0xc
jmp 0x40b8d4
push ebx
push dword [ebp - 0x6e4]
push dword [ebp - 0x6e8]
push dword [ebp - 0x6e0]
push ecx
lea ecx, [ebp - 0x6f8]
push ecx
push eax
jmp 0x40b4a4
cmp byte [ebp + 8], bl
lea eax, [ebp - 0x618]
je 0x40b487
push 1
jmp 0x40b488
push ebx
push dword [ebp - 0x6e4]
push dword [ebp - 0x6e8]
push dword [ebp - 0x6e0]
push eax
lea eax, [ebp - 0x6f8]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x708]
push eax
call fcn.00412145
add esp, 0x24
call fcn.0040ab88
push eax
lea ecx, [ebp - 0x650]
call fcn.004045fa
mov byte [ebp - 4], 2
call fcn.00411719
mov eax, dword [eax]
mov dword [ebp - 0x71c], eax
call fcn.00411719
mov eax, dword [eax + 4]
mov dword [ebp - 0x718], eax
call fcn.00411719
mov eax, dword [eax + 8]
mov dword [ebp - 0x714], eax
call fcn.00411719
cmp dword [ebp - 0x638], 0x10
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x710], eax
mov eax, dword [ebp - 0x64c]
jae 0x40b514
lea eax, [ebp - 0x64c]
push eax
lea ecx, [ebp - 0x6d8]
call fcn.0040aa43
push ebx
push ebx
lea ecx, [ebp - 0x6d8]
mov byte [ebp - 4], 3
call fcn.0040aa6c
mov edi, eax
push edi
call fcn.0042ab65
pop ecx
mov esi, eax
push edi
push esi
lea ecx, [ebp - 0x6d8]
call fcn.0040aa6c
lea ecx, [ebp - 0x70c]
push ecx
lea ecx, [ebp - 0x71c]
lea eax, [esi + edi]
push ecx
push eax
push esi
mov dword [ebp - 0x6dc], eax
call fcn.0040a9f7
push esi
mov edi, eax
call fcn.0042ab6a
add esp, 0x14
cmp edi, dword [ebp - 0x6dc]
jne 0x40b5aa
push ebx
push 0x43b240
push 0xb5
call fcn.00403bc5
add esp, 0xc
cmp dword [ebp - 0x6d8], ebx
je 0x40b8bb
push dword [ebp - 0x6d8]
call fcn.0041d2b3
pop ecx
jmp 0x40b8bb
sub edi, esi
cmp dword [ebp - 0x6d8], ebx
mov dword [ebp - 0x6dc], edi
je 0x40b5c6
push dword [ebp - 0x6d8]
call fcn.0041d2b3
pop ecx
xor esi, esi
push ebx
lea ecx, [ebp - 0x634]
inc esi
mov dword [ebp - 0x61c], 0xf
call fcn.00404001
mov byte [ebp - 4], 4
push esi
lea ecx, [ebp - 0x790]
call fcn.0040244c
push eax
lea eax, [ebp - 0x650]
push eax
lea eax, [ebp - 0x728]
push eax
call fcn.0040aea9
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x634]
mov byte [ebp - 4], 5
call fcn.00404398
push ebx
push 1
lea ecx, [ebp - 0x728]
mov byte [ebp - 4], 4
call fcn.004040ef
mov eax, dword [ebp - 0x630]
push 0x10
pop edi
cmp dword [ebp - 0x61c], edi
jae 0x40b642
lea eax, [ebp - 0x630]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40b651
inc esi
jmp 0x40b5e3
cmp dword [ebp - 0x61c], edi
mov ecx, dword [ebp - 0x630]
jae 0x40b665
lea ecx, [ebp - 0x630]
cmp dword [ebp - 0x638], edi
mov eax, dword [ebp - 0x64c]
jae 0x40b679
lea eax, [ebp - 0x64c]
push 1
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x40b69f
push ebx
push 0x43b230
push 0xb5
call fcn.00403bc5
add esp, 0xc
jmp 0x40b8ad
cmp dword [ebp - 0x61c], edi
mov eax, dword [ebp - 0x630]
jae 0x40b6b3
lea eax, [ebp - 0x630]
push eax
lea ecx, [ebp - 0x6a0]
call fcn.0040b0e4
cmp dword [ebp - 0x6f4], ebx
mov byte [ebp - 4], 6
jne 0x40b6cf
xor eax, eax
jmp 0x40b6db
mov eax, dword [ebp - 0x6f0]
sub eax, dword [ebp - 0x6f4]
push eax
push dword [ebp - 0x6f4]
lea ecx, [ebp - 0x6a0]
push ebx
push dword [ebp - 0x6dc]
call fcn.0040ac52
cmp dword [ebp - 0x70c], ebx
jne 0x40b762
call fcn.00402396
xor edx, edx
mov ecx, 0x500001
div ecx
lea esi, [edx + 0x500000]
shr esi, 0xc
shl esi, 0xc
push esi
call fcn.0042ab65
xor edi, edi
cmp esi, ebx
pop ecx
mov dword [ebp - 0x6d8], eax
jbe 0x40b741
call fcn.00402396
mov ecx, dword [ebp - 0x6d8]
and eax, 0xff
mov byte [edi + ecx], al
inc edi
cmp edi, esi
jb 0x40b729
push esi
push dword [ebp - 0x6d8]
lea ecx, [ebp - 0x6a0]
push 2
push ebx
call fcn.0040ac52
push dword [ebp - 0x6d8]
call fcn.0042ab6a
pop ecx
push 0x6f
push 0x84
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
cmp esi, ebx
jne 0x40b78e
push ebx
push 0x43b218
push 0xb5
call fcn.00403bc5
add esp, 0xc
jmp 0x40b8a2
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x114]
push eax
push ebx
push 0x43b214
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push 1
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x6d4]
call fcn.0040b081
push esi
push edi
lea ecx, [ebp - 0x6d4]
mov byte [ebp - 4], 7
call fcn.0040abfe
mov esi, 0x43b1f4
push esi
lea ecx, [ebp - 0x66c]
call fcn.004045fa
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x634]
push eax
lea ecx, [ebp - 0x66c]
mov byte [ebp - 4], 8
call fcn.0040ad22
push 0x43b210
lea ecx, [ebp - 0x66c]
call fcn.0040ae4c
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x650]
push eax
lea ecx, [ebp - 0x66c]
call fcn.0040ad22
push esi
lea ecx, [ebp - 0x66c]
call fcn.0040ae4c
cmp dword [ebp - 0x654], 0x10
mov eax, dword [ebp - 0x668]
jae 0x40b863
lea eax, [ebp - 0x668]
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.0040aef7
test al, al
pop ecx
pop ecx
push ebx
jne 0x40b88a
push 0x43b1fc
push 0xb5
call fcn.00403bc5
add esp, 0xc
push ebx
lea ecx, [ebp - 0x66c]
push 1
call fcn.004040ef
lea ecx, [ebp - 0x6d4]
call fcn.0040acc9
lea ecx, [ebp - 0x6a0]
call fcn.0040acc9
push ebx
lea ecx, [ebp - 0x634]
push 1
call fcn.004040ef
push ebx
lea ecx, [ebp - 0x650]
push 1
call fcn.004040ef
lea ecx, [ebp - 0x6f8]
call fcn.0040ace3
lea ecx, [ebp - 0x708]
call fcn.0040ace3
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
xor ecx, ebp
pop ebx
call fcn.0041c04e
leave
ret