Function at 0x40d000
Capabilities:
Check if file exists
Copy file
Create a process with modified i/o handles and window
Create process on windows
Delete file
Extract resource via kernel32 functions
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52dc2f
mov eax, dword fs:[0]
push eax
sub esp, 0x6a8
mov eax, dword [0x588e70]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x648], ecx
mov dword [ebp - 4], 0
call fcn.0041767f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40d055
push 0x80004005
call fcn.004025a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebx, [eax + 0x10]
mov dword [ebp - 0x63c], ebx
mov byte [ebp - 4], 1
call fcn.0041767f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40d085
push 0x80004005
call fcn.004025a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [ebp - 0x640], edi
push 0xa
push 0x68
push 0
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x40d11a
lea eax, [edi - 0x10]
mov byte [ebp - 4], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40d0cd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebx - 0x10]
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40d0ed
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40d113
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
jmp 0x40d783
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
lea ecx, [ebp - 0x318]
push ecx
mov ebx, eax
push 0x104
mov dword [ebp - 0x644], ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push esi
call fcn.004164a6
mov ecx, 1
add esp, 4
mov edi, eax
cmp esi, ecx
jle 0x40d18e
mov edx, edi
lea eax, [ebx + 1]
sub edx, ebx
lea esp, [esp]
movzx ebx, byte [eax - 1]
mov byte [edx + eax], bl
movzx ebx, byte [eax]
mov byte [edi + ecx - 1], bl
add ecx, 2
add eax, 2
cmp ecx, esi
jl 0x40d170
mov ebx, dword [ebp - 0x644]
mov edx, esi
and edx, 0x80000001
jns 0x40d19d
dec edx
or edx, 0xfffffffe
inc edx
cmp edx, 1
jne 0x40d1aa
mov al, byte [ebx + esi - 1]
mov byte [edi + esi - 1], al
lea eax, [ebp - 0x318]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40d1b3
sub eax, edx
push eax
lea ecx, [ebp - 0x318]
push ecx
lea ecx, [ebp - 0x63c]
call fcn.00402a20
push 0x11
push str.SIGN_VERIFIER.ZIP
lea ecx, [ebp - 0x63c]
call fcn.0040ad00
mov ebx, dword [ebp - 0x63c]
push 0x1001
push ebx
lea ecx, [ebp - 0x670]
call fcn.004285ca
push esi
push edi
lea ecx, [ebp - 0x670]
mov byte [ebp - 4], 3
call fcn.00427b81
lea ecx, [ebp - 0x670]
call fcn.00427de5
push 0
lea ecx, [ebp - 0x638]
call fcn.00412210
push ebx
lea ecx, [ebp - 0x638]
mov byte [ebp - 4], 4
call fcn.004122b0
test eax, eax
jne 0x40d318
mov edi, dword [ebp - 0x648]
push 0x25
push ecx
mov ecx, esp
mov dword [ebp - 0x644], esp
push str.Error_on_opening_zipped_sign_verifier____
mov byte [edi + 0xfb4], 1
call fcn.00402bb0
lea ecx, [edi + 0xbc8]
call fcn.00403dd0
test byte [edi + 0x1ea8], 1
jne 0x40d283
mov edx, dword [edi + 0xbc8]
mov eax, dword [edx + 0x170]
lea ecx, [edi + 0xbc8]
call eax
lea ecx, [ebp - 0x638]
mov byte [ebp - 4], 3
call fcn.00412280
lea ecx, [ebp - 0x670]
mov byte [ebp - 4], 2
call fcn.00427fb8
mov eax, dword [ebp - 0x640]
add eax, 0xfffffff0
mov byte [ebp - 4], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40d2c7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebx - 0x10]
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40d2e7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40d113
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
jmp 0x40d783
push 0
lea ecx, [ebp - 0x318]
push ecx
lea ecx, [ebp - 0x638]
call fcn.00412830
test eax, eax
jne 0x40d41d
mov edi, dword [ebp - 0x648]
push 0x25
push ecx
mov ecx, esp
mov dword [ebp - 0x644], esp
push str.Error_on_extracting_zipped_sign_verifier____
mov byte [edi + 0xfb4], 1
call fcn.00402bb0
lea ecx, [edi + 0xbc8]
call fcn.00403dd0
test byte [edi + 0x1ea8], 1
jne 0x40d37e
mov edx, dword [edi + 0xbc8]
mov eax, dword [edx + 0x170]
lea ecx, [edi + 0xbc8]
call eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x638]
mov byte [ebp - 4], 3
call fcn.00412280
lea ecx, [ebp - 0x670]
mov byte [ebp - 4], 2
call fcn.00427fb8
mov eax, dword [ebp - 0x640]
add eax, 0xfffffff0
mov byte [ebp - 4], 1
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40d3cc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebx - 0x10]
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40d3ec
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40d113
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
jmp 0x40d783
lea ecx, [ebp - 0x638]
call fcn.00411f30
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
call ebx
lea ecx, [ebp - 0x644]
push ecx
lea ecx, [ebp - 0x638]
call fcn.004128d0
push eax
lea ecx, [ebp - 0x63c]
mov byte [ebp - 4], 5
call fcn.00404ec0
mov eax, dword [ebp - 0x644]
add eax, 0xfffffff0
mov byte [ebp - 4], 4
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40d479
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x214]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x214]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40d494
sub eax, esi
push eax
lea edx, [ebp - 0x214]
push edx
lea ecx, [ebp - 0x640]
call fcn.00402a20
push 0x11
push str.SignVerifier.exe
lea ecx, [ebp - 0x640]
call fcn.0040ad00
mov esi, dword [ebp - 0x640]
mov edi, dword [ebp - 0x63c]
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x214]
push 0x53f500
push eax
call fcn.00514414
add esp, 0xc
push edi
call ebx
mov ecx, dword [ebp + 8]
push ecx
push esi
lea edx, [ebp - 0x418]
push str._s__s
push edx
call fcn.00514414
push 0x44
lea eax, [ebp - 0x6b4]
push 0
push eax
call fcn.005144f0
mov edi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
add esp, 0x1c
push 0xfffffffffffffff6
mov dword [ebp - 0x6b4], 0x44
mov dword [ebp - 0x688], 0x101
call edi
push 0xfffffffffffffff5
mov dword [ebp - 0x67c], eax
call edi
push 0xfffffffffffffff4
mov dword [ebp - 0x678], eax
call edi
mov dword [ebp - 0x674], eax
xor eax, eax
xor ecx, ecx
lea edx, [ebp - 0x658]
push edx
mov dword [ebp - 0x658], eax
mov dword [ebp - 0x654], eax
mov dword [ebp - 0x650], eax
mov dword [ebp - 0x64c], eax
lea eax, [ebp - 0x6b4]
push eax
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
mov word [ebp - 0x684], cx
lea ecx, [ebp - 0x418]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40d5eb
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 2
jne 0x40d5c4
lea edx, [ebp - 0x110]
push str.Cant_start_verifying_signing
push edx
call fcn.00514414
add esp, 8
jmp 0x40d5db
call edi
push eax
lea eax, [ebp - 0x110]
push str.Cant_start_verifying_signing._d_n
push eax
call fcn.00514414
add esp, 0xc
push 0
push 0
lea ecx, [ebp - 0x110]
push ecx
call fcn.00422eca
mov edx, dword [ebp - 0x658]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x658]
lea eax, [ebp - 0x65c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [ebp - 0x65c]
test eax, eax
je 0x40d6d9
push eax
lea edx, [ebp - 0x110]
push str.Digital_Sign_Verify_Fail..._X
push edx
call fcn.00514414
add esp, 0xc
push 0
push 0
lea eax, [ebp - 0x110]
push eax
call fcn.00422eca
push esi
call ebx
lea ecx, [ebp - 0x638]
mov byte [ebp - 4], 3
call fcn.00412280
lea ecx, [ebp - 0x670]
mov byte [ebp - 4], 2
call fcn.00427fb8
add esi, 0xfffffff0
mov byte [ebp - 4], 1
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40d682
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
mov eax, dword [ebp - 0x63c]
add eax, 0xfffffff0
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40d6a8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40d113
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
jmp 0x40d783
mov ecx, dword [ebp - 0x658]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call edi
mov edx, dword [ebp - 0x654]
push edx
call edi
push esi
call ebx
lea ecx, [ebp - 0x638]
mov byte [ebp - 4], 3
call fcn.00412280
lea ecx, [ebp - 0x670]
mov byte [ebp - 4], 2
call fcn.00427fb8
add esi, 0xfffffff0
mov byte [ebp - 4], 1
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40d732
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov eax, dword [ebp - 0x63c]
add eax, 0xfffffff0
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40d758
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40d77e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005144d7
mov esp, ebp
pop ebp
ret 4