Function at 0x4029a0
Capabilities:
Check if file exists
Enumerate files on windows
Extract resource via kernel32 functions
Get common file path
Get disk size
Get file version info
Move file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1864
call fcn.00404660
mov eax, dword [0x40fbe0]
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_FindWindowW]
push edi
push str.XLGameUpdate_2_33
push str.XLGameUpdate01572D6A_8C9A_234b_8B31_F2890BF1FB21_2_33
mov dword [esp + 0x1874], eax
call esi
test eax, eax
je 0x402aaf
push 0
push str.xlacc_gamedownloader_windowname_2_33
call esi
mov edi, eax
test edi, edi
je 0x402a97
mov edx, dword [ebp + 0x10]
mov eax, edx
mov dword [esp + 0x78], 0xf
mov dword [esp + 0x74], 0
mov byte [esp + 0x64], 0
lea esi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402a10
sub eax, esi
push eax
push edx
lea ecx, [esp + 0x68]
call fcn.00402190
push 4
push 0
push str.hide
lea ecx, [esp + 0x6c]
call fcn.00401b90
cmp eax, 0xffffffff
push 0
push 0
je 0x402a77
push 0x468
push edi
call dword [sym.imp.USER32.dll_PostMessageW]
cmp dword [esp + 0x78], 0x10
jb 0x402a97
mov eax, dword [esp + 0x64]
push eax
call fcn.00403f35
add esp, 4
or eax, 0xffffffff
mov ecx, dword [esp + 0x186c]
call fcn.00403cf4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x464
push edi
call dword [sym.imp.USER32.dll_PostMessageW]
cmp dword [esp + 0x78], 0x10
jb 0x402a97
mov ecx, dword [esp + 0x64]
push ecx
call fcn.00403f35
add esp, 4
or eax, 0xffffffff
mov ecx, dword [esp + 0x186c]
call fcn.00403cf4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
call fcn.00401ad0
xor ebx, ebx
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
mov word [esp + 0xc8], bx
xor eax, eax
mov ecx, 0x81
lea edi, [esp + 0xca]
rep stosd dword es:[edi], eax
lea edx, [esp + 0xc8]
push edx
push 0x104
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x54]
push ecx
lea edx, [esp + 0x60]
push edx
lea eax, [esp + 0xd4]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
cmp eax, 1
jne 0x402b46
cmp dword [esp + 0x2c], ebx
ja 0x402b46
jb 0x402b1e
cmp dword [esp + 0x28], 0x989680
jae 0x402b46
push ebx
push ebx
push 0x40b554
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 0xfffffffe
mov ecx, dword [esp + 0x186c]
call fcn.00403cf4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov esi, dword [ebp + 8]
xor eax, eax
push 0x7f00
mov ecx, 0xb
lea edi, [esp + 0x68]
rep stosd dword es:[edi], eax
push ebx
mov dword [0x4102e0], esi
mov dword [esp + 0x68], 0x30
mov dword [esp + 0x6c], 3
mov dword [esp + 0x70], 0x402910
mov dword [esp + 0x74], ebx
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], esi
call dword [sym.imp.USER32.dll_LoadIconW]
push 0x7f00
push ebx
mov dword [esp + 0x80], eax
call dword [sym.imp.USER32.dll_LoadCursorW]
push ebx
mov dword [esp + 0x80], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
mov ecx, dword [esp + 0x78]
lea edx, [esp + 0x60]
push edx
mov dword [esp + 0x84], eax
mov dword [esp + 0x88], ebx
mov dword [esp + 0x8c], str.XLGameUpdate01572D6A_8C9A_234b_8B31_F2890BF1FB21_2_33
mov dword [esp + 0x90], ecx
call dword [sym.imp.USER32.dll_RegisterClassExW]
test ax, ax
je 0x4035a3
push ebx
push esi
push ebx
push ebx
push 0x80000000
push 0x80000000
push 0x80000000
push 0x80000000
push 0xcf0000
push str.XLGameUpdate_2_33
push str.XLGameUpdate01572D6A_8C9A_234b_8B31_F2890BF1FB21_2_33
push 0x300
call dword [sym.imp.USER32.dll_CreateWindowExW]
cmp eax, ebx
mov dword [0x4102e4], eax
je 0x4035a3
xor eax, eax
mov word [esp + 0x7e0], bx
mov ecx, 0x81
lea edi, [esp + 0x7e2]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea eax, [esp + 0xcc]
push eax
lea ecx, [esp + 0x7e8]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
xor eax, eax
mov word [esp + 0x2d0], bx
mov ecx, 0x81
lea edi, [esp + 0x2d2]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [esp + 0x1250], bx
mov ecx, 0x81
lea edi, [esp + 0x1252]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov word [esp + 0x1048], bx
xor eax, eax
mov ecx, 0x81
lea edi, [esp + 0x104a]
rep stosd dword es:[edi], eax
lea edx, [esp + 0xc8]
push edx
push 0x104
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jbe 0x4035a3
mov ecx, dword [0x4102e0]
push 0x104
lea eax, [esp + 0x1254]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jbe 0x4035a3
lea edx, [esp + 0x1250]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov esi, eax
cmp esi, ebx
mov dword [esp + 0x20], esi
je 0x4035a3
push 0x104
lea eax, [esp + 0x1254]
push eax
lea ecx, [esp + 0x1050]
push ecx
call fcn.00404616
add esp, 0xc
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
push esi
lea edx, [esp + 0xcc]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [esp + 0xc8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea ecx, [esp + 0xc8]
push ecx
call fcn.00402820
xor eax, eax
mov ecx, 0x3f
lea edi, [esp + 0x6e6]
rep stosd dword es:[edi], eax
add esp, 4
stosw word es:[edi], ax
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x104c]
push eax
mov word [esp + 0x6e8], bx
mov dword [esp + 0x1c], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, ebx
jbe 0x402e06
lea ecx, [esi + esi + 2]
push ecx
call fcn.004037c8
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x402e06
mov edx, dword [esp + 0x14]
push edi
push esi
push edx
lea eax, [esp + 0x1054]
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x402dfd
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
push 0x40b344
push edi
mov dword [esp + 0x20], ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x402dfd
mov eax, dword [esp + 0x18]
movzx ecx, word [eax + 0xc]
movzx edx, word [eax + 0xe]
push ecx
movzx ecx, word [eax + 8]
push edx
movzx edx, word [eax + 0xa]
push ecx
push edx
lea eax, [esp + 0x6f0]
push 0x40b32c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
push edi
call fcn.00403f35
add esp, 4
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [esp + 0x6e0]
push ecx
lea edx, [esp + 0xcc]
push edx
call esi
lea eax, [esp + 0xc8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea ecx, [esp + 0xc8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x402e55
lea edx, [esp + 0xc8]
push edx
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
test eax, eax
jne 0x4035a3
lea eax, [esp + 0xc8]
push eax
lea ecx, [esp + 0x2d4]
push ecx
call fcn.00404537
add esp, 8
lea edx, [esp + 0x2d0]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
lea eax, [esp + 0xc8]
push eax
lea ecx, [esp + 0x7e4]
push ecx
call fcn.00404537
add esp, 8
push str..GameUpdate.cab
lea edx, [esp + 0x7e4]
push edx
call esi
xor eax, eax
cmp eax, 0x40b528
je 0x4035a3
lea ecx, [esp + 0x7e0]
test ecx, ecx
je 0x4035a3
push 0x40b528
push 0x65
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, ebx
je 0x4035a3
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp eax, ebx
mov dword [esp + 0x1c], eax
je 0x4035a3
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
mov dword [esp + 0x14], eax
je 0x4035a3
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp eax, ebx
mov dword [esp + 0x24], eax
je 0x4035a3
push ebx
push 0x80
push 2
push ebx
push 1
push 0x40000000
lea edx, [esp + 0x7f8]
push edx
mov dword [esp + 0x2c], 1
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x402f60
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
mov ecx, dword [esp + 0x186c]
call fcn.00403cf4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push ebx
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x402f91
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
mov ecx, dword [esp + 0x186c]
call fcn.00403cf4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [esp + 0x1c]
xor esi, esi
cmp eax, ebx
jbe 0x402fe0
jmp 0x402fa0
sub eax, esi
cmp eax, 0xfa000
jbe 0x402fae
mov eax, 0xfa000
push ebx
lea edx, [esp + 0x1c]
push edx
push eax
mov eax, dword [esp + 0x30]
lea ecx, [esi + eax]
push ecx
push edi
mov dword [esp + 0x2c], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x402fdc
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
add esi, edx
cmp esi, eax
jb 0x402fa0
jmp 0x402fe0
mov dword [esp + 0x10], ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esp + 0x10], ebx
je 0x4035a3
lea eax, [esp + 0xc8]
push eax
lea ecx, [esp + 0x7e4]
push ecx
call fcn.004019f0
add esp, 8
test eax, eax
je 0x4035a3
xor eax, eax
mov word [esp + 0x9e8], bx
mov ecx, 0x81
lea edi, [esp + 0x9ea]
rep stosd dword es:[edi], eax
lea edx, [esp + 0x2d0]
stosw word es:[edi], ax
push edx
lea eax, [esp + 0x9ec]
push eax
call fcn.00404537
add esp, 8
mov word [esp + 0x4d8], bx
xor eax, eax
push ebx
mov ecx, 0x81
lea edi, [esp + 0x4de]
rep stosd dword es:[edi], eax
push 0x25
lea ecx, [esp + 0x4e0]
push ecx
push ebx
stosw word es:[edi], ax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x40b50c
lea edx, [esp + 0x9ec]
push edx
call esi
push 0x40b50c
lea eax, [esp + 0x4dc]
push eax
call esi
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea ecx, [esp + 0x4d8]
push ecx
call edi
test eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileW]
jne 0x4030ca
lea edx, [esp + 0x4d8]
push edx
lea eax, [esp + 0x9ec]
push eax
call ebx
push str...msvcp71.dll
lea ecx, [esp + 0x9ec]
push ecx
call esi
push str...msvcp71.dll
lea edx, [esp + 0x4dc]
push edx
call esi
lea eax, [esp + 0x4d8]
push eax
call edi
test eax, eax
jne 0x403108
lea ecx, [esp + 0x4d8]
push ecx
lea edx, [esp + 0x9ec]
push edx
call ebx
xor ebx, ebx
mov esi, str.._atl71.dll
mov dword [esp + 0x10], ebx
xor eax, eax
mov word [esp + 0xbf0], 0
mov ecx, 0x81
lea edi, [esp + 0xbf2]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x2d0]
push eax
lea ecx, [esp + 0xbf4]
push ecx
call fcn.00404537
add esp, 8
push esi
lea edx, [esp + 0xbf4]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [esp + 0xbf0]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
jne 0x403272
cmp esi, str..msvcr71.dll
jle 0x403279
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
mov dword [esp + 0x92], ecx
mov dword [esp + 0x96], ecx
push 0xa
lea edx, [esp + 0x94]
mov dword [esp + 0x9e], ecx
push edx
mov dword [esp + 0xa6], ecx
push ebx
mov esi, eax
mov word [esp + 0x9c], 0
mov word [esp + 0xae], cx
call fcn.004045db
add esp, 0xc
push 0x40b4d4
lea ecx, [esp + 0x64]
call fcn.00401510
lea eax, [esp + 0xbf0]
push eax
lea ecx, [esp + 0x64]
call fcn.00402400
push 0x40b4c8
lea ecx, [esp + 0x64]
call fcn.00402400
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x64]
call fcn.00402400
push str.__err
lea ecx, [esp + 0x64]
call fcn.00402400
push 0xa
lea edx, [esp + 0x94]
push edx
push esi
call fcn.004045db
add esp, 0xc
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0x64]
call fcn.00402400
cmp dword [esp + 0x78], 8
mov eax, dword [esp + 0x64]
jae 0x403242
lea eax, [esp + 0x64]
push 0
push 0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [esp + 0x60]
call fcn.004012d0
mov eax, 0xfffffffd
mov ecx, dword [esp + 0x186c]
call fcn.00403cf4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov dword [ebx*4 + 0x4102ac], eax
mov eax, dword [esp + 0x10]
add eax, 0x208
inc ebx
add esi, 0x208
cmp eax, 0x1a68
mov dword [esp + 0x10], eax
jb 0x403113
lea ecx, [esp + 0x2d0]
push ecx
lea ecx, [esp + 0xb0]
call fcn.00401510
push str..dll
lea ecx, [esp + 0xb0]
call fcn.00402400
cmp dword [esp + 0xc4], 8
mov eax, dword [esp + 0xb0]
jae 0x4032d5
lea eax, [esp + 0xb0]
lea edx, [esp + 0xdf8]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4033b8
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
jmp 0x403300
lea eax, [esp + 0xe24]
push 0x40b398
push eax
call fcn.00404553
add esp, 8
test eax, eax
je 0x40339e
lea ecx, [esp + 0xe24]
push 0x40b390
push ecx
call fcn.00404553
add esp, 8
test eax, eax
je 0x40339e
lea edx, [esp + 0xe24]
push 0x40b484
push edx
call fcn.00404553
add esp, 8
test eax, eax
je 0x40339e
lea eax, [esp + 0x2d0]
push eax
lea ecx, [esp + 0x64]
call fcn.00401510
push 0x40b344
lea ecx, [esp + 0x64]
call fcn.00402400
lea ecx, [esp + 0xe24]
push ecx
lea ecx, [esp + 0x64]
call fcn.00402400
cmp dword [esp + 0x78], 8
mov eax, dword [esp + 0x64]
jae 0x40338e
lea eax, [esp + 0x64]
push eax
call edi
test eax, eax
je 0x40340e
lea ecx, [esp + 0x60]
call fcn.004012d0
lea edx, [esp + 0xdf8]
push edx
push esi
call ebx
test eax, eax
jne 0x403300
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x2d0]
push edx
lea ecx, [esp + 0xb0]
call fcn.004023e0
push 0x40b45c
lea ecx, [esp + 0xb0]
call fcn.00402400
cmp dword [esp + 0xc4], 8
mov eax, dword [esp + 0xb0]
jae 0x4033f5
lea eax, [esp + 0xb0]
push eax
call edi
mov esi, eax
test esi, esi
jne 0x403491
push eax
push eax
push 0x40b42c
jmp 0x4034af
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [esp + 0x60]
push eax
lea ecx, [esp + 0x94]
push str.load_file_failed
push ecx
call fcn.00402420
mov eax, dword [esp + 0xb4]
add esp, 0xc
cmp eax, 8
mov eax, dword [esp + 0x94]
jae 0x403449
lea eax, [esp + 0x94]
push 0
push 0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [esp + 0x90]
call fcn.004012d0
lea ecx, [esp + 0x60]
call fcn.004012d0
lea ecx, [esp + 0xac]
call fcn.004012d0
mov eax, 0xfffffffd
mov ecx, dword [esp + 0x186c]
call fcn.00403cf4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.LoadXar
push esi
call edi
test eax, eax
mov dword [0x4102a8], eax
jne 0x4034dd
push eax
push eax
push 0x40b3b8
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [esp + 0xac]
call fcn.004012d0
mov eax, 0xfffffffd
mov ecx, dword [esp + 0x186c]
call fcn.00403cf4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
call eax
push str.GetWnd
push esi
call edi
call eax
test eax, eax
mov dword [0x4102ec], eax
je 0x403504
mov ecx, dword [ebp + 0x10]
push ecx
push 0
push 0x467
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
push 0
push 0x19
lea edx, [esp + 0x1460]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov eax, dword [esp + 0x20]
push eax
lea ecx, [esp + 0x145c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [esp + 0x1458]
push 0x40b3a4
push edx
call fcn.0040450d
add esp, 8
push 0x104
lea eax, [esp + 0x1664]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
push 0
push 0
push 0
lea ecx, [esp + 0x40]
push ecx
call esi
test eax, eax
je 0x403597
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
lea edx, [esp + 0x34]
push edx
call edi
lea eax, [esp + 0x34]
push eax
call ebx
push 0
push 0
push 0
lea ecx, [esp + 0x40]
push ecx
call esi
test eax, eax
jne 0x403578
lea ecx, [esp + 0xac]
call fcn.004012d0
mov ecx, dword [esp + 0x186c]
xor eax, eax
call fcn.00403cf4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10