Function at 0x43eaf5
Capabilities:
Check if file exists
Delete file
Extract resource via kernel32 functions
Get common file path
Move file
Write file on windows

Disassembly:
push 0xa94
mov eax, 0x5db14d
call fcn.00447fd9
mov dword [ebp - 0xa78], ecx
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
call fcn.004212c6
mov ecx, eax
call fcn.00429ec0
lea eax, [ebp - 0x7a4]
push eax
call fcn.004212c6
mov ecx, eax
call fcn.004290a1
and dword [ebp - 4], 0
lea ecx, [ebp - 0x744]
push esi
call fcn.00401d40
xor eax, eax
lea ecx, [ebp - 0x8ac]
inc eax
mov byte [ebp - 4], al
lea eax, [ebp - 0x7a4]
push eax
call fcn.00403980
lea eax, [ebp - 0x744]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x894]
call fcn.00403980
push 3
pop eax
mov byte [ebp - 4], al
lea eax, [ebp - 0x8ac]
push eax
call fcn.0049da78
lea eax, [ebp - 0x894]
push eax
call fcn.0049da78
cmp dword [ebp - 0x790], 8
lea eax, [ebp - 0x7a4]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmovae eax, dword [ebp - 0x7a4]
pop ecx
pop ecx
push eax
call esi
lea eax, [ebp - 0x894]
push eax
lea ecx, [ebp - 0x8ac]
call fcn.00422ad9
test eax, eax
je 0x43ebe7
cmp dword [ebp - 0x790], 8
lea eax, [ebp - 0x7a4]
cmovae eax, dword [ebp - 0x7a4]
sub esp, 0x18
mov ecx, esp
push eax
call fcn.00401d40
call fcn.0047f8f3
add esp, 0x18
call fcn.004212c6
mov ecx, eax
call fcn.00429166
mov ecx, dword [ebp - 0xa78]
xor edi, edi
test eax, eax
push 1
pop eax
cmovne edi, eax
call fcn.0043f8bf
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004a2e40
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x218]
push eax
call fcn.0047ea82
and dword [ebp - 0x764], 0
xor eax, eax
mov dword [ebp - 0x760], 7
mov word [ebp - 0x774], ax
mov dword [esp], 0x5e463c
call fcn.004a6baf
pop ecx
push eax
push 0x5e463c
lea ecx, [ebp - 0x774]
call fcn.00401ea0
push 0x5e5e84
mov byte [ebp - 4], 4
call fcn.004a6baf
pop ecx
push eax
push 0x5e5e84
lea ecx, [ebp - 0x774]
call fcn.00403b60
push 0x5e463c
call fcn.004a6baf
pop ecx
push eax
push 0x5e463c
lea ecx, [ebp - 0x774]
call fcn.00403b60
and dword [ebp - 0x77c], 0
xor eax, eax
push 0x5e463c
mov dword [ebp - 0x778], 7
mov word [ebp - 0x78c], ax
call fcn.004a6baf
pop ecx
push eax
push 0x5e463c
lea ecx, [ebp - 0x78c]
call fcn.00401ea0
push str.d54868991d
mov byte [ebp - 4], 5
call fcn.004a6baf
pop ecx
push eax
push str.d54868991d
lea ecx, [ebp - 0x78c]
call fcn.00403b60
push 0x5e463c
call fcn.004a6baf
pop ecx
push eax
push 0x5e463c
lea ecx, [ebp - 0x78c]
call fcn.00403b60
cmp dword [ebp - 0x778], 8
lea ecx, [ebp - 0x78c]
lea eax, [ebp - 0x774]
cmovae ecx, dword [ebp - 0x78c]
cmp dword [ebp - 0x760], 8
push ecx
cmovae eax, dword [ebp - 0x774]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0xa78], eax
test eax, eax
jne 0x43ed82
xor esi, esi
test edi, edi
je 0x43f84d
inc esi
push esi
push str.InstRate_ResErr
push esi
call fcn.004226f8
mov ecx, eax
call fcn.0042719a
xor ebx, ebx
jmp 0x43f850
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push dword [ebp - 0xa78]
mov dword [ebp - 0xa8c], eax
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0x1869f
push 0x2710
mov ebx, eax
call fcn.00487cd6
cdq
push edx
push eax
lea eax, [ebp - 0x864]
push eax
call fcn.0049d4a9
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 6
push 0x5e1980
push eax
call fcn.004b0beb
lea eax, [ebp - 0x218]
push 0x5e2730
push eax
call fcn.004b0beb
cmp dword [ebp - 0x850], 8
lea eax, [ebp - 0x864]
cmovae eax, dword [ebp - 0x864]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.004b0beb
lea eax, [ebp - 0x218]
push str._7zData.7z
push eax
call fcn.004b0beb
add esp, 0x34
lea eax, [ebp - 0x218]
push eax
call esi
test eax, eax
je 0x43ee39
lea eax, [ebp - 0x218]
push eax
call fcn.0047d888
pop ecx
push 0
push 0x80
xor eax, eax
inc eax
push eax
push 0
push eax
push 0x40000000
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x43ee85
and dword [ebp - 0xa78], 0
lea eax, [ebp - 0xa78]
push 0
push eax
push ebx
push dword [ebp - 0xa8c]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x104
xor esi, esi
lea eax, [ebp - 0x31c]
push esi
push eax
call fcn.004a2e40
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.0049da04
add esp, 0x14
call fcn.004212c6
mov ecx, eax
call fcn.00429b47
call fcn.004212c6
mov ecx, eax
call fcn.0042850d
mov dword [ebp - 0xa88], esi
mov dword [ebp - 0xa9c], esi
mov dword [ebp - 0xa98], esi
mov dword [ebp - 0xa94], esi
xor eax, eax
mov byte [ebp - 4], 7
mov ebx, str.WnUserPage.exe
mov dword [ebp - 0x7c0], 7
push ebx
mov dword [ebp - 0x7c4], esi
mov word [ebp - 0x7d4], ax
call fcn.004a6baf
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x7d4]
call fcn.00401ea0
lea eax, [ebp - 0x7d4]
mov byte [ebp - 4], 8
push eax
lea ecx, [ebp - 0xa9c]
call fcn.0042a543
xor eax, eax
mov byte [ebp - 4], 7
push esi
inc eax
lea ecx, [ebp - 0x7d4]
push eax
call fcn.00401de0
mov dword [ebp - 0x7dc], esi
xor eax, eax
mov esi, str.DuiLib32.dll
mov dword [ebp - 0x7d8], 7
push esi
mov word [ebp - 0x7ec], ax
call fcn.004a6baf
pop ecx
push eax
push esi
lea ecx, [ebp - 0x7ec]
call fcn.00401ea0
lea eax, [ebp - 0x7ec]
mov byte [ebp - 4], 9
push eax
lea ecx, [ebp - 0xa9c]
call fcn.0042a543
xor eax, eax
mov byte [ebp - 4], 7
push 0
inc eax
lea ecx, [ebp - 0x7ec]
push eax
call fcn.00401de0
cmp dword [ebp - 0x730], 8
lea ecx, [ebp - 0xa9c]
push ecx
lea eax, [ebp - 0x744]
cmovae eax, dword [ebp - 0x744]
lea ecx, [ebp - 0x31c]
push ecx
push eax
call fcn.0041b9b4
cmp dword [ebp - 0x730], 8
lea eax, [ebp - 0x744]
push ebx
cmovae eax, dword [ebp - 0x744]
mov esi, 0x5e46d0
push eax
lea eax, [ebp - 0x72c]
push esi
push eax
call fcn.00421690
cmp dword [ebp - 0x730], 8
lea eax, [ebp - 0x744]
push str.WnBuyVip.exe
cmovae eax, dword [ebp - 0x744]
push eax
lea eax, [ebp - 0x524]
push esi
push eax
call fcn.00421690
lea eax, [ebp - 0x524]
push eax
lea eax, [ebp - 0x72c]
push eax
call fcn.004b1242
lea eax, [ebp - 0x524]
push eax
lea eax, [ebp - 0x72c]
push eax
push str._trename__s_to__s
call fcn.00489d6a
mov al, byte [0x66ff88]
add esp, 0x40
test al, al
je 0x43f060
push str._trename_RunBuyVip
call fcn.00489d6a
xor ebx, ebx
push ebx
call fcn.0044080e
pop ecx
pop ecx
jmp 0x43f062
xor ebx, ebx
cmp dword [ebp - 0x730], 8
lea ecx, [ebp - 0xa88]
push ecx
push fcn.0043f8a6
lea ecx, [ebp - 0x31c]
lea eax, [ebp - 0x744]
cmovae eax, dword [ebp - 0x744]
push ecx
push eax
call fcn.0041be3e
add esp, 0x10
mov dword [ebp - 0x838], 7
xor eax, eax
mov dword [ebp - 0x83c], ebx
mov esi, 0x64a7dc
mov word [ebp - 0x84c], ax
lea ecx, [ebp - 0x84c]
push ebx
push esi
call fcn.00401ea0
push ebx
xor eax, eax
mov byte [ebp - 4], 0xa
push esi
lea ecx, [ebp - 0x75c]
mov dword [ebp - 0x748], 7
mov dword [ebp - 0x74c], ebx
mov word [ebp - 0x75c], ax
call fcn.00401ea0
lea eax, [ebp - 0x744]
mov byte [ebp - 4], 0xb
push eax
lea ecx, [ebp - 0x87c]
call fcn.00403980
mov esi, str.WnUtility.exe
mov byte [ebp - 4], 0xc
push esi
call fcn.004a6baf
pop ecx
push eax
push esi
lea ecx, [ebp - 0x87c]
call fcn.00403b60
xor eax, eax
mov dword [ebp - 0x820], 7
mov esi, 0x5e5f9c
mov dword [ebp - 0x824], ebx
push esi
mov word [ebp - 0x834], ax
call fcn.004a6baf
pop ecx
push eax
push esi
lea ecx, [ebp - 0x834]
call fcn.00401ea0
mov byte [ebp - 4], 0xd
call fcn.004212c6
mov ecx, eax
call fcn.00429127
mov dword [ebp - 0xa78], eax
call fcn.004212c6
mov ecx, eax
call fcn.004290f0
mov ebx, eax
lea ecx, [ebp - 0x8dc]
push ebx
call fcn.00401d40
mov esi, 0x5e5fa0
mov byte [ebp - 4], 0xe
push esi
call fcn.004a6baf
pop ecx
push eax
push 0
push esi
lea ecx, [ebp - 0x8dc]
call fcn.00404600
mov dword [ebp - 0xa8c], eax
call fcn.004212c6
mov ecx, eax
call fcn.0042907d
xor esi, esi
test eax, eax
push 1
pop eax
cmovne esi, eax
call fcn.004212c6
mov ecx, eax
call fcn.00429076
mov edx, dword [ebp + 0xc]
neg eax
sbb eax, eax
xor ecx, ecx
neg eax
inc ecx
test edx, edx
cmove ecx, esi
xor esi, esi
inc esi
mov dword [ebp - 0xaa0], ecx
test edx, edx
cmove esi, eax
call fcn.004212c6
mov ecx, eax
call fcn.00429084
xor edx, edx
test eax, eax
push 1
mov ecx, edx
mov dword [ebp - 0xa84], edx
pop eax
cmovne ecx, eax
mov dword [ebp - 0xa80], edx
mov dword [ebp - 0xa90], ecx
mov dword [ebp - 0xa7c], edx
push dword [ebp - 0xa78]
mov byte [ebp - 4], 0xf
call fcn.004a6baf
pop ecx
test eax, eax
je 0x43f352
and dword [ebp - 0x7f4], 0
xor eax, eax
push 0x5e5fa8
mov dword [ebp - 0x7f0], 7
mov word [ebp - 0x804], ax
call fcn.004a6baf
pop ecx
push eax
push 0x5e5fa8
lea ecx, [ebp - 0x804]
call fcn.00401ea0
lea eax, [ebp - 0x804]
mov byte [ebp - 4], 0x10
push eax
lea ecx, [ebp - 0xa84]
call fcn.0042a543
xor eax, eax
mov byte [ebp - 4], 0xf
push 0
inc eax
lea ecx, [ebp - 0x804]
push eax
call fcn.00401de0
push dword [ebp - 0xa78]
lea ecx, [ebp - 0x8f4]
call fcn.00401d40
lea eax, [ebp - 0x8f4]
mov byte [ebp - 4], 0x11
push eax
lea ecx, [ebp - 0xa84]
call fcn.0042a543
xor eax, eax
mov byte [ebp - 4], 0xf
push 0
inc eax
lea ecx, [ebp - 0x8f4]
push eax
call fcn.00401de0
and dword [ebp - 0x80c], 0
xor eax, eax
push 0x5e5fb0
mov dword [ebp - 0x808], 7
mov word [ebp - 0x81c], ax
call fcn.004a6baf
pop ecx
push eax
push 0x5e5fb0
lea ecx, [ebp - 0x81c]
call fcn.00401ea0
lea eax, [ebp - 0x81c]
mov byte [ebp - 4], 0x12
push eax
lea ecx, [ebp - 0xa84]
call fcn.0042a543
xor eax, eax
mov byte [ebp - 4], 0xf
push 0
inc eax
lea ecx, [ebp - 0x81c]
push eax
call fcn.00401de0
push ebx
lea ecx, [ebp - 0x924]
call fcn.00401d40
lea eax, [ebp - 0x924]
mov byte [ebp - 4], 0x13
push eax
lea ecx, [ebp - 0xa84]
call fcn.0042a543
lea ecx, [ebp - 0x924]
jmp 0x43f3b5
push 0x5e5fb0
lea ecx, [ebp - 0x93c]
call fcn.00401d40
lea eax, [ebp - 0x93c]
mov byte [ebp - 4], 0x14
push eax
lea ecx, [ebp - 0xa84]
call fcn.0042a543
xor eax, eax
mov byte [ebp - 4], 0xf
push 0
inc eax
lea ecx, [ebp - 0x93c]
push eax
call fcn.00401de0
push ebx
lea ecx, [ebp - 0x954]
call fcn.00401d40
lea eax, [ebp - 0x954]
mov byte [ebp - 4], 0x15
push eax
lea ecx, [ebp - 0xa84]
call fcn.0042a543
lea ecx, [ebp - 0x954]
xor eax, eax
mov byte [ebp - 4], 0xf
xor ebx, ebx
inc eax
push ebx
push eax
call fcn.00401de0
cmp dword [ebp - 0xa8c], 0xffffffff
je 0x43f442
push 0x5e5fb8
lea ecx, [ebp - 0x96c]
call fcn.00401d40
lea eax, [ebp - 0x96c]
mov byte [ebp - 4], 0x16
push eax
lea ecx, [ebp - 0xa84]
call fcn.0042a543
xor eax, eax
mov byte [ebp - 4], 0xf
push ebx
inc eax
lea ecx, [ebp - 0x96c]
push eax
call fcn.00401de0
push 0x5e19a4
lea ecx, [ebp - 0x984]
call fcn.00401d40
lea eax, [ebp - 0x984]
mov byte [ebp - 4], 0x17
push eax
lea ecx, [ebp - 0xa84]
call fcn.0042a543
xor eax, eax
mov byte [ebp - 4], 0xf
push ebx
inc eax
lea ecx, [ebp - 0x984]
push eax
call fcn.00401de0
test esi, esi
jne 0x43f4b7
push 0x5e5fc0
lea ecx, [ebp - 0x99c]
call fcn.00401d40
lea eax, [ebp - 0x99c]
mov byte [ebp - 4], 0x18
push eax
lea ecx, [ebp - 0xa84]
call fcn.0042a543
push ebx
inc esi
mov byte [ebp - 4], 0xf
push esi
lea ecx, [ebp - 0x99c]
call fcn.00401de0
push 0x5e19a8
lea ecx, [ebp - 0x9b4]
call fcn.00401d40
lea eax, [ebp - 0x9b4]
mov byte [ebp - 4], 0x19
push eax
lea ecx, [ebp - 0xa84]
call fcn.0042a543
push ebx
push esi
lea ecx, [ebp - 0x9b4]
mov byte [ebp - 4], 0xf
call fcn.00401de0
jmp 0x43f4ba
xor esi, esi
inc esi
cmp dword [ebp - 0xaa0], 0
jne 0x43f531
push 0x5e5fc8
lea ecx, [ebp - 0x9cc]
call fcn.00401d40
lea eax, [ebp - 0x9cc]
mov byte [ebp - 4], 0x1a
push eax
lea ecx, [ebp - 0xa84]
call fcn.0042a543
push ebx
push esi
lea ecx, [ebp - 0x9cc]
mov byte [ebp - 4], 0xf
call fcn.00401de0
push 0x5e19a8
lea ecx, [ebp - 0x9e4]
call fcn.00401d40
lea eax, [ebp - 0x9e4]
mov byte [ebp - 4], 0x1b
push eax
lea ecx, [ebp - 0xa84]
call fcn.0042a543
push ebx
push esi
lea ecx, [ebp - 0x9e4]
mov byte [ebp - 4], 0xf
call fcn.00401de0
cmp dword [ebp + 0xc], 0
jne 0x43f5a5
push 0x5e5fd0
lea ecx, [ebp - 0x9fc]
call fcn.00401d40
lea eax, [ebp - 0x9fc]
mov byte [ebp - 4], 0x1c
push eax
lea ecx, [ebp - 0xa84]
call fcn.0042a543
push ebx
push esi
lea ecx, [ebp - 0x9fc]
mov byte [ebp - 4], 0xf
call fcn.00401de0
push 0x5e19a8
lea ecx, [ebp - 0xa14]
call fcn.00401d40
lea eax, [ebp - 0xa14]
mov byte [ebp - 4], 0x1d
push eax
lea ecx, [ebp - 0xa84]
call fcn.0042a543
push ebx
push esi
lea ecx, [ebp - 0xa14]
mov byte [ebp - 4], 0xf
call fcn.00401de0
cmp dword [ebp - 0xa90], 0
je 0x43f61c
push 0x5e5fd8
lea ecx, [ebp - 0x90c]
call fcn.00401d40
lea eax, [ebp - 0x90c]
mov byte [ebp - 4], 0x1e
push eax
lea ecx, [ebp - 0xa84]
call fcn.0042a543
push ebx
push esi
lea ecx, [ebp - 0x90c]
mov byte [ebp - 4], 0xf
call fcn.00401de0
push 0x5e19a4
lea ecx, [ebp - 0xa2c]
call fcn.00401d40
lea eax, [ebp - 0xa2c]
mov byte [ebp - 4], 0x1f
push eax
lea ecx, [ebp - 0xa84]
call fcn.0042a543
push ebx
push esi
lea ecx, [ebp - 0xa2c]
mov byte [ebp - 4], 0xf
call fcn.00401de0
test edi, edi
je 0x43f68e
push 0x5e5fe0
lea ecx, [ebp - 0xa44]
call fcn.00401d40
lea eax, [ebp - 0xa44]
mov byte [ebp - 4], 0x20
push eax
lea ecx, [ebp - 0xa84]
call fcn.0042a543
push ebx
push esi
lea ecx, [ebp - 0xa44]
mov byte [ebp - 4], 0xf
call fcn.00401de0
push 0x5e19a4
lea ecx, [ebp - 0xa5c]
call fcn.00401d40
lea eax, [ebp - 0xa5c]
mov byte [ebp - 4], 0x21
push eax
lea ecx, [ebp - 0xa84]
call fcn.0042a543
push ebx
push esi
lea ecx, [ebp - 0xa5c]
mov byte [ebp - 4], 0xf
call fcn.00401de0
push 0x5e5fe8
lea ecx, [ebp - 0x8c4]
call fcn.00401d40
lea eax, [ebp - 0xa84]
mov byte [ebp - 4], 0x22
push eax
lea eax, [ebp - 0x8c4]
push eax
lea eax, [ebp - 0xa74]
push eax
call fcn.00487f4e
add esp, 0xc
lea ecx, [ebp - 0x75c]
push eax
call fcn.00403900
push ebx
push esi
lea ecx, [ebp - 0xa74]
call fcn.00401de0
push ebx
push esi
lea ecx, [ebp - 0x8c4]
mov byte [ebp - 4], 0xf
call fcn.00401de0
lea eax, [ebp - 0x87c]
push eax
lea ecx, [ebp - 0x7bc]
call fcn.00403980
mov byte [ebp - 4], 0x23
test edi, edi
je 0x43f716
push esi
push str.InstRate_RunUtility
push esi
call fcn.004226f8
mov ecx, eax
call fcn.0042719a
cmp dword [ebp - 0x748], 8
lea ecx, [ebp - 0x75c]
push ebx
cmovae ecx, dword [ebp - 0x75c]
lea eax, [ebp - 0x7bc]
cmp dword [ebp - 0x7a8], 8
push 0x2710
cmovae eax, dword [ebp - 0x7bc]
push esi
push ecx
push eax
call fcn.004826c1
cmp dword [ebp - 0x748], 8
lea ecx, [ebp - 0x75c]
lea eax, [ebp - 0x7bc]
cmovae ecx, dword [ebp - 0x75c]
cmp dword [ebp - 0x7a8], 8
push ecx
cmovae eax, dword [ebp - 0x7bc]
push eax
push str.cmd:_s__s
call fcn.00489d6a
mov ecx, dword [ebp - 0xa88]
push 0x64
pop esi
mov eax, esi
sub eax, ecx
push 3
pop edi
cdq
idiv edi
push esi
add ecx, eax
push ecx
mov dword [ebp - 0xa88], ecx
call fcn.0043f8a6
mov ecx, dword [ebp - 0xa88]
mov eax, esi
sub eax, ecx
cdq
idiv edi
push esi
add ecx, eax
push ecx
mov dword [ebp - 0xa88], ecx
call fcn.0043f8a6
add esp, 0x30
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
push esi
call fcn.0043f8a6
pop ecx
pop ecx
xor esi, esi
lea ecx, [ebp - 0x7bc]
push ebx
inc esi
push esi
call fcn.00401de0
lea ecx, [ebp - 0xa84]
call fcn.00422d41
push ebx
push esi
lea ecx, [ebp - 0x8dc]
call fcn.00401de0
push ebx
push esi
lea ecx, [ebp - 0x834]
call fcn.00401de0
push ebx
push esi
lea ecx, [ebp - 0x87c]
call fcn.00401de0
push ebx
push esi
lea ecx, [ebp - 0x75c]
call fcn.00401de0
push ebx
push esi
lea ecx, [ebp - 0x84c]
call fcn.00401de0
lea ecx, [ebp - 0xa9c]
call fcn.00422d41
push ebx
push esi
lea ecx, [ebp - 0x864]
call fcn.00401de0
jmp 0x43f850
xor ebx, ebx
inc esi
push ebx
push esi
lea ecx, [ebp - 0x78c]
call fcn.00401de0
push ebx
push esi
lea ecx, [ebp - 0x774]
call fcn.00401de0
push ebx
push esi
lea ecx, [ebp - 0x894]
call fcn.00401de0
push ebx
push esi
lea ecx, [ebp - 0x8ac]
call fcn.00401de0
push ebx
push esi
lea ecx, [ebp - 0x744]
call fcn.00401de0
push ebx
push esi
lea ecx, [ebp - 0x7a4]
call fcn.00401de0
call fcn.00447f83
ret 0xc