Function at 0x462d50
Capabilities:
Check if file exists
Extract resource via kernel32 functions
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5922cd
mov eax, dword fs:[0]
push eax
mov eax, 0x1240
call fcn.00555270
mov eax, dword [0x5deba8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x462d9b
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x462da2
xor eax, eax
jmp 0x4639b7
mov dword [ebp - 0x101c], 0
push 0
push 0x80
push 3
push 0
push 1
push SHChangeNotifyDeregister
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x1038], eax
cmp dword [ebp - 0x1038], 0xffffffff
jne 0x462e5f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1124], eax
lea ecx, [ebp - 0x1128]
call fcn.0041d970
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x1124]
push eax
push str.ErrorMessage_d
lea ecx, [ebp - 0x1128]
push ecx
call fcn.00423c30
add esp, 0xc
cmp dword [ebp - 0x1124], 5
je 0x462e38
push 0
push 0x5b12f8
lea ecx, [ebp - 0x1128]
call fcn.0041e1e0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 0x11f8], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1128]
call fcn.0041dab0
mov eax, dword [ebp - 0x11f8]
jmp 0x4639b7
push 0
lea edx, [ebp - 0x1120]
push edx
push 0x40
lea eax, [ebp - 0x1014]
push eax
mov ecx, dword [ebp - 0x1038]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x462ea3
push 0x5b1300
call fcn.005726f5
add esp, 4
mov edx, dword [ebp - 0x1038]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4639b7
movzx eax, word [ebp - 0x1014]
cmp eax, 0x5a4d
je 0x462ec5
mov ecx, dword [ebp - 0x1038]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4639b7
push 0
push 0
mov edx, dword [ebp - 0xfd8]
push edx
mov eax, dword [ebp - 0x1038]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x462ef6
mov ecx, dword [ebp - 0x1038]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4639b7
push 0
lea edx, [ebp - 0x1120]
push edx
push 4
lea eax, [ebp - 0x1018]
push eax
mov ecx, dword [ebp - 0x1038]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x462f3a
push 0x5b131c
call fcn.005726f5
add esp, 4
mov edx, dword [ebp - 0x1038]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4639b7
cmp dword [ebp - 0x1018], 0x4550
je 0x462f67
push str.not_a_pe_file
call fcn.005726f5
add esp, 4
mov eax, dword [ebp - 0x1038]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4639b7
push 0
lea ecx, [ebp - 0x1120]
push ecx
push 0x14
lea edx, [ebp - 0x1034]
push edx
mov eax, dword [ebp - 0x1038]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x462fab
push 0x5b1344
call fcn.005726f5
add esp, 4
mov ecx, dword [ebp - 0x1038]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4639b7
push 0
lea edx, [ebp - 0x1120]
push edx
push 0xe0
lea eax, [ebp - 0x111c]
push eax
mov ecx, dword [ebp - 0x1038]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x462ff2
push 0x5b1360
call fcn.005726f5
add esp, 4
mov edx, dword [ebp - 0x1038]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4639b7
push 0
push 0
push 0
mov eax, dword [ebp - 0x1038]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x46301e
mov ecx, dword [ebp - 0x1038]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4639b7
mov edx, dword [ebp - 0x1038]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1020], 0
mov ecx, 0x5eda84
call fcn.00463ec0
push 2
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 0x1038], eax
push 0
push 0x461ea0
push 0xe
mov ecx, dword [ebp - 0x1038]
push ecx
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
test eax, eax
setne dl
mov byte [ebp - 0x1039], dl
movzx eax, byte [ebp - 0x1039]
test eax, eax
jne 0x46308b
xor eax, eax
jmp 0x4639b7
mov ecx, 0x5eda84
call fcn.00463e70
mov dword [ebp - 0x112c], eax
lea ecx, [ebp - 0x1130]
call fcn.00463f60
mov byte [ebp - 0x1155], 0
push 0x5b137c
lea ecx, [ebp - 0x1154]
call fcn.0041d9b0
mov dword [ebp - 4], 1
mov dword [ebp - 0x1150], 0
push 0x5b1113
lea ecx, [ebp - 0x114c]
call fcn.0045fb10
mov byte [ebp - 4], 2
cmp dword [ebp + 0xc], 0xffffffff
je 0x46332e
mov ecx, 0x5eda84
call fcn.00463e70
cmp dword [ebp + 0xc], eax
jge 0x46332e
lea ecx, [ebp - 0x11fc]
push ecx
mov ecx, 0x5eda84
call fcn.00463e10
mov edx, dword [eax]
mov dword [ebp - 0x1130], edx
jmp 0x46312e
push 0
lea eax, [ebp - 0x1200]
push eax
lea ecx, [ebp - 0x1130]
call fcn.00463fa0
lea ecx, [ebp - 0x1204]
push ecx
mov ecx, 0x5eda84
call fcn.00463e40
push eax
lea ecx, [ebp - 0x1130]
call fcn.00463ff0
movzx edx, al
test edx, edx
je 0x4632d2
lea ecx, [ebp - 0x1130]
call fcn.00463f80
push eax
lea ecx, [ebp - 0x114c]
call fcn.00460140
mov dword [ebp - 0x115c], 0
lea ecx, [ebp - 0x114c]
call fcn.0041e510
push eax
lea ecx, [ebp - 0x1160]
call fcn.0041da30
mov byte [ebp - 4], 3
cmp dword [ebp + 0xc], 0xffffffff
je 0x463260
cmp dword [ebp + 0xc], 0
jge 0x463260
cmp dword [ebp + 0xc], 0
jge 0x46325e
mov eax, dword [ebp + 0xc]
push eax
call fcn.00460780
add esp, 4
mov dword [ebp - 0x1168], eax
lea ecx, [ebp - 0x1164]
call fcn.0041d970
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x1168]
push ecx
push 0x5b1380
lea edx, [ebp - 0x1164]
push edx
call fcn.00423c30
add esp, 0xc
lea ecx, [ebp - 0x1160]
call fcn.0041e1e0
push eax
lea ecx, [ebp - 0x1164]
call fcn.0041dbd0
test eax, eax
je 0x46322c
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1164]
call fcn.0041dab0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1160]
call fcn.0041dab0
jmp 0x46311a
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1164]
call fcn.0041dab0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1160]
call fcn.0041dab0
jmp 0x4632d2
jmp 0x4632be
cmp dword [ebp + 0xc], 0xffffffff
je 0x4632be
cmp dword [ebp + 0xc], 0
jle 0x4632be
mov eax, dword [ebp - 0x1150]
cmp eax, dword [ebp + 0xc]
je 0x4632a2
cmp dword [ebp + 0xc], 0
jle 0x4632a2
mov ecx, dword [ebp - 0x1150]
add ecx, 1
mov dword [ebp - 0x1150], ecx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1160]
call fcn.0041dab0
jmp 0x46311a
mov edx, dword [ebp - 0x1150]
cmp edx, dword [ebp + 0xc]
jne 0x4632be
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1160]
call fcn.0041dab0
jmp 0x4632d2
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1160]
call fcn.0041dab0
jmp 0x46311a
lea eax, [ebp - 0x1208]
push eax
mov ecx, 0x5eda84
call fcn.00463e40
push eax
lea ecx, [ebp - 0x1130]
call fcn.00463fd0
movzx ecx, al
test ecx, ecx
je 0x46332c
mov dword [ebp - 0x120c], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x114c]
call fcn.0041e490
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1154]
call fcn.0041dab0
mov eax, dword [ebp - 0x120c]
jmp 0x4639b7
jmp 0x46338a
lea edx, [ebp - 0x1210]
push edx
mov ecx, 0x5eda84
call fcn.00463e10
mov eax, dword [eax]
mov dword [ebp - 0x1130], eax
lea ecx, [ebp - 0x1130]
call fcn.00463f80
push eax
lea ecx, [ebp - 0x114c]
call fcn.00460140
mov dword [ebp - 0x116c], 0
lea ecx, [ebp - 0x114c]
call fcn.0041e510
push eax
lea ecx, [ebp - 0x1170]
call fcn.0041da30
lea ecx, [ebp - 0x1170]
call fcn.0041dab0
mov dword [ebp - 0x1174], 0
lea ecx, [ebp - 0x114c]
call fcn.0041e510
push eax
lea ecx, [ebp - 0x1178]
call fcn.0041da30
mov byte [ebp - 4], 5
push ecx
mov ecx, esp
mov dword [ebp - 0x1214], esp
lea edx, [ebp - 0x1178]
push edx
call fcn.0041d990
mov dword [ebp - 0x1244], eax
call fcn.00461df0
add esp, 4
mov byte [ebp - 0x1245], al
movzx eax, byte [ebp - 0x1245]
test eax, eax
jne 0x46347a
lea ecx, [ebp - 0x114c]
call fcn.0041e510
push eax
call fcn.00578c75
add esp, 4
mov dword [ebp - 0x117c], eax
cmp dword [ebp - 0x117c], 0
jl 0x463435
cmp dword [ebp - 0x117c], 0xffff
jge 0x463435
push 0xe
movzx ecx, word [ebp - 0x117c]
push ecx
mov edx, dword [ebp - 0x1038]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x1174], eax
jmp 0x463478
lea ecx, [ebp - 0x114c]
call fcn.0041e510
push eax
lea ecx, [ebp - 0x1180]
call fcn.0041da30
push 0xe
lea ecx, [ebp - 0x1180]
call fcn.0041e1e0
push eax
mov eax, dword [ebp - 0x1038]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x1174], eax
lea ecx, [ebp - 0x1180]
call fcn.0041dab0
jmp 0x4634bd
lea ecx, [ebp - 0x114c]
call fcn.0041e510
push eax
lea ecx, [ebp - 0x1184]
call fcn.0041da30
push 0xe
lea ecx, [ebp - 0x1184]
call fcn.0041e1e0
push eax
mov ecx, dword [ebp - 0x1038]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x1174], eax
lea ecx, [ebp - 0x1184]
call fcn.0041dab0
cmp dword [ebp - 0x1174], 0
je 0x463918
mov edx, dword [ebp - 0x1174]
push edx
mov eax, dword [ebp - 0x1038]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x1188], eax
cmp dword [ebp - 0x1188], 0
je 0x463916
mov ecx, dword [ebp - 0x1188]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x11bc], eax
push 0x18
call fcn.00553a71
add esp, 4
mov dword [ebp - 0x1218], eax
mov edx, dword [ebp - 0x1218]
mov dword [ebp - 0x1190], edx
mov eax, dword [ebp - 0x11bc]
mov cx, word [eax]
mov word [ebp - 0x118c], cx
mov edx, dword [ebp - 0x11bc]
mov ax, word [edx + 2]
mov word [ebp - 0x11c0], ax
mov ecx, dword [ebp - 0x11bc]
mov dx, word [ecx + 4]
mov word [ebp - 0x11c4], dx
mov eax, dword [ebp - 0x1190]
mov cx, word [ebp - 0x11c4]
mov word [eax + 4], cx
mov edx, dword [ebp - 0x1190]
mov ax, word [ebp - 0x11c0]
mov word [edx + 2], ax
mov ecx, dword [ebp - 0x1190]
mov dx, word [ebp - 0x118c]
mov word [ecx], dx
lea ecx, [ebp - 0x11b8]
call fcn.004619b0
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x1190]
sub esp, 0x18
mov ecx, esp
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov edx, dword [eax + 0xc]
mov dword [ecx + 0xc], edx
mov edx, dword [eax + 0x10]
mov dword [ecx + 0x10], edx
mov eax, dword [eax + 0x14]
mov dword [ecx + 0x14], eax
lea ecx, [ebp - 0x11b8]
call fcn.00461ae0
mov ecx, dword [ebp - 0x1190]
movzx edx, word [ecx + 4]
test edx, edx
je 0x4638ec
mov dword [ebp - 0x11cc], 0
mov dword [ebp - 0x11c8], 0
mov dword [ebp - 0x11d8], 0
mov dword [ebp - 0x11d0], 0
mov dword [ebp - 0x11d4], 0
mov dword [ebp - 0x11dc], 0
jmp 0x46362a
mov eax, dword [ebp - 0x11dc]
add eax, 1
mov dword [ebp - 0x11dc], eax
mov ecx, dword [ebp - 0x1190]
movzx edx, word [ecx + 4]
cmp dword [ebp - 0x11dc], edx
jge 0x4638db
mov eax, dword [ebp - 0x11dc]
imul eax, eax, 0xe
mov ecx, dword [ebp - 0x11bc]
lea edx, [ecx + eax + 6]
push edx
call fcn.004639d0
add esp, 4
mov dword [ebp - 0x11cc], eax
push 3
mov eax, dword [ebp - 0x11cc]
movzx ecx, word [eax + 0xc]
push ecx
mov edx, dword [ebp - 0x1038]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x11e8], eax
cmp dword [ebp - 0x11e8], 0
jne 0x4636df
mov dword [ebp - 0x121c], 0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x11b8]
call fcn.004619f0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1178]
call fcn.0041dab0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x114c]
call fcn.0041e490
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1154]
call fcn.0041dab0
mov eax, dword [ebp - 0x121c]
jmp 0x4639b7
mov eax, dword [ebp - 0x11e8]
push eax
mov ecx, dword [ebp - 0x1038]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x11e4], eax
cmp dword [ebp - 0x11e4], 0
jne 0x463756
mov dword [ebp - 0x1220], 0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x11b8]
call fcn.004619f0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1178]
call fcn.0041dab0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x114c]
call fcn.0041e490
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1154]
call fcn.0041dab0
mov eax, dword [ebp - 0x1220]
jmp 0x4639b7
mov edx, dword [ebp - 0x11e4]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x11f4], eax
cmp dword [ebp - 0x11f4], 0
jne 0x4637c6
mov dword [ebp - 0x1224], 0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x11b8]
call fcn.004619f0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1178]
call fcn.0041dab0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x114c]
call fcn.0041e490
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1154]
call fcn.0041dab0
mov eax, dword [ebp - 0x1224]
jmp 0x4639b7
mov eax, dword [ebp - 0x11e8]
push eax
mov ecx, dword [ebp - 0x1038]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x11e0], eax
mov edx, dword [ebp - 0x11e0]
push edx
call fcn.00553501
add esp, 4
mov dword [ebp - 0x1228], eax
mov eax, dword [ebp - 0x1228]
mov dword [ebp - 0x11f0], eax
mov ecx, dword [ebp - 0x11e0]
push ecx
mov edx, dword [ebp - 0x11f4]
push edx
mov eax, dword [ebp - 0x11f0]
push eax
call fcn.005544b0
add esp, 0xc
push 8
call fcn.00553a71
add esp, 4
mov dword [ebp - 0x1230], eax
cmp dword [ebp - 0x1230], 0
je 0x46384a
mov ecx, dword [ebp - 0x1230]
call fcn.00461600
mov dword [ebp - 0x124c], eax
jmp 0x463854
mov dword [ebp - 0x124c], 0
mov ecx, dword [ebp - 0x124c]
mov dword [ebp - 0x122c], ecx
mov edx, dword [ebp - 0x122c]
mov dword [ebp - 0x11ec], edx
mov eax, dword [ebp - 0x11e0]
push eax
mov ecx, dword [ebp - 0x11f0]
push ecx
mov ecx, dword [ebp - 0x11ec]
call fcn.00461700
mov edx, dword [ebp - 0x11ec]
push edx
lea ecx, [ebp - 0x11b8]
call fcn.00461b20
cmp dword [ebp - 0x11f0], 0
je 0x4638bb
mov eax, dword [ebp - 0x11f0]
mov dword [ebp - 0x1234], eax
mov ecx, dword [ebp - 0x1234]
push ecx
call fcn.00552dca
add esp, 4
mov edx, dword [ebp - 0x11cc]
mov dword [ebp - 0x1238], edx
mov eax, dword [ebp - 0x1238]
push eax
call fcn.00552dca
add esp, 4
jmp 0x46361b
lea ecx, [ebp - 0x11b8]
call fcn.00461bb0
mov dword [ebp - 0x101c], eax
mov ecx, dword [ebp - 0x1190]
mov dword [ebp - 0x123c], ecx
mov edx, dword [ebp - 0x123c]
push edx
call fcn.00552dca
add esp, 4
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x11b8]
call fcn.004619f0
jmp 0x463967
mov eax, dword [ebp - 0x1038]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x1240], 0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1178]
call fcn.0041dab0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x114c]
call fcn.0041e490
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1154]
call fcn.0041dab0
mov eax, dword [ebp - 0x1240]
jmp 0x4639b7
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1178]
call fcn.0041dab0
mov ecx, dword [ebp - 0x1038]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x114c]
call fcn.0041e490
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1154]
call fcn.0041dab0
mov edx, dword [ebp - 0x1038]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x101c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055338c
mov esp, ebp
pop ebp
ret