Function at 0x417620
Capabilities:
Extract resource via kernel32 functions
Get common file path

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x448ab7
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x73c
mov eax, dword [0x45a080]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x4690e3
call fcn.00447953
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x45379c
mov esi, eax
push 0x9c
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edx, eax
mov dword [ebp - 0x680], 0
mov ecx, edx
mov dword [ebp - 0x67c], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x690], xmm0
lea esi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4176c0
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x690]
call fcn.00407e40
push 0x461cf0
lea eax, [ebp - 0x438]
mov dword [ebp - 4], 0
push 0x104
push eax
call fcn.0042a8b3
add esp, 0xc
lea eax, [ebp - 0x120]
push 0x461cf0
push 0x104
push eax
call fcn.0042a8b3
lea ecx, [ebp - 0x120]
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x417718
sub ecx, edx
lea eax, [ecx - 1]
test eax, eax
jle 0x417743
nop dword [eax + eax]
cmp byte [ebp + eax - 0x120], 0x5c
je 0x417bcc
dec eax
test eax, eax
jg 0x417730
push 0
push 0
lea eax, [ebp - 0x228]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x417773
push str._USERPROFILE_Desktop
lea eax, [ebp - 0x228]
push 0x104
push eax
call fcn.0042a8b3
add esp, 0xc
lea eax, [ebp - 0x228]
push eax
push str._sNetScr.exe
lea eax, [ebp - 0x540]
push 0x104
push eax
call fcn.004013f0
add esp, 0x10
lea eax, [ebp - 0x330]
push eax
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
je 0x4177be
lea eax, [ebp - 0x330]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x330]
push eax
push str._sESET_NetScr.xml
lea eax, [ebp - 0x648]
push 0x104
push eax
call fcn.004013f0
xorps xmm0, xmm0
mov dword [ebp - 0x668], 0
lea ecx, [ebp - 0x438]
mov dword [ebp - 0x664], 0
add esp, 0x10
lea edx, [ecx + 1]
movups xmmword [ebp - 0x678], xmm0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x417805
sub ecx, edx
lea eax, [ebp - 0x438]
push ecx
push eax
lea ecx, [ebp - 0x678]
call fcn.00407e40
mov eax, dword [0x4537d4]
xorps xmm0, xmm0
movups xmmword [ebp - 0x660], xmm0
mov dword [ebp - 0x658], eax
mov ax, word [0x4537d8]
movq xmm0, qword [str._NETSCREXEPATH_]
mov word [ebp - 0x654], ax
mov al, byte [0x4537da]
mov dword [ebp - 0x650], 0xf
mov dword [ebp - 0x64c], 0xf
movq qword [ebp - 0x660], xmm0
mov byte [ebp - 0x652], al
mov byte [ebp - 0x651], 0
lea eax, [ebp - 0x678]
mov byte [ebp - 4], 2
push eax
lea edx, [ebp - 0x660]
lea ecx, [ebp - 0x690]
call fcn.004168f0
mov byte [ebp - 4], 1
add esp, 4
mov ecx, dword [ebp - 0x64c]
cmp ecx, 0xf
jbe 0x4178d6
mov edx, dword [ebp - 0x660]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4178cc
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x417c07
push ecx
push edx
call fcn.00421cfe
add esp, 8
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x664]
cmp ecx, 0xf
jbe 0x417914
mov edx, dword [ebp - 0x678]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41790a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x417c07
push ecx
push edx
call fcn.00421cfe
add esp, 8
xorps xmm0, xmm0
mov dword [ebp - 0x668], 0
lea ecx, [ebp - 0x540]
mov dword [ebp - 0x664], 0
movups xmmword [ebp - 0x678], xmm0
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x417940
sub ecx, edx
lea eax, [ebp - 0x540]
push ecx
push eax
lea ecx, [ebp - 0x678]
call fcn.00407e40
lea eax, [ebp - 0x694]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x660]
mov dword [ebp - 0x694], 0x1f
xorps xmm0, xmm0
push eax
movups xmmword [ebp - 0x660], xmm0
call fcn.004084a0
movups xmm0, xmmword [str._NETSCRDESKTOPATH_]
mov ecx, dword [ebp - 0x694]
mov dword [ebp - 0x64c], ecx
movups xmmword [eax], xmm0
mov cx, word [0x453800]
mov word [eax + 0x10], cx
mov dword [ebp - 0x660], eax
mov dword [ebp - 0x650], 0x12
mov byte [eax + 0x12], 0
lea eax, [ebp - 0x678]
mov byte [ebp - 4], 4
push eax
lea edx, [ebp - 0x660]
lea ecx, [ebp - 0x690]
call fcn.004168f0
mov byte [ebp - 4], 3
add esp, 0xc
mov ecx, dword [ebp - 0x64c]
cmp ecx, 0xf
jbe 0x417a19
mov edx, dword [ebp - 0x660]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x417a0f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x417c07
push ecx
push edx
call fcn.00421cfe
add esp, 8
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x664]
cmp ecx, 0xf
jbe 0x417a57
mov edx, dword [ebp - 0x678]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x417a4d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x417c07
push ecx
push edx
call fcn.00421cfe
add esp, 8
lea ecx, [ebp - 0x648]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x417a60
sub ecx, edx
lea eax, [ebp - 0x648]
push ecx
push eax
mov ecx, 0x465a40
call fcn.00407c90
cmp dword [0x465a54], 0xf
lea ecx, [ebp - 0x748]
mov eax, 0x465a40
cmova eax, dword [0x465a40]
sub esp, 0xc
push eax
call fcn.0041a380
mov eax, dword [ebp - 0x748]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ofstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x748]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0x74c], eax
mov byte [ebp - 4], 5
lea edx, [ebp - 0x690]
cmp dword [ebp - 0x67c], 0xf
lea ecx, [ebp - 0x748]
push dword [ebp - 0x680]
cmova edx, dword [ebp - 0x690]
call fcn.0041b610
add esp, 4
lea ecx, [ebp - 0x744]
call fcn.0041a2f0
test eax, eax
jne 0x417b28
mov eax, dword [ebp - 0x748]
lea ecx, [ebp - 0x748]
push 0
add ecx, dword [eax + 4]
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.004165b0
mov eax, dword [ebp - 0x748]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ofstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x748]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0x74c], eax
lea ecx, [ebp - 0x744]
call fcn.00418fe0
mov eax, dword [ebp - 0x748]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ostream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x748]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ebp + ecx - 0x74c], eax
lea eax, [ebp - 0x6e0]
mov byte [ebp - 4], 6
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.00420fe4
mov ecx, dword [ebp - 0x67c]
add esp, 4
cmp ecx, 0xf
jbe 0x417bea
mov edx, dword [ebp - 0x690]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x417be0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x417c07
jmp 0x417be0
cmp eax, 0x104
jae 0x417c0c
mov byte [ebp + eax - 0x120], 0
jmp 0x417743
push ecx
push edx
call fcn.00421cfe
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0042195a
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.00430308
call fcn.00421edc
int3