Function at 0x6d001c67
Capabilities:
Delete file
Extract resource via kernel32 functions

Disassembly:
push ebp
sub esp, 0x628
lea ebp, [esp - 4]
mov eax, dword [0x6d0070c0]
xor eax, ebp
mov dword [ebp + 0x628], eax
push 0x38
mov eax, 0x6d004845
call fcn.6d003b34
lea ecx, [ebp - 0x44]
call fcn.6d00343d
and dword [ebp - 4], 0
mov esi, 0x104
push esi
lea eax, [ebp + 0x524]
push eax
push dword [0x6d007104]
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
push esi
lea eax, [ebp + 0x524]
push eax
push eax
call dword [sym.imp.kernel32.dll_GetShortPathNameA]
push 2
lea eax, [ebp + 0x114]
push eax
lea eax, [ebp + 0x524]
push eax
call fcn.6d0018dc
lea eax, [ebp + 0x524]
push eax
call fcn.6d003c50
add esp, 0x10
test eax, eax
jne 0x6d001d2f
push 1
push dword [ebp + 0x634]
push 0x7e
call fcn.6d003c50
add esp, 0xc
mov esi, eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.6d0025c4
mov eax, esi
lea esp, [ebp - 0x54]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x628]
xor ecx, ebp
call fcn.6d00396e
add ebp, 0x62c
leave
ret
and dword [ebp - 0x18], 0
mov ebx, dword [sym.imp.kernel32.dll_lstrlenA]
mov edi, 0x3fffffff
mov eax, dword [ebp - 0x18]
add eax, 0x12c
movzx eax, ax
push 6
push eax
push dword [0x6d007104]
call dword [sym.imp.kernel32.dll_FindResourceA]
mov esi, eax
push esi
push dword [0x6d007104]
call dword [sym.imp.kernel32.dll_LoadResource]
push esi
push dword [0x6d007104]
mov dword [ebp - 0x14], eax
call dword [sym.imp.kernel32.dll_SizeofResource]
cmp dword [ebp - 0x18], 6
mov esi, eax
jne 0x6d001e0b
lea eax, [ebp + 0x114]
push eax
lea eax, [ebp + 0x420]
push str._s_axbridgelib_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp + 0x420]
add esp, 0xc
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x6d001da8
sub eax, ecx
add eax, esi
push esi
push dword [ebp - 0x14]
mov byte [ebp + eax + 0x420], dl
lea eax, [ebp + 0x420]
push eax
call dword [sym.imp.MSVCR100.dll__mbsnbcat]
add esp, 0xc
xor esi, esi
lea eax, [ebp + 0x420]
push eax
cmp dword [ebp + 0x634], esi
je 0x6d001df3
call fcn.6d001b23
pop ecx
test eax, eax
jne 0x6d001e68
mov esi, 0x80004005
jmp 0x6d001cfb
call dword [sym.imp.kernel32.dll_DeleteFileA]
test eax, eax
jne 0x6d001e68
push esi
push esi
push 0x84
call fcn.6d003c50
jmp 0x6d001e65
push esi
push dword [ebp - 0x14]
lea eax, [ebp + 0x420]
push eax
call dword [sym.imp.MSVCR100.dll__mbsnbcpy]
add esp, 0xc
cmp dword [ebp - 0x18], 0
mov byte [ebp + esi + 0x420], 0
jne 0x6d001e46
lea eax, [ebp + 0x420]
push eax
lea eax, [ebp + 0x10]
push 0x6d00530c
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
cmp dword [ebp - 0x18], 4
jne 0x6d001e68
lea eax, [ebp + 0x420]
push eax
lea eax, [ebp + 0x31c]
push str._s.Bean
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp + 0x420]
push eax
call ebx
lea esi, [eax + 1]
cmp esi, edi
jle 0x6d001e7e
and dword [ebp - 0x10], 0
jmp 0x6d001e9b
lea eax, [esi + esi]
call fcn.6d003a40
mov eax, esp
push 3
push esi
lea ecx, [ebp + 0x420]
push ecx
push eax
call fcn.6d003c50
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax*4 + section..data]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x6d001eb6
push eax
call ebx
lea esi, [eax + 1]
cmp esi, edi
jle 0x6d001eba
xor eax, eax
jmp 0x6d001ed0
lea eax, [esi + esi]
call fcn.6d003a40
mov eax, esp
push 3
push esi
push dword [ebp - 0x14]
push eax
call fcn.6d003c50
push dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.6d002a7d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 9
jl 0x6d001d3e
lea eax, [ebp + 0x114]
push eax
lea eax, [ebp + 0x218]
push str._s_bin_axbridge.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp + 0x218]
push eax
call ebx
lea esi, [eax + 1]
cmp esi, edi
jle 0x6d001f1c
and dword [ebp - 0x10], 0
jmp 0x6d001f39
lea eax, [esi + esi]
call fcn.6d003a40
mov eax, esp
push 3
push esi
lea ecx, [ebp + 0x218]
push ecx
push eax
call fcn.6d003c50
mov dword [ebp - 0x10], eax
mov eax, dword [str.PROC_SERVER]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x6d001f4f
push eax
call ebx
lea esi, [eax + 1]
cmp esi, edi
jle 0x6d001f53
xor eax, eax
jmp 0x6d001f69
lea eax, [esi + esi]
call fcn.6d003a40
mov eax, esp
push 3
push esi
push dword [ebp - 0x14]
push eax
call fcn.6d003c50
push dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.6d002a7d
lea eax, [ebp + 0x524]
push eax
call ebx
lea esi, [eax + 1]
cmp esi, edi
jle 0x6d001f8c
and dword [ebp - 0x10], 0
jmp 0x6d001fa9
lea eax, [esi + esi]
call fcn.6d003a40
mov eax, esp
push 3
push esi
lea ecx, [ebp + 0x524]
push ecx
push eax
call fcn.6d003c50
mov dword [ebp - 0x10], eax
mov eax, dword [str.TLB_PATH]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x6d001fbf
push eax
call ebx
lea esi, [eax + 1]
cmp esi, edi
jle 0x6d001fc3
xor eax, eax
jmp 0x6d001fd9
lea eax, [esi + esi]
call fcn.6d003a40
mov eax, esp
push 3
push esi
push dword [ebp - 0x14]
push eax
call fcn.6d003c50
push dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.6d002a7d
lea eax, [ebp + 0x524]
push eax
call ebx
lea esi, [eax + 1]
cmp esi, edi
jle 0x6d001ffc
and dword [ebp - 0x10], 0
jmp 0x6d002019
lea eax, [esi + esi]
call fcn.6d003a40
mov eax, esp
push 3
push esi
lea ecx, [ebp + 0x524]
push ecx
push eax
call fcn.6d003c50
mov dword [ebp - 0x10], eax
mov eax, dword [str.ICON]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x6d00202f
push eax
call ebx
lea esi, [eax + 1]
cmp esi, edi
jle 0x6d002033
xor eax, eax
jmp 0x6d002049
lea eax, [esi + esi]
call fcn.6d003a40
mov eax, esp
push 3
push esi
push dword [ebp - 0x14]
push eax
call fcn.6d003c50
push dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.6d002a7d
cmp dword [ebp + 0x634], 0
je 0x6d002152
lea eax, [ebp + 0x31c]
push eax
call ebx
lea esi, [eax + 1]
cmp esi, edi
jle 0x6d002077
xor eax, eax
jmp 0x6d002091
lea eax, [esi + esi]
call fcn.6d003a40
mov eax, esp
push 3
push esi
lea ecx, [ebp + 0x31c]
push ecx
push eax
call fcn.6d003c50
lea ecx, [ebp]
push ecx
push eax
call dword [sym.imp.ole32.dll_CLSIDFromProgID]
test eax, eax
jne 0x6d00210b
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp]
push eax
call dword [sym.imp.ole32.dll_StringFromCLSID]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x6d0020c4
push eax
call dword [sym.imp.kernel32.dll_lstrlenW]
inc eax
cmp eax, edi
jle 0x6d0020c8
xor esi, esi
jmp 0x6d0020e2
lea esi, [eax + eax]
mov eax, esi
call fcn.6d003a40
mov eax, esp
push 3
push esi
push dword [ebp - 0x14]
push eax
call fcn.6d003c50
mov esi, eax
push dword [ebp - 0x10]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea eax, [ebp + 0x10]
push eax
push esi
call dword [sym.imp.MSVCR100.dll__mbsicmp]
pop ecx
pop ecx
test eax, eax
je 0x6d00210b
push 1
push dword [ebp + 0x634]
push 0x7f
jmp 0x6d001cf1
lea eax, [ebp + 0x524]
push eax
call ebx
lea esi, [eax + 1]
cmp esi, edi
jle 0x6d00211f
xor eax, eax
jmp 0x6d002139
lea eax, [esi + esi]
call fcn.6d003a40
mov eax, esp
push 3
push esi
lea ecx, [ebp + 0x524]
push ecx
push eax
call fcn.6d003c50
push 0x6d00532c
push 0xc9
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.6d00376a
jmp 0x6d001cf9
lea eax, [ebp + 0x524]
push eax
call ebx
lea esi, [eax + 1]
cmp esi, edi
jle 0x6d002166
xor eax, eax
jmp 0x6d002180
lea eax, [esi + esi]
call fcn.6d003a40
mov eax, esp
push 3
push esi
lea ecx, [ebp + 0x524]
push ecx
push eax
call fcn.6d003c50
push str.REGISTRY
push 0xc9
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.6d00380f
jmp 0x6d001cf9