Function at 0x49ab00
Capabilities:
Delete file
Extract resource via kernel32 functions
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x5954a0]
xor eax, ebp
mov dword [ebp - 0x20], eax
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
cmp dword [ebp + 8], 0
je 0x49ab45
mov eax, dword [ebp + 8]
push eax
call fcn.004f810a
add esp, 4
test eax, eax
ja 0x49ab4e
mov dword [ebp - 4], 0
jmp 0x49ab68
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x49ab68
xor eax, eax
jmp 0x49b2ae
mov dword [ebp - 0x10], 0
jmp 0x49ab7a
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0xc]
mov eax, dword [eax + 0x10]
sub eax, dword [ecx + 0xc]
cdq
mov ecx, 0x216
idiv ecx
cmp dword [ebp - 0x10], eax
jae 0x49b09c
xor edx, edx
mov word [ebp - 0x60], dx
push 0x3e
push 0
lea eax, [ebp - 0x5e]
push eax
call fcn.004f8090
add esp, 0xc
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x64], 0
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0xc]
mov eax, dword [ecx + 0x10]
sub eax, dword [edx + 0xc]
cdq
mov ecx, 0x216
idiv ecx
cmp dword [ebp - 0x10], eax
jb 0x49abee
call fcn.004fb0ce
xor edx, edx
jne 0x49abee
mov eax, dword [ebp - 0x10]
imul eax, eax, 0x216
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0xc]
cmp dword [eax + edx], 0x64
jne 0x49b097
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x74], 0
jmp 0x49ac40
mov eax, dword [ebp - 0x74]
add eax, 1
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0x400
jae 0x49ac93
mov ecx, dword [ebp - 0x74]
push ecx
push str.DOC_d
lea edx, [ebp - 0x60]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x553688
lea eax, [ebp - 0x60]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
jne 0x49ac7d
jmp 0x49ac93
mov edx, dword [ebp - 0x68]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, dword [ebp - 0x7c]
mov dword [ebp - 0x7c], eax
jmp 0x49ac37
mov ecx, dword [ebp - 0x7c]
push ecx
call fcn.004f8626
add esp, 4
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0
jne 0x49acbf
push 0x4000000
call fcn.004f8626
add esp, 4
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x64], 1
cmp dword [ebp - 0x70], 0
jne 0x49accf
jmp 0x49b0a3
cmp dword [ebp - 0x64], 0
jne 0x49ad62
mov edx, dword [ebp - 0x7c]
push edx
push 0
mov eax, dword [ebp - 0x70]
push eax
call fcn.004f8090
add esp, 0xc
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0xc]
mov eax, dword [ecx + 0x10]
sub eax, dword [edx + 0xc]
cdq
mov ecx, 0x216
idiv ecx
cmp dword [ebp - 0x10], eax
jb 0x49ad09
call fcn.004fb0ce
xor edx, edx
jne 0x49ad09
mov eax, dword [ebp - 0x10]
imul eax, eax, 0x216
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0xc]
mov ecx, dword [ebp - 0x70]
mov dword [edx + eax + 4], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
mov ecx, dword [edx + 0x10]
sub ecx, dword [eax + 0xc]
mov eax, ecx
cdq
mov ecx, 0x216
idiv ecx
cmp dword [ebp - 0x10], eax
jb 0x49ad43
call fcn.004fb0ce
xor edx, edx
jne 0x49ad43
mov eax, dword [ebp - 0x10]
imul eax, eax, 0x216
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0xc]
mov ecx, dword [ebp - 0x7c]
mov dword [edx + eax + 8], ecx
jmp 0x49af0b
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
mov ecx, dword [edx + 0x10]
sub ecx, dword [eax + 0xc]
mov eax, ecx
cdq
mov ecx, 0x216
idiv ecx
cmp dword [ebp - 0x10], eax
jb 0x49ad82
call fcn.004fb0ce
xor edx, edx
jne 0x49ad82
mov eax, dword [ebp - 0x10]
imul eax, eax, 0x216
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0xc]
lea eax, [edx + eax + 0xc]
push eax
push 0x200
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0xc]
mov eax, dword [ecx + 0x10]
sub eax, dword [edx + 0xc]
cdq
mov ecx, 0x216
idiv ecx
cmp dword [ebp - 0x10], eax
jb 0x49adc3
call fcn.004fb0ce
xor edx, edx
jne 0x49adc3
mov eax, dword [ebp - 0x10]
imul eax, eax, 0x216
mov ecx, dword [ebp + 0xc]
add eax, dword [ecx + 0xc]
mov dword [ebp - 0x80], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
mov ecx, dword [edx + 0x10]
sub ecx, dword [eax + 0xc]
mov eax, ecx
cdq
mov ecx, 0x216
idiv ecx
cmp dword [ebp - 0x10], eax
jb 0x49adf9
call fcn.004fb0ce
xor edx, edx
jne 0x49adf9
mov eax, dword [ebp - 0x10]
imul eax, eax, 0x216
mov ecx, dword [ebp + 0xc]
add eax, dword [ecx + 0xc]
mov dword [ebp - 0x84], eax
mov edx, dword [ebp - 0x84]
add edx, 0xc
push edx
call fcn.004f810a
add esp, 4
mov ecx, dword [ebp - 0x80]
movzx edx, word [ecx + eax*2 + 0xa]
cmp edx, 0x5c
je 0x49ae72
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0xc]
mov eax, dword [eax + 0x10]
sub eax, dword [ecx + 0xc]
cdq
mov ecx, 0x216
idiv ecx
cmp dword [ebp - 0x10], eax
jb 0x49ae4f
call fcn.004fb0ce
xor edx, edx
jne 0x49ae4f
push 0x5668c0
mov eax, dword [ebp - 0x10]
imul eax, eax, 0x216
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0xc]
lea eax, [edx + eax + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0xc]
mov eax, dword [ecx + 0x10]
sub eax, dword [edx + 0xc]
cdq
mov ecx, 0x216
idiv ecx
cmp dword [ebp - 0x10], eax
jb 0x49ae90
call fcn.004fb0ce
xor edx, edx
jne 0x49ae90
mov eax, dword [ebp - 0x10]
imul eax, eax, 0x216
mov ecx, dword [ebp + 0xc]
add eax, dword [ecx + 0xc]
mov dword [ebp - 0x88], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
mov ecx, dword [edx + 0x10]
sub ecx, dword [eax + 0xc]
mov eax, ecx
cdq
mov ecx, 0x216
idiv ecx
cmp dword [ebp - 0x10], eax
jb 0x49aec9
call fcn.004fb0ce
xor edx, edx
jne 0x49aec9
mov eax, dword [ebp - 0x10]
imul eax, eax, 0x216
mov ecx, dword [ebp + 0xc]
add eax, dword [ecx + 0xc]
mov dword [ebp - 0x8c], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
mov edx, dword [ebp - 0x88]
add edx, 0xc
push edx
push str._s_x08.tmp
mov eax, dword [ebp - 0x8c]
add eax, 0xc
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov dword [ebp - 0x74], 0
jmp 0x49af1d
mov ecx, dword [ebp - 0x74]
add ecx, 1
mov dword [ebp - 0x74], ecx
cmp dword [ebp - 0x74], 0x400
jae 0x49b097
mov edx, dword [ebp - 0x74]
push edx
push str.DOC_d
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x553688
lea ecx, [ebp - 0x60]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
jne 0x49af61
jmp 0x49b097
mov eax, dword [ebp - 0x68]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x49af82
jmp 0x49b0a3
mov edx, dword [ebp - 0x68]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x49afa3
jmp 0x49b0a3
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x49afc0
jmp 0x49b0a3
cmp dword [ebp - 0x64], 0
je 0x49afd1
mov edx, dword [ebp - 0x70]
mov dword [ebp - 0x94], edx
jmp 0x49afdd
mov eax, dword [ebp - 0x70]
add eax, dword [ebp - 0x78]
mov dword [ebp - 0x94], eax
mov ecx, dword [ebp - 0x94]
mov dword [ebp - 0x6c], ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x6c]
push ecx
call fcn.004f8140
add esp, 0xc
push 0x20
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x6c]
push ecx
call fcn.004a7200
add esp, 0x10
cmp dword [ebp - 0x64], 0
je 0x49b068
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
mov ecx, dword [edx + 0x10]
sub ecx, dword [eax + 0xc]
mov eax, ecx
cdq
mov ecx, 0x216
idiv ecx
cmp dword [ebp - 0x10], eax
jb 0x49b036
call fcn.004fb0ce
xor edx, edx
jne 0x49b036
xor eax, eax
cmp eax, dword [ebp - 0x74]
sbb ecx, ecx
neg ecx
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x6c]
push eax
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x216
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0xc]
lea ecx, [eax + ecx + 0xc]
push ecx
call fcn.00497560
add esp, 0x10
mov edx, dword [ebp - 0x78]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x78], edx
cmp dword [ebp + 0x14], 0
je 0x49b092
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
push 0
call dword [ebp + 0x14]
add esp, 0xc
movzx edx, al
test edx, edx
jne 0x49b092
jmp 0x49b0a3
jmp 0x49af14
jmp 0x49ab71
mov dword [ebp - 8], 1
cmp dword [ebp + 8], 0
je 0x49b0b9
cmp dword [ebp - 4], 0
je 0x49b0b9
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 8], 0
jne 0x49b2ab
mov dword [ebp - 0x10], 0
jmp 0x49b0d5
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
mov ecx, dword [edx + 0x10]
sub ecx, dword [eax + 0xc]
mov eax, ecx
cdq
mov ecx, 0x216
idiv ecx
cmp dword [ebp - 0x10], eax
jae 0x49b2ab
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
mov ecx, dword [edx + 0x10]
sub ecx, dword [eax + 0xc]
mov eax, ecx
cdq
mov ecx, 0x216
idiv ecx
cmp dword [ebp - 0x10], eax
jb 0x49b114
call fcn.004fb0ce
xor edx, edx
jne 0x49b114
mov eax, dword [ebp - 0x10]
imul eax, eax, 0x216
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0xc]
cmp dword [edx + eax + 4], 0
je 0x49b16c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0xc]
mov eax, dword [eax + 0x10]
sub eax, dword [ecx + 0xc]
cdq
mov ecx, 0x216
idiv ecx
cmp dword [ebp - 0x10], eax
jb 0x49b14c
call fcn.004fb0ce
xor edx, edx
jne 0x49b14c
mov eax, dword [ebp - 0x10]
imul eax, eax, 0x216
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + eax + 4]
push eax
call fcn.004f84cf
add esp, 4
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0xc]
mov eax, dword [ecx + 0x10]
sub eax, dword [edx + 0xc]
cdq
mov ecx, 0x216
idiv ecx
cmp dword [ebp - 0x10], eax
jb 0x49b18a
call fcn.004fb0ce
xor edx, edx
jne 0x49b18a
mov eax, dword [ebp - 0x10]
imul eax, eax, 0x216
mov ecx, dword [ebp + 0xc]
add eax, dword [ecx + 0xc]
mov dword [ebp - 0x90], eax
mov edx, dword [ebp - 0x90]
add edx, 0xc
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x49b1f3
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0xc]
mov eax, dword [eax + 0x10]
sub eax, dword [ecx + 0xc]
cdq
mov ecx, 0x216
idiv ecx
cmp dword [ebp - 0x10], eax
jb 0x49b1d5
call fcn.004fb0ce
xor edx, edx
jne 0x49b1d5
mov eax, dword [ebp - 0x10]
imul eax, eax, 0x216
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0xc]
lea eax, [edx + eax + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0xc]
mov eax, dword [ecx + 0x10]
sub eax, dword [edx + 0xc]
cdq
mov ecx, 0x216
idiv ecx
cmp dword [ebp - 0x10], eax
jb 0x49b211
call fcn.004fb0ce
xor edx, edx
jne 0x49b211
push 0x567128
mov eax, dword [ebp - 0x10]
imul eax, eax, 0x216
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0xc]
lea eax, [edx + eax + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0xc]
mov eax, dword [ecx + 0x10]
sub eax, dword [edx + 0xc]
cdq
mov ecx, 0x216
idiv ecx
cmp dword [ebp - 0x10], eax
jb 0x49b252
call fcn.004fb0ce
xor edx, edx
jne 0x49b252
mov eax, dword [ebp - 0x10]
imul eax, eax, 0x216
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [edx + eax + 4], 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0xc]
mov eax, dword [eax + 0x10]
sub eax, dword [ecx + 0xc]
cdq
mov ecx, 0x216
idiv ecx
cmp dword [ebp - 0x10], eax
jb 0x49b28b
call fcn.004fb0ce
xor edx, edx
jne 0x49b28b
mov eax, dword [ebp - 0x10]
imul eax, eax, 0x216
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [edx + eax + 8], 0
jmp 0x49b0cc
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.004f8124
mov esp, ebp
pop ebp
ret