Function at 0x49aa7a
Capabilities:
Check if file exists
Delete file
Extract resource via kernel32 functions
Move file

Disassembly:
jne 0x49a67a
sub ecx, edx
sar ecx, 1
je 0x49a1dd
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x49a1dd
push 0x409
push 0x65
push 0
je 0x49a8d3
jne 0x49a8d3
cmp eax, 0x3e070082
cmp eax, dword [ecx*8 + 0x10030cf0]
cmp dword [ebp - 0x1ac0], esi
mov dword [0xd4b220], eax
mov dword [0xdef480], ebx
push 0xb051fc
movd mm4, eax
mov dword [ebp - 0x83c], ebx
xor bl, byte [ecx]
std
int1
xchg esi, eax
mov bl, 0x50
int3
pop ebp
ret
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
je 0x49a998
jne 0x49a998
cmp ecx, 0x5c
fld dword [0xad60d0]
movzx ecx, byte [edi + 0x436154]
mov al, byte [edi + eax + 1]
call dword [0xa7e580]
mov dword [0x1153f524], eax
mov dword [ebp - 0xf8], 0
mov byte [0xd052c4], bl
cmp dword [0xddea38], 0
mov ecx, dword [0x52e4dc]
mov dword [ebp - 0xfc], 0x9ffd2c
and byte [eax + eax + 0x942080], dl
push 0xcb76ec
mov ebx, dword [ebx + 0x26]
invalid
push edi
mov eax, dword [0x5b90d8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
jmp 0x49a0c1
pop ecx
pop edi
je 0x49b061
jne 0x49b061
push 0x697dab58
add esi, 1
cmp dword [ebp - 0x70], 0x3fffc0
push reloc.comctl32.dll_CreateMappedBitmap
mov eax, 0x4ce3f8
inc edi
add byte [eax + 0x4ce3f8], bh
mov eax, 0x10d982e0
push 0x10180282
mov dword [0x11558924], eax
push 0x11481588
mov eax, 0x115478d4
mov eax, 0xfd6264
fmul qword [0x9c4ad8]
push 0x697c64dc
pushal
pop edi
jl 0x499f1a
adc dl, byte [eax]
pop eax
test al, 0x6f
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
test ebx, ebx
je 0x49ab7a
jne 0x49ab7a
and dword [ebp - 0x1c], 0xfffffffd
mov dword [0x40737c], edi
mov ebx, dword [ebp - 0x42c]
mov dword [esi + 0x10], 0x1114b7f0
cmp dword [eax + 0xb8], 0
jmp dword [eax*4 + 0x529e28]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 8]
mov dword [ebp - 0x1c], 0
jmp 0x49a65f
xor eax, eax
mov ecx, dword [ebp - 0xc]
jmp 0x49a5f5
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x49a1dd
push 0x49a36f
ret
mov dword fs:[0], ecx
je 0x499efa
clc
clc
invalid
jne 0x499efa
push 0x100e1480
push 0x11297ae0
mov edi, dword [ebx + 0x30]
push 0xd2b1dc
push 0x114b25e8
mov dword [ecx + eax*4], 0xffffffff
push 0xacca7c
push 0x10079ce0
push 0x7ceb50
push 0x485fb8
imul ebx, dword [ebp - 0x627fff90], 0x70
lea edx, [ebp - 0x444]
push 0x11472c84
inc ebp
mov eax, dword [0xed29d307]
jl 0x49a5fe
aas
adc dword [0x14a8c60e], edx
or esp, dword [edi]
rcr dword [ecx - 0x39], 0x45
cld
add byte [eax], al
add byte [eax], al
mov dword [ebp - 4], 0
test edi, edi
je 0x49a1dd
mov ecx, edi
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
je 0x499c1c
jne 0x499c1c
push 0x114824a0
mov edx, dword [ebx + 0x63]
cmp cl, byte [edi + 0x6979cd70]
mov eax, dword [0x1153f31c]
push 0x44bc64
lea eax, [edi + 0x60c]
lea eax, [ebp + 0xc]
mov esi, 0x9de268
test byte [ebx + 0x61], bh
add dword [ecx], ebx
pop ss
mov edi, 0x868c58d
cmp al, 0x56
sbb byte [0x5b5e5f2d], cl
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push reloc.wtsapi32.dll_WTSVirtualChannelClose
ret
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
jmp 0x49acb8
push ebx
push esi
je 0x499e76
jne 0x499e76
push 0x984490
push 0xa72f08
lea esi, [ebp - 0x84]
push 0xa322d0
mov eax, 0x697d68c4
mov al, 0x8f
scasd eax, dword es:[edi]
test dword [0xd4e81d1a], edx
test dh, bh
inc dword [ebp + 0x3b840fc0]
idiv bh
invalid
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aed18
jmp 0x499dcb
je 0x49a1dd
jmp 0x49aefe
test esi, esi
je 0x49a6cc
je 0x499f53
jne 0x499f53
mov dword [ecx], 0x439ab8
push 0xafb000
mov dword [ebp - 0x1a0], esi
movzx dx, byte [ebp - 0xd]
push 0x100b4ccc
mov eax, dword [edi + 0xf4]
cmp dword [0xd0c38c], 0
push 0xa0a6bc
mov dword [esi], 0x697dd55c
push 0x102a9c70
push 0x424378
push dword [esi*8 + 0x47bba0]
push 0x46e
mov al, byte [ebp - 0x59]
cmp edi, 5
add edx, dword [ecx - 4]
invalid
push esi
push 0
jmp 0x49a528
pop esi
pop ebx
mov esp, ebp
je 0x499d96
jne 0x499d96
push 0x9ff3d4
push 0xa93f38
add dword [0x699d3670], 1
push 0x1020e1a8
push 0xa15de4
mov eax, 0xa95658
add dword [edi + 8], 1
push 0xa97844
jmp dword [0x100171d0]