Function at 0x40153c
Capabilities:
Check if file exists
Create process on windows
Delete file
Extract resource via kernel32 functions
Get common file path
Get file attributes
Get program files directory
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2844
call fcn.00404d40
mov eax, dword [0x40e3fc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea ecx, [ebp - 0x2741]
push ecx
xor ebx, ebx
push eax
mov dword [0x40ef40], esi
mov byte [ebp - 0x2741], bl
call section..text
pop ecx
pop ecx
push ebx
push 0x26
lea eax, [ebp - 0x108]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x108]
push eax
call fcn.00404820
pop ecx
lea ecx, [ebp - 0x108]
cmp byte [eax + ecx - 1], 0x5c
je 0x4015b3
mov eax, ecx
push 0x40a1e0
push eax
call fcn.004048e0
pop ecx
pop ecx
lea eax, [ebp - 0x108]
push str.Gepro_
push eax
call fcn.004048e0
lea eax, [ebp - 0x108]
push eax
call fcn.004013d9
lea eax, [ebp - 0x108]
push str.kokundo.exe
push eax
call fcn.004048e0
add esp, 0x14
mov dword [ebp - 0x2750], ebx
cmp byte [ebp - 0x2741], bl
jne 0x401611
push ebx
push 0x4012a7
push ebx
push 0x64
push esi
call dword [sym.imp.USER32.dll_CreateDialogParamA]
push 5
push eax
mov dword [ebp - 0x2750], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [ebp - 0x2764], 1
mov dword [ebp - 0x2758], ebx
mov dword [ebp - 0x2754], ebx
cmp dword [ebp - 0x2750], ebx
je 0x401647
push dword [ebp - 0x2754]
push ebx
push 0x705
push dword [ebp - 0x2750]
call dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x401863
push 0xa
push 2
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
cmp esi, ebx
je 0x401863
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x274c], eax
cmp eax, ebx
je 0x401863
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 0x274c]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
cmp esi, ebx
je 0x401863
cmp edi, ebx
jbe 0x401863
mov eax, dword [esi]
mov dword [ebp - 0x275c], eax
cmp eax, ebx
je 0x401863
push ebx
push 0x20
push 1
push ebx
push 1
push 0x40000000
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x2748], eax
cmp eax, 0xffffffff
je 0x401863
lea eax, [ebp - 0x2740]
push 0x38
mov dword [ebp - 0x27e4], eax
mov dword [ebp - 0x27ec], edi
lea eax, [ebp - 0x27f0]
push 0x40a218
add esi, 4
mov edi, 0x1000
push eax
mov dword [ebp - 0x27f0], esi
mov dword [ebp - 0x27d0], ebx
mov dword [ebp - 0x27cc], ebx
mov dword [ebp - 0x27c8], ebx
mov dword [ebp - 0x27e0], edi
call fcn.00401f70
add esp, 0xc
test eax, eax
je 0x401759
push dword [ebp - 0x2748]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x401863
lea eax, [ebp - 0x27f0]
push 4
push eax
call fcn.00401f90
mov esi, edi
sub esi, dword [ebp - 0x27e0]
pop ecx
mov dword [ebp - 0x274c], eax
pop ecx
je 0x4017ff
push ebx
lea eax, [ebp - 0x277c]
push eax
push esi
lea eax, [ebp - 0x2740]
push eax
push dword [ebp - 0x2748]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x401ae2
cmp dword [ebp - 0x277c], esi
jne 0x401ae2
mov eax, dword [ebp - 0x27dc]
imul eax, eax, 0x1e
xor edx, edx
div dword [ebp - 0x275c]
mov dword [ebp - 0x2754], eax
cmp eax, dword [ebp - 0x2758]
je 0x4017ed
cmp dword [ebp - 0x2750], ebx
je 0x4017ed
push eax
push ebx
push 0x705
push dword [ebp - 0x2750]
mov dword [ebp - 0x2758], eax
call dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [ebp - 0x2740]
mov dword [ebp - 0x27e4], eax
mov dword [ebp - 0x27e0], edi
cmp dword [ebp - 0x274c], 1
je 0x401841
cmp dword [ebp - 0x274c], ebx
je 0x401759
cmp dword [ebp - 0x274c], 0xfffffffb
je 0x401759
push dword [ebp - 0x2748]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
or dword [ebp - 0x2748], 0xffffffff
lea eax, [ebp - 0x27f0]
push eax
call fcn.00401db0
cmp dword [ebp - 0x2748], 0xffffffff
pop ecx
je 0x401863
push dword [ebp - 0x2748]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x44
pop esi
push esi
lea eax, [ebp - 0x2844]
push ebx
push eax
call fcn.00404cc0
add esp, 0xc
xor eax, eax
mov word [ebp - 0x2814], ax
lea eax, [ebp - 0x2778]
push eax
lea eax, [ebp - 0x2844]
push eax
push ebx
push ebx
push 0x20
push ebx
push ebx
push ebx
lea eax, [ebp - 0x108]
push eax
push ebx
mov dword [ebp - 0x2844], esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x401923
push 0x2710
push dword [ebp - 0x2778]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4018d5
push ebx
push dword [ebp - 0x2778]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
inc esi
lea eax, [ebp - 0x2768]
push eax
push dword [ebp - 0x2778]
mov dword [ebp - 0x2768], ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [ebp - 0x2768], 0x3e9
jb 0x401906
cmp dword [ebp - 0x2768], 0x44c
jbe 0x401909
xor esi, esi
inc esi
push dword [ebp - 0x2778]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x2774]
call edi
cmp esi, ebx
je 0x401948
cmp dword [ebp - 0x2764], 2
jge 0x401d94
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
inc dword [ebp - 0x2764]
jmp 0x401627
push 0x104
lea eax, [ebp - 0x53c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push ebx
push ebx
lea eax, [ebp - 0x740]
push eax
lea eax, [ebp - 0x2760]
push eax
lea eax, [ebp - 0x53c]
push eax
call fcn.00404c70
push ebx
push ebx
lea eax, [ebp - 0x740]
push eax
lea eax, [ebp - 0x2760]
push eax
lea eax, [ebp - 0x53c]
push eax
call fcn.004049c8
add esp, 0x28
push 0xa
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
cmp esi, ebx
jne 0x4019ae
push 2
jmp 0x401d96
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
cmp edi, ebx
je 0x4019a7
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov dword [ebp - 0x2754], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp eax, ebx
je 0x4019a7
cmp dword [ebp - 0x2754], ebx
jbe 0x4019a7
mov ecx, dword [eax]
add eax, 4
mov dword [ebp - 0x2748], ecx
mov dword [ebp - 0x275c], eax
cmp ecx, ebx
je 0x4019a7
lea eax, [ebp - 0x640]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x22c]
push eax
push ebx
push 0x40a214
lea eax, [ebp - 0x640]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov esi, 0x80
test eax, eax
je 0x401a74
push ebx
push esi
push 2
push ebx
push 1
push 0x40000000
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x401a74
push ebx
push ebx
push dword [ebp - 0x2748]
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
cmp eax, dword [ebp - 0x2748]
jne 0x401a6e
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x401af6
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x104
lea eax, [ebp - 0x640]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x22c]
push eax
push ebx
push 0x40a214
lea eax, [ebp - 0x640]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x401ae2
push ebx
push esi
push 2
push ebx
push 1
push 0x40000000
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x401ae2
push ebx
push ebx
push dword [ebp - 0x2748]
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
cmp eax, dword [ebp - 0x2748]
je 0x401ae9
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
jmp 0x401d96
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x401af6
push edi
jmp 0x401adc
push ebx
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebp - 0x275c]
mov dword [ebp - 0x27b8], eax
mov eax, dword [ebp - 0x2754]
mov dword [ebp - 0x27b4], eax
lea eax, [ebp - 0x1740]
push 0x38
mov dword [ebp - 0x27ac], eax
lea eax, [ebp - 0x27b8]
push 0x40a218
push eax
mov dword [ebp - 0x2798], ebx
mov dword [ebp - 0x2794], ebx
mov dword [ebp - 0x2790], ebx
mov dword [ebp - 0x27a8], 0x1000
call fcn.00401f70
add esp, 0xc
push 4
test eax, eax
jne 0x401d96
lea eax, [ebp - 0x27b8]
push eax
call fcn.00401f90
mov esi, 0x1000
sub esi, dword [ebp - 0x27a8]
pop ecx
mov dword [ebp - 0x274c], eax
pop ecx
je 0x401bf7
push ebx
lea eax, [ebp - 0x2780]
push eax
push esi
lea eax, [ebp - 0x1740]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x401ae2
cmp dword [ebp - 0x2780], esi
jne 0x401ae2
mov eax, dword [ebp - 0x27a4]
imul eax, eax, 0x46
xor edx, edx
div dword [ebp - 0x2748]
add eax, 0x1e
cmp eax, dword [ebp - 0x2758]
je 0x401be1
push eax
push ebx
push 0x705
push dword [ebp - 0x2750]
mov dword [ebp - 0x2758], eax
call dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [ebp - 0x1740]
mov dword [ebp - 0x27ac], eax
mov dword [ebp - 0x27a8], 0x1000
cmp dword [ebp - 0x274c], 1
je 0x401c1c
cmp dword [ebp - 0x274c], ebx
je 0x401c15
cmp dword [ebp - 0x274c], 0xfffffffb
jne 0x401d90
push 4
jmp 0x401b60
lea eax, [ebp - 0x27b8]
push eax
call fcn.00401db0
pop ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push 5
pop eax
push str..exe
mov word [ebp - 0x2814], ax
push str.KokSetup
lea eax, [ebp - 0x740]
push eax
lea eax, [ebp - 0x2760]
push eax
lea eax, [ebp - 0x437]
push eax
mov dword [ebp - 0x2844], 0x44
mov byte [ebp - 0x438], 0x22
call fcn.004049c8
lea eax, [ebp - 0x438]
push 0x40a1fc
push eax
call fcn.004048e0
add esp, 0x1c
cmp byte [ebp - 0x2741], bl
je 0x401ca0
lea eax, [ebp - 0x438]
push 0x40a1f8
push eax
call fcn.004048e0
pop ecx
pop ecx
lea eax, [ebp - 0x53c]
push eax
lea eax, [ebp - 0x438]
push eax
call fcn.004048e0
pop ecx
pop ecx
mov esi, dword [sym.imp.KERNEL32.dll_CreateProcessA]
lea eax, [ebp - 0x2778]
push eax
lea eax, [ebp - 0x2844]
push eax
push ebx
push ebx
push 0x20
push ebx
push ebx
push ebx
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x22c]
push eax
call esi
test eax, eax
jne 0x401ceb
push 3
jmp 0x401d96
xor eax, eax
mov word [ebp - 0x2814], ax
lea eax, [ebp - 0x22c]
push eax
push 0x40a1f4
push 0xa
lea eax, [ebp - 0x128]
push eax
push dword [ebp - 0x2770]
call fcn.00409a0b
add esp, 0xc
push eax
lea eax, [ebp - 0x438]
push str.KokUndo.exe__p
push eax
call fcn.004048d0
pop ecx
pop ecx
push eax
call fcn.004048e0
pop ecx
pop ecx
push eax
call fcn.004048e0
pop ecx
pop ecx
push eax
call fcn.004048e0
pop ecx
pop ecx
lea eax, [ebp - 0x2800]
push eax
lea eax, [ebp - 0x2844]
push eax
push ebx
push ebx
push 0x20
push ebx
push ebx
push ebx
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x108]
push eax
call esi
test eax, eax
je 0x401d7c
push dword [ebp - 0x2800]
call edi
push dword [ebp - 0x27fc]
call edi
push dword [ebp - 0x2778]
call edi
push dword [ebp - 0x2774]
call edi
xor eax, eax
jmp 0x401d9c
push 4
jmp 0x401d96
push 5
call fcn.0040102e
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404810
leave
ret 0x10