Function at 0x401000
Capabilities:
Check if file exists
Delete file
Extract resource via kernel32 functions
Get file attributes
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x498fe9
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0xa4c
mov eax, dword [0x4b3da0]
xor eax, ebp
mov dword [ebp - 0x2c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x48]
call fcn.004027e0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x48]
push ecx
lea edx, [ebp - 0x9f4]
push edx
call fcn.0040bf10
add esp, 8
mov dword [ebp - 0xa4c], eax
mov eax, dword [ebp - 0xa4c]
mov dword [ebp - 0xa50], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0xa50]
push ecx
mov ecx, 0x4b85a8
call fcn.004014b0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x9f4]
call fcn.00401490
push 0
lea edx, [ebp - 0xa10]
push edx
call fcn.0040e490
add esp, 8
mov dword [ebp - 0xa54], eax
mov eax, dword [ebp - 0xa54]
mov dword [ebp - 0xa58], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0xa58]
push ecx
mov ecx, 0x4b858c
call fcn.004014b0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xa10]
call fcn.00401490
push str._seeyoulog.txt
push 0x4b858c
lea edx, [ebp - 0x64]
push edx
call fcn.00401a10
add esp, 0xc
mov byte [ebp - 4], 3
push 0x400
lea eax, [ebp - 0x64]
push eax
mov ecx, 0x4b8564
call fcn.0040ec50
lea ecx, [ebp - 0x64]
call fcn.00401f60
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0xffffffff
je 0x401131
mov ecx, dword [ebp - 0x68]
and ecx, 0x10
je 0x401131
lea ecx, [ebp - 0x64]
call fcn.00401f60
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x64]
call fcn.00401490
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0x401172
mov dword [ebp - 0xa14], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.00401f80
mov eax, dword [ebp - 0xa14]
jmp 0x40143c
mov edx, dword [ebp + 8]
push edx
call fcn.00419080
add esp, 4
push str.ZIPRES
push 0x66
call fcn.00419000
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x4011be
mov dword [ebp - 0xa18], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.00401f80
mov eax, dword [ebp - 0xa18]
jmp 0x40143c
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x28]
push eax
call fcn.00419000
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x40120c
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov dword [ebp - 0xa1c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.00401f80
mov eax, dword [ebp - 0xa1c]
jmp 0x40143c
mov edx, dword [ebp - 0x28]
push edx
call fcn.00419000
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x401249
mov dword [ebp - 0xa20], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.00401f80
mov eax, dword [ebp - 0xa20]
jmp 0x40143c
mov eax, dword [ebp - 0x14]
push eax
call fcn.004182b2
add esp, 4
mov dword [ebp - 0xa24], eax
mov ecx, dword [ebp - 0xa24]
mov dword [0x4b8504], ecx
cmp dword [0x4b8504], 0
je 0x40128e
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
mov ecx, dword [0x4b8504]
push ecx
call fcn.00480a90
add esp, 0xc
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_FreeResource]
push str.opZZvX9f
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [0x4b8504]
push ecx
call fcn.00419090
add esp, 0xc
push 0x1f40
call fcn.0040e9d0
add esp, 4
push str.Global_ONCE_RUN_seeyouJiasuqi_install_
lea ecx, [ebp - 0xa40]
call fcn.004027e0
lea edx, [ebp - 0xa40]
push edx
lea ecx, [ebp - 0x20]
call fcn.0040bd00
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xa40]
call fcn.00401f80
lea ecx, [ebp - 0x20]
call fcn.0040bd80
test eax, eax
je 0x40137c
push 0x4ab478
push 0x4ab484
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
je 0x40137c
push 9
mov eax, dword [ebp - 0x6c]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x6c]
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
push 3
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
mov edx, dword [ebp - 0x6c]
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov dword [ebp - 0xa44], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.0040bd50
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.00401f80
mov eax, dword [ebp - 0xa44]
jmp 0x40143c
mov byte [ebp - 4], 5
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x9d8]
call fcn.00402830
mov dword [ebp - 0xa5c], eax
mov byte [ebp - 4], 6
push 0
push 0
push 0
push 0
push 0
push 0
push 0x16000000
push 0x4ab498
push 0
lea ecx, [ebp - 0x9d8]
call fcn.00421d70
lea ecx, [ebp - 0x9d8]
call fcn.00422160
lea ecx, [ebp - 0x9d8]
call fcn.00421ee0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x9d8]
call fcn.00402990
jmp 0x401404
mov dword [ebp - 4], 4
call dword [sym.imp.ole32.dll_CoUninitialize]
mov dword [ebp - 0xa48], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.0040bd50
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.00401f80
mov eax, dword [ebp - 0xa48]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x2c]
xor ecx, ebp
call fcn.0047dd71
mov esp, ebp
pop ebp
ret 0x10