Function at 0x4064ff
Capabilities:
Check if file exists
Create directory
Extract resource via kernel32 functions
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x28c
mov eax, dword [0x420004]
xor eax, esp
mov dword [esp + 0x288], eax
mov eax, dword [ebp + 8]
and dword [esp + 0xc], 0
push ebx
push esi
mov dword [esp + 0x20], eax
xor ebx, ebx
mov eax, dword [ebp + 0xc]
inc ebx
push edi
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0x10]
push 0x208
mov dword [esp + 0x20], eax
lea eax, [esp + 0x8c]
push 0
push eax
mov byte [esp + 0x1b], bl
call fcn.00407ec0
add esp, 0xc
lea eax, [esp + 0x88]
push ebx
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [esp + 0x88]
push eax
lea ecx, [esp + 0x44]
call fcn.004061ba
mov esi, str.TencentQQNTSTemp
push esi
call fcn.0040b488
pop ecx
push eax
push esi
lea ecx, [esp + 0x48]
call fcn.004062aa
push eax
lea ecx, [esp + 0x2c]
call fcn.004061e9
lea ecx, [esp + 0x40]
call fcn.0040618f
cmp dword [esp + 0x3c], 8
lea eax, [esp + 0x28]
cmovae eax, dword [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4065c3
shr eax, 4
and al, bl
jne 0x406636
lea ecx, [esp + 0x28]
call fcn.00406955
test al, al
je 0x4065d9
lea ecx, [esp + 0x28]
call fcn.0040696b
cmp dword [esp + 0x3c], 8
lea eax, [esp + 0x28]
push 0
cmovae eax, dword [esp + 0x2c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test eax, eax
je 0x406636
push 0x41db78
lea ecx, [esp + 0x44]
call fcn.004061ba
lea edx, [esp + 0x28]
lea ecx, [esp + 0x40]
call fcn.00406a46
lea ecx, [esp + 0x40]
mov bl, al
call fcn.0040618f
test bl, bl
jne 0x40662e
xor eax, eax
push eax
push eax
push 0x41dc3c
jmp 0x40675d
xor ebx, ebx
mov byte [esp + 0xf], 0
inc ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x41dc4c
push 0x6a
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x406931
push edi
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push 0
mov dword [esp + 0x18], eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
xor ecx, ecx
mov eax, dword [esp + 0x10]
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00406cd8
mov edi, eax
mov eax, dword [esp + 0x14]
pop ecx
lea ecx, [eax*2 + 2]
push ecx
push 0
push edi
call fcn.00407ec0
add esp, 0xc
push dword [esp + 0x10]
push esi
push edi
call fcn.00407940
mov esi, dword [esp + 0x1c]
lea eax, [esp + 0x34]
add esp, 0xc
mov edx, esi
cmp dword [esp + 0x3c], 8
mov ecx, edi
cmovae eax, dword [esp + 0x28]
push eax
call fcn.00405d72
pop ecx
test al, al
jne 0x40676c
cmp byte [esp + 0xf], al
je 0x406710
push 0x41db78
lea ecx, [esp + 0x5c]
call fcn.004061ba
lea edx, [esp + 0x28]
mov dword [esp + 0x18], ebx
lea ecx, [esp + 0x58]
call fcn.00406a46
test al, al
jne 0x406712
xor bl, bl
test byte [esp + 0x18], 1
je 0x406722
lea ecx, [esp + 0x58]
call fcn.0040618f
test bl, bl
je 0x406743
cmp dword [esp + 0x3c], 8
lea eax, [esp + 0x28]
mov edx, esi
mov ecx, edi
cmovae eax, dword [esp + 0x28]
push eax
call fcn.00405d72
pop ecx
test al, al
jne 0x40676c
push edi
call fcn.00406c95
pop ecx
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
push eax
push eax
push 0x41dc54
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
xor esi, esi
inc esi
jmp 0x406933
push edi
call fcn.00406c95
pop ecx
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FreeResource]
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x44]
call fcn.004061e9
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x74]
call fcn.004061e9
mov ebx, 0x41db4c
push ebx
call fcn.0040b488
pop ecx
push eax
push ebx
lea ecx, [esp + 0x48]
call fcn.004062aa
mov edi, str.HummerSetup.dll
mov esi, eax
push edi
call fcn.0040b488
pop ecx
push eax
push edi
mov ecx, esi
call fcn.004062aa
push ebx
call fcn.0040b488
pop ecx
push eax
push ebx
lea ecx, [esp + 0x78]
call fcn.004062aa
mov edi, str.arkHTTPClient.dll
mov esi, eax
push edi
call fcn.0040b488
pop ecx
push eax
push edi
mov ecx, esi
call fcn.004062aa
cmp dword [esp + 0x84], 8
lea eax, [esp + 0x70]
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmovae eax, dword [esp + 0x70]
push eax
call esi
cmp dword [esp + 0x54], 8
lea ecx, [esp + 0x40]
mov edi, eax
cmovae ecx, dword [esp + 0x40]
push ecx
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, eax
test edi, edi
je 0x406858
test esi, esi
je 0x406863
push str.tWinMain
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40685c
push 0x41dbae
push dword [ebp + 0x14]
push dword [esp + 0x24]
push dword [esp + 0x2c]
push dword [esp + 0x34]
call eax
add esp, 0x14
jmp 0x40685c
test esi, esi
je 0x406866
push esi
call ebx
test edi, edi
je 0x406866
push edi
call ebx
push 8
pop esi
cmp dword [esp + 0x54], esi
lea eax, [esp + 0x40]
lea ecx, [esp + 0x58]
cmovae eax, dword [esp + 0x40]
push eax
call fcn.004061ba
lea ecx, [esp + 0x58]
call fcn.00406955
lea ecx, [esp + 0x58]
mov bl, al
call fcn.0040618f
test bl, bl
je 0x4068c1
cmp dword [esp + 0x54], esi
lea eax, [esp + 0x40]
lea ecx, [esp + 0x58]
cmovae eax, dword [esp + 0x40]
push eax
call fcn.004061ba
lea ecx, [esp + 0x58]
call fcn.0040696b
lea ecx, [esp + 0x58]
call fcn.0040618f
cmp dword [esp + 0x84], esi
lea eax, [esp + 0x70]
lea ecx, [esp + 0x58]
cmovae eax, dword [esp + 0x70]
push eax
call fcn.004061ba
lea ecx, [esp + 0x58]
call fcn.00406955
lea ecx, [esp + 0x58]
mov bl, al
call fcn.0040618f
test bl, bl
je 0x40691f
cmp dword [esp + 0x84], esi
lea eax, [esp + 0x70]
lea ecx, [esp + 0x58]
cmovae eax, dword [esp + 0x70]
push eax
call fcn.004061ba
lea ecx, [esp + 0x58]
call fcn.0040696b
lea ecx, [esp + 0x58]
call fcn.0040618f
lea ecx, [esp + 0x70]
call fcn.0040618f
lea ecx, [esp + 0x40]
call fcn.0040618f
xor esi, esi
lea ecx, [esp + 0x28]
call fcn.0040618f
mov ecx, dword [esp + 0x294]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00406c87
mov esp, ebp
pop ebp
ret 0x10