Function at 0x401000
Capabilities:
Create directory
Create shortcut via ishelllink
Extract resource via kernel32 functions
Get common file path
Write file on windows

Disassembly:
sub esp, 0x6a0
mov eax, dword [0x40a004]
xor eax, esp
mov dword [esp + 0x69c], eax
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push 0x1fe
lea eax, [esp + 0xb2]
push ebx
push eax
mov word [esp + 0xb8], bx
call fcn.00403040
push 0x1fe
lea ecx, [esp + 0x2be]
push ebx
push ecx
mov word [esp + 0x2c4], bx
call fcn.00403040
push 0x1fe
lea edx, [esp + 0x4ca]
push ebx
push edx
mov word [esp + 0x4d0], bx
call fcn.00403040
add esp, 0x24
push 1
push 0x1a
lea eax, [esp + 0xb4]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0xc
push str._aoqi
lea ecx, [esp + 0xb4]
push 0x100
push ecx
call fcn.00401476
add esp, 0x10
push ebx
lea edx, [esp + 0xb0]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x14
push str._aoqi.ico
lea eax, [esp + 0xb4]
push 0x100
push eax
call fcn.00401476
add esp, 0x10
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0xe
mov edi, eax
push 0x66
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push edi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
xor esi, esi
lea esp, [esp]
lea ecx, [esi + 1]
movzx edx, cx
push 3
push edx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
push ebx
push edi
mov dword [esp + esi*4 + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push ebx
push edi
mov dword [esp + esi*4 + 0x64], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [esp + esi*4 + 0x28], eax
add esi, 1
cmp esi, 3
jl 0x401100
mov eax, dword [esp + 0x28]
mov dx, word [ebp]
mov ecx, dword [esp + 0x2c]
add eax, 0x36
add ecx, eax
mov dword [esp + 0x20], eax
mov word [esp + 0x68], dx
mov ax, word [ebp + 2]
mov dword [esp + 0x24], ecx
mov word [esp + 0x6a], ax
mov cx, word [ebp + 4]
mov word [esp + 0x6c], cx
mov dword [esp + 0x1c], 0x36
xor esi, esi
lea eax, [esp + 0x6f]
lea ecx, [ebp + 7]
mov edi, edi
movzx edx, byte [ecx - 1]
mov byte [eax - 1], dl
movzx edx, byte [ecx]
mov byte [eax], dl
movzx edx, byte [ecx + 1]
mov byte [eax + 1], dl
movzx edx, byte [ecx + 2]
mov byte [eax + 2], dl
movzx edx, word [ecx + 3]
mov word [eax + 3], dx
movzx edx, word [ecx + 5]
mov word [eax + 5], dx
mov edx, dword [ecx + 7]
mov dword [eax + 7], edx
mov edx, dword [esp + esi*4 + 0x1c]
mov dword [eax + 0xb], edx
add esi, 1
add ecx, 0xe
add eax, 0x10
cmp esi, 3
jl 0x401180
push 0
push 0x80
push 2
push 0
push 3
push 0x40000000
lea eax, [esp + 0xc4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
push 0
jne 0x401207
push str.error
push 0x4092c8
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x40144c
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
lea ecx, [esp + 0x1c]
push ecx
push 0x36
lea edx, [esp + 0x74]
push edx
push ebx
call ebp
xor esi, esi
mov edi, edi
mov ecx, dword [esp + esi + 0x28]
mov edx, dword [esp + esi + 0x5c]
push 0
lea eax, [esp + 0x1c]
push eax
push ecx
push edx
push ebx
call ebp
add esi, 4
cmp esi, 0xc
jl 0x401220
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x34]
push eax
mov dword [esp + 0x38], 0x28
mov dword [esp + 0x4c], 0x84
mov dword [esp + 0x40], edi
mov dword [esp + 0x3c], 0
mov dword [esp + 0x48], str.www.9aoqi.com
mov dword [esp + 0x50], 0x66
mov dword [esp + 0x44], str._fTeR
call dword [sym.imp.USER32.dll_MessageBoxIndirectW]
cmp eax, 7
je 0x401200
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 1
push 0
lea ecx, [esp + 0x2b4]
push ecx
push 0
call esi
push 1
push 2
lea edx, [esp + 0x4b4]
push edx
push 0
call esi
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jl 0x401200
mov edi, dword [sym.imp.ole32.dll_CoCreateInstance]
lea eax, [esp + 0x10]
push eax
push 0x40818c
push 1
push 0
push 0x40819c
call edi
test eax, eax
jl 0x401389
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x50]
push str.http:__aoqi.100bt.com__shortcut
push eax
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
push 0x409358
push eax
call edx
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
push 0
lea edx, [esp + 0xb0]
push edx
push eax
mov eax, dword [ecx + 0x44]
call eax
call esi
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
lea edx, [esp + 0x14]
push edx
push 0x4081ac
push eax
mov eax, dword [ecx]
call eax
test eax, eax
jl 0x40137d
push 0x12
push 0x409360
lea ecx, [esp + 0x2b4]
push 0x100
push ecx
call fcn.00401476
mov eax, dword [esp + 0x24]
mov edx, dword [eax]
mov edx, dword [edx + 0x18]
add esp, 0x10
push 1
lea ecx, [esp + 0x2b0]
push ecx
push eax
call edx
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
lea eax, [esp + 0x10]
push eax
push 0x40818c
push 1
push 0
push 0x40819c
call edi
test eax, eax
jl 0x401441
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x50]
push str.http:__aoqi.100bt.com__shortcut
push eax
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
push str.eYGY_O
push eax
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
push 0
lea edx, [esp + 0xb0]
push edx
push eax
mov eax, dword [ecx + 0x44]
call eax
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
lea edx, [esp + 0x14]
push edx
push 0x4081ac
push eax
mov eax, dword [ecx]
call eax
test eax, eax
jl 0x401435
push 0x12
push 0x409360
lea ecx, [esp + 0x4b4]
push 0x100
push ecx
call fcn.00401476
mov eax, dword [esp + 0x24]
mov edx, dword [eax]
mov edx, dword [edx + 0x18]
add esp, 0x10
push 1
lea ecx, [esp + 0x4b0]
push ecx
push eax
call edx
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, 1
mov ecx, dword [esp + 0x6ac]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00401467
add esp, 0x6a0
ret 0x10