Function at 0x401a80
Capabilities:
Extract resource via kernel32 functions
Get common file path
Hide graphical window
Persist via application shimming
Write file on windows

Disassembly:
sub esp, 0x318
push ebx
push ebp
push esi
push edi
push 0x401850
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x121]
mov byte [esp + 0x120], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x120]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x120]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
mov esi, 0x45b710
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x1d]
mov byte [esp + 0x1c], 0
rep stosd dword es:[edi], eax
mov edx, dword [esi]
lea ecx, [esp + 0x1c]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x120]
push edx
push eax
push 0x465350
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
lea edx, [esp + 0x2c]
push edx
call fcn.0040d070
add esp, 0x14
test eax, eax
jne 0x401dac
add esi, 4
cmp esi, 0x45b7b8
jl 0x401ad8
push eax
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jl 0x401def
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
mov esi, dword [esp + 0x32c]
push esi
call fcn.004279b0
push 0x4653ac
push 0x67
push esi
call fcn.004019d0
mov ebp, eax
add esp, 0x10
test ebp, ebp
jbe 0x401ddb
push ebp
call dword [sym.imp.MSVCRT.dll_malloc]
mov ecx, ebp
mov ebx, eax
mov edx, ecx
xor eax, eax
mov edi, ebx
push ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push ebx
and ecx, 3
push 0x4653b4
push 0x67
push esi
rep stosb byte es:[edi], al
mov dword [esp + 0x28], ebx
call fcn.00401a20
push ebp
push ebx
call fcn.004279d0
add esp, 0x20
push 0x4653f8
push 0x6a
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebp, eax
test ebp, ebp
je 0x401dcd
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x401dcd
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
mov dword [esp + 0x14], eax
je 0x401dcd
mov ecx, 0x41
xor eax, eax
mov edi, 0x46af9c
mov byte [esp + 0x224], al
rep stosd dword es:[edi], eax
mov ecx, 0x40
lea edi, [esp + 0x225]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x224]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [esp + 0x224]
push ecx
push str._sGWVPNDoctorHelp.mht
push 0x46af9c
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push 0x46af9c
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push ebp
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea edx, [esp + 0x18]
push 0
push edx
push eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x24], 0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x401cb2
mov ecx, 0x3f
lea edi, [esp + 0x1d]
mov byte [esp + 0x1c], al
push 0x46af9c
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x20]
push 0x465414
push ecx
stosb byte es:[edi], al
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea edx, [esp + 0x1c]
push 0
push 0x465448
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call dword [sym.imp.KERNEL32.dll_FreeResource]
or ebx, 0xffffffff
mov eax, dword [esp + 0x334]
test eax, eax
je 0x401cf0
call dword [sym.imp.MSVCRT.dll___p___argc]
cmp dword [eax], 2
jne 0x401cf0
call dword [sym.imp.MSVCRT.dll___p___argv]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.MSVCRT.dll_atoi]
add esp, 4
mov ebx, eax
push 0x6a4
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
add esp, 4
test edi, edi
je 0x401def
mov ecx, edi
call fcn.00426c80
lea ecx, [edi + 0x14]
mov dword [edi + 0x10], 0x45b7d0
call fcn.004273b0
push 0
push 0x1f4
push 0x320
push 0
push 0
push 0
push 0x96c80080
push 0x465490
mov dword [edi], 0x45b7bc
mov dword [edi + 0x10], 0x45b7b8
push 0
mov ecx, edi
mov dword [edi + 0x28c], ebx
call fcn.00426ce0
push 0x65
push esi
call dword [sym.imp.USER32.dll_LoadIconA]
push eax
push 1
push 0x170
mov ecx, edi
call fcn.00439e90
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push 5
mov ecx, edi
call fcn.00439e90
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.004298a0
call dword [sym.imp.ole32.dll_CoUninitialize]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x318
ret 0x10
lea eax, [esp + 0x1c]
push eax
push 0x465358
call dword [sym.imp.MSVCRT.dll_printf]
add esp, 8
push 0
push 0x465374
push 0x46537c
jmp 0x401de7
push 0
push 0x465450
push str.GWVPNDoctor.exe_Load_GWVPNDoctorHelp.mht_in_rc_failed
jmp 0x401de7
push 0
push 0x4653bc
push str.GWVPNDoctor.exe_Load_Skin_fail_zip_in_rc_size_is_0
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x318
ret 0x10