Function at 0x40789b
Capabilities:
Check if file exists
Create directory
Extract resource via kernel32 functions
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x28c
mov eax, dword [0x422004]
xor eax, esp
mov dword [esp + 0x288], eax
mov eax, dword [ebp + 8]
and dword [esp + 0xc], 0
push ebx
push esi
mov dword [esp + 0x20], eax
xor ebx, ebx
mov eax, dword [ebp + 0xc]
inc ebx
push edi
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0x10]
push 0x208
mov dword [esp + 0x20], eax
lea eax, [esp + 0x8c]
push 0
push eax
mov byte [esp + 0x1b], bl
call fcn.00409600
add esp, 0xc
lea eax, [esp + 0x88]
push ebx
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [esp + 0x88]
push eax
lea ecx, [esp + 0x44]
call fcn.004074fa
mov esi, str.TencentQQSTemp
push esi
call fcn.0040e082
pop ecx
push eax
push esi
lea ecx, [esp + 0x48]
call fcn.00407629
push eax
lea ecx, [esp + 0x2c]
call fcn.0040752b
lea ecx, [esp + 0x40]
call fcn.004075b0
cmp dword [esp + 0x3c], 8
lea eax, [esp + 0x28]
cmovae eax, dword [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40795f
shr eax, 4
and al, bl
jmp 0x407961
xor al, al
test al, al
jne 0x4079d8
lea ecx, [esp + 0x28]
call fcn.00407d1f
test al, al
je 0x40797b
lea ecx, [esp + 0x28]
call fcn.00407d35
cmp dword [esp + 0x3c], 8
lea eax, [esp + 0x28]
push 0
cmovae eax, dword [esp + 0x2c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test eax, eax
je 0x4079d8
push 0x4206d8
lea ecx, [esp + 0x44]
call fcn.004074fa
lea edx, [esp + 0x28]
lea ecx, [esp + 0x40]
call fcn.00407e10
lea ecx, [esp + 0x40]
mov bl, al
call fcn.004075b0
test bl, bl
jne 0x4079d0
xor eax, eax
push eax
push eax
push 0x420778
jmp 0x407b08
xor ebx, ebx
mov byte [esp + 0xf], 0
inc ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x420788
push 0x6a
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x407cfb
push edi
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push 0
mov dword [esp + 0x18], eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
xor ecx, ecx
mov eax, dword [esp + 0x10]
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0040832f
mov edi, eax
mov eax, dword [esp + 0x14]
pop ecx
lea ecx, [eax*2 + 2]
push ecx
push 0
push edi
call fcn.00409600
add esp, 0xc
push dword [esp + 0x10]
push esi
push edi
call fcn.00409080
mov esi, dword [esp + 0x1c]
lea eax, [esp + 0x34]
add esp, 0xc
mov edx, esi
cmp dword [esp + 0x3c], 8
mov ecx, edi
cmovae eax, dword [esp + 0x28]
push eax
call fcn.004070d5
pop ecx
test al, al
jne 0x407b17
cmp byte [esp + 0xf], al
je 0x407aba
push 0x4206d8
lea ecx, [esp + 0x74]
call fcn.004074fa
lea edx, [esp + 0x28]
mov dword [esp + 0x18], ebx
lea ecx, [esp + 0x70]
call fcn.00407e10
test al, al
je 0x407aba
mov byte [esp + 0xf], bl
mov eax, ebx
jmp 0x407ac0
mov eax, dword [esp + 0x18]
xor bl, bl
test al, 1
je 0x407acd
lea ecx, [esp + 0x70]
call fcn.004075b0
test bl, bl
je 0x407aee
cmp dword [esp + 0x3c], 8
lea eax, [esp + 0x28]
mov edx, esi
mov ecx, edi
cmovae eax, dword [esp + 0x28]
push eax
call fcn.004070d5
pop ecx
test al, al
jne 0x407b17
push edi
call fcn.004082ec
pop ecx
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
push eax
push eax
push 0x420790
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
xor esi, esi
inc esi
jmp 0x407cfd
push edi
call fcn.004082ec
pop ecx
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FreeResource]
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x5c]
call fcn.0040752b
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x44]
call fcn.0040752b
mov ebx, 0x42069c
push ebx
call fcn.0040e082
pop ecx
push eax
push ebx
lea ecx, [esp + 0x60]
call fcn.00407629
mov edi, 0x420704
mov esi, eax
push edi
call fcn.0040e082
pop ecx
push eax
push edi
mov ecx, esi
call fcn.00407629
push ebx
call fcn.0040e082
pop ecx
push eax
push ebx
lea ecx, [esp + 0x48]
call fcn.00407629
mov edi, str.arkHTTPClient.dll
mov esi, eax
push edi
call fcn.0040e082
pop ecx
push eax
push edi
mov ecx, esi
call fcn.00407629
cmp dword [esp + 0x6c], 8
lea ecx, [esp + 0x58]
cmovae ecx, dword [esp + 0x58]
call fcn.004080b2
test eax, eax
je 0x407c25
cmp dword [esp + 0x54], 8
lea eax, [esp + 0x40]
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmovae eax, dword [esp + 0x40]
push eax
call esi
cmp dword [esp + 0x6c], 8
lea ecx, [esp + 0x58]
mov edi, eax
cmovae ecx, dword [esp + 0x58]
push ecx
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, eax
test edi, edi
je 0x407c15
test esi, esi
je 0x407c1c
push str.tWinMain
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x407c15
push 0x40788a
push dword [ebp + 0x14]
push dword [esp + 0x24]
push dword [esp + 0x2c]
push dword [esp + 0x34]
call eax
add esp, 0x14
test esi, esi
je 0x407c1c
push esi
call ebx
test edi, edi
je 0x407c35
push edi
call ebx
jmp 0x407c35
xor eax, eax
push eax
push eax
push str._rT9SM
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp dword [esp + 0x6c], 8
lea eax, [esp + 0x58]
lea ecx, [esp + 0x70]
cmovae eax, dword [esp + 0x58]
push eax
call fcn.004074fa
lea ecx, [esp + 0x70]
call fcn.00407d1f
lea ecx, [esp + 0x70]
mov bl, al
call fcn.004075b0
test bl, bl
je 0x407c8f
cmp dword [esp + 0x6c], 8
lea eax, [esp + 0x58]
lea ecx, [esp + 0x70]
cmovae eax, dword [esp + 0x58]
push eax
call fcn.004074fa
lea ecx, [esp + 0x70]
call fcn.00407d35
lea ecx, [esp + 0x70]
call fcn.004075b0
cmp dword [esp + 0x54], 8
lea eax, [esp + 0x40]
lea ecx, [esp + 0x70]
cmovae eax, dword [esp + 0x40]
push eax
call fcn.004074fa
lea ecx, [esp + 0x70]
call fcn.00407d1f
lea ecx, [esp + 0x70]
mov bl, al
call fcn.004075b0
test bl, bl
je 0x407ce9
cmp dword [esp + 0x54], 8
lea eax, [esp + 0x40]
lea ecx, [esp + 0x70]
cmovae eax, dword [esp + 0x40]
push eax
call fcn.004074fa
lea ecx, [esp + 0x70]
call fcn.00407d35
lea ecx, [esp + 0x70]
call fcn.004075b0
lea ecx, [esp + 0x40]
call fcn.004075b0
lea ecx, [esp + 0x58]
call fcn.004075b0
xor esi, esi
lea ecx, [esp + 0x28]
call fcn.004075b0
mov ecx, dword [esp + 0x294]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004082db
mov esp, ebp
pop ebp
ret 0x10