Function at 0x40cd0f
Capabilities:
Create process on windows
Extract resource via kernel32 functions
Get common file path
Get disk size
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
sub esp, 0x60
xor esi, esi
xor edi, edi
mov ecx, 0x9d
push esi
dec ecx
jne 0x40cd21
push 0
push dword [0x414eb0]
call fcn.00409454
push dword [0x414f00]
call fcn.0040889f
push eax
push dword [0x414f00]
call fcn.00408904
call fcn.00412d0b
lea ebx, [ebp - 0xb8]
call fcn.004122e1
mov edx, dword [ebp - 0xb8]
call fcn.00412cb6
mov ecx, 1
mov eax, 3
call fcn.004100fb
lea ebx, [ebp - 0xb8]
call fcn.004122e1
mov eax, dword [0x414a68]
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0
je 0x40d4df
fild dword [0x414f0c]
fistp qword [ebp - 0xa8]
push 0xffffffffffffffff
sub esp, 4
mov edx, dword [ebp - 0xb8]
call fcn.00412cb6
mov ebx, esp
call fcn.00412393
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00411f3d
pop eax
add esp, 4
call fcn.00412623
pop dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x2c]
je 0x40cec6
sub esp, 4
lea ebx, [ebp - 0x94]
push ebx
lea ebx, [ebp - 0x8c]
push ebx
lea ebx, [ebp - 0x84]
push ebx
mov edx, dword [ebp - 0xb8]
call fcn.00412cb6
mov ebx, esp
add ebx, 0xc
call fcn.00412393
call dword [sym.imp.KERNEL32.DLL_GetDiskFreeSpaceExA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00411f3d
pop eax
add esp, 4
call fcn.00412623
lea ebx, [ebp - 0x94]
mov eax, ebx
mov ebx, 8
call fcn.00411f45
mov eax, 1
call fcn.0040f2ec
fistp qword [ebp - 0xa0]
fild qword [ebp - 0xa8]
fild qword [ebp - 0xa0]
fcompp
fnstsw ax
sahf
jae 0x40cec6
mov edx, 0x4152b7
call fcn.00412cca
push 0
mov eax, 0xd
call fcn.0040f222
mov eax, 0xa
call fcn.0040f222
mov eax, 0xd
call fcn.0040f222
mov eax, 0xa
call fcn.0040f222
call fcn.0040f1bb
call fcn.00412510
mov edx, 0x415307
call fcn.00412cca
call fcn.00412510
mov eax, 0x2010
mov edx, 0x415336
call fcn.00412cca
call fcn.0040f9b5
jmp 0x40d4df
mov edx, dword [ebp - 0xb8]
call fcn.00412cb6
push dword [0x414ee8]
call fcn.00409498
call fcn.00412d0b
call fcn.00412510
mov edx, 0x41534e
call fcn.00412cca
call fcn.00412510
xor eax, eax
call fcn.0040f750
mov edx, 0x41503a
call fcn.00412cca
call fcn.00412581
je 0x40cf72
mov edx, 0x415354
call fcn.00412cca
push 0
mov eax, 0xd
call fcn.0040f222
mov eax, 0xd
call fcn.0040f222
call fcn.0040f1bb
call fcn.00412510
mov edx, 0x4153a1
call fcn.00412cca
call fcn.00412510
mov eax, 0x2024
mov edx, 0x4153c8
call fcn.00412cca
call fcn.0040f9b5
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 7
jne 0x40cf72
jmp 0x40d4df
push dword [0x414eb8]
call fcn.00408a96
push dword [0x414ec0]
call fcn.00408a96
mov edx, dword [ebp - 0xb8]
call fcn.00412cb6
push dword [0x414ee8]
call fcn.00409498
call fcn.00412d0b
call fcn.00412510
mov edx, 0x41534e
call fcn.00412cca
call fcn.00412510
call fcn.0040fe32
push 0xa
push dword [ebp - 0xcc]
push dword [ebp - 0xc0]
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
call fcn.00412623
mov dword [ebp - 0xd0], eax
push dword [ebp - 0xd0]
push dword [ebp - 0xc0]
call dword [sym.imp.KERNEL32.DLL_LoadResource]
call fcn.00412623
mov edi, eax
call fcn.00412c5f
mov word [ebp - 0xc8], ax
push 0x7f02
push dword [ebp - 0xc0]
call dword [sym.imp.USER32.DLL_LoadCursorA]
call fcn.00412623
mov edx, dword [ebp - 0xb8]
call fcn.00412cb6
push dword [0x414ee8]
call fcn.00409498
call fcn.00412d0b
call fcn.00412510
mov edx, 0x41534e
call fcn.00412cca
call fcn.00412510
xor ebx, ebx
movsx eax, word [ebp - 0xc8]
mov word [ebp - 0x32], ax
mov ecx, pe_nt_image_headers32
xor eax, eax
mov dx, 0x20c1
call fcn.0040fb1e
fild dword [0x415ecc]
fild qword [ebp - 0xa8]
call fcn.004122ad
fistp dword [ebp - 0xd8]
fldz
fild dword [0x415ecc]
fild qword [ebp - 0xa8]
call fcn.004122c4
fcompp
fnstsw ax
sahf
je 0x40d099
inc dword [ebp - 0xd8]
mov dword [ebp - 0xcc], 2
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0xe0], eax
mov esi, 1
jmp 0x40d17c
call fcn.00409004
push 0xa
push dword [ebp - 0xcc]
push dword [ebp - 0xc0]
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
call fcn.00412623
mov dword [ebp - 0xd0], eax
push dword [ebp - 0xd0]
push dword [ebp - 0xc0]
call dword [sym.imp.KERNEL32.DLL_LoadResource]
call fcn.00412623
mov edi, eax
inc dword [ebp - 0xcc]
mov eax, edi
push eax
push dword [ebp - 0xd0]
push dword [ebp - 0xc0]
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
call fcn.00412623
pop dword [ebp - 0x2c]
mov ebx, eax
mov eax, dword [ebp - 0x2c]
call fcn.00411f45
lea ebx, [ebp - 0xbc]
call fcn.004122e1
movsx eax, word [ebp - 0xc8]
mov word [ebp - 0x32], ax
mov edx, dword [ebp - 0xbc]
call fcn.00412cb6
call fcn.00411a92
fild dword [ebp - 0xd8]
mov dword [ebp - 0x58], esi
fild dword [ebp - 0x58]
fimul word [0x415e5c]
fdivrp st(1)
call fcn.00411fbf
fistp dword [ebp - 0xe4]
push dword [ebp - 0xe4]
push dword [0x414eb0]
call fcn.00409454
inc esi
mov eax, esi
cmp eax, dword [ebp - 0xe0]
jle 0x40d0ba
push 0x64
push dword [0x414eb0]
call fcn.00409454
xor ecx, ecx
movsx eax, word [ebp - 0xc8]
call fcn.00411fd6
push 0xa
push dword [ebp - 0xcc]
push dword [ebp - 0xc0]
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
call fcn.00412623
mov dword [ebp - 0xd0], eax
push dword [0x414eb8]
call fcn.00408ade
push dword [0x414ec0]
call fcn.00408ade
push 0
push dword [ebp - 0xd0]
push dword [ebp - 0xc0]
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
call fcn.00412623
pop dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x2c]
jle 0x40d4bc
mov edx, 0x4153d3
call fcn.00412cca
push 0
mov eax, 0xd
call fcn.0040f222
mov eax, 0xd
call fcn.0040f222
call fcn.0040f1bb
call fcn.00412510
mov edx, 0x415403
call fcn.00412cca
call fcn.00412510
mov eax, 0x2004
mov edx, 0x415444
call fcn.00412cca
call fcn.0040f9b5
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 7
jne 0x40d260
jmp 0x40d4df
lea ebx, [ebp - 0x2d8]
push ebx
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
call fcn.00412623
mov dword [ebp - 0x2dc], eax
push dword [ebp - 0xd0]
push dword [ebp - 0xc0]
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
call fcn.00412623
call fcn.0041191b
fistp qword [ebp - 0xa8]
push dword [ebp - 0xd0]
push dword [ebp - 0xc0]
call dword [sym.imp.KERNEL32.DLL_LoadResource]
call fcn.00412623
mov edi, eax
lea ebx, [ebp - 0x2d8]
call fcn.00412b60
mov ecx, 1
mov eax, dword [ebp - 0x2dc]
call fcn.004100fb
mov edx, 0x41545b
call fcn.00412cca
call fcn.00412510
lea ebx, [ebp - 0xc4]
call fcn.004122e1
mov edx, dword [ebp - 0xc4]
call fcn.00412cb6
call fcn.0040fe32
mov edx, dword [ebp - 0xc4]
call fcn.00412cb6
xor ebx, ebx
mov word [ebp - 0x32], 2
mov ecx, pe_nt_image_headers32
mov eax, 1
mov dx, 0x20c4
call fcn.0040fb1e
mov word [ebp - 0x32], 2
mov eax, edi
fild qword [ebp - 0xa8]
fistp qword [ebp - 0x58]
mov ebx, dword [ebp - 0x58]
call fcn.00411f45
call fcn.00411a92
xor ecx, ecx
mov eax, 2
call fcn.00411fd6
sub esp, 0x10
push 5
mov edx, 0x41503a
call fcn.00412cca
mov ebx, esp
add ebx, 0x10
call fcn.00412393
mov edx, 0x41503a
call fcn.00412cca
mov ebx, esp
add ebx, 0x10
call fcn.00412393
mov edx, dword [ebp - 0xc4]
call fcn.00412cb6
mov ebx, esp
add ebx, 0x10
call fcn.00412393
mov edx, 0x41546c
call fcn.00412cca
mov ebx, esp
add ebx, 0x10
call fcn.00412393
push dword [ebp - 0xc0]
call dword [sym.imp.SHELL32.DLL_ShellExecuteA]
push eax
mov ebx, esp
mov eax, dword [ebx + 0x10]
call fcn.00411f3d
mov ebx, esp
mov eax, dword [ebx + 0xc]
call fcn.00411f3d
mov ebx, esp
mov eax, dword [ebx + 8]
call fcn.00411f3d
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00411f3d
pop eax
add esp, 0x10
call fcn.00412623
mov dword [ebp - 0x2e0], eax
fild dword [ebp - 0x2e0]
fstp xword [ebp - 0x3c]
fild word [0x4155cc]
fld xword [ebp - 0x3c]
fcompp
fnstsw ax
sahf
jne 0x40d456
mov edx, 0x415472
call fcn.00412cca
push 0
mov eax, 0xd
call fcn.0040f222
mov eax, 0xd
call fcn.0040f222
call fcn.0040f1bb
call fcn.00412510
mov edx, 0x415485
call fcn.00412cca
call fcn.00412510
mov eax, 0x2000
mov edx, 0x415444
call fcn.00412cca
call fcn.0040f9b5
jmp 0x40d4b7
fild word [0x415624]
fld xword [ebp - 0x3c]
fcompp
fnstsw ax
sahf
jne 0x40d4b7
mov edx, 0x415472
call fcn.00412cca
push 0
mov eax, 0xd
call fcn.0040f222
mov eax, 0xd
call fcn.0040f222
call fcn.0040f1bb
call fcn.00412510
mov edx, 0x4154a6
call fcn.00412cca
call fcn.00412510
mov eax, 0x2000
mov edx, 0x415444
call fcn.00412cca
call fcn.0040f9b5
jmp 0x40d4da
mov edx, 0x4153d3
call fcn.00412cca
mov eax, 0x2000
mov edx, 0x415444
call fcn.00412cca
call fcn.0040f9b5
call fcn.00409004
mov ebx, fcn.0040cd0f
call fcn.00412bf6
mov eax, dword [ebp - 0x7c]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10