Function at 0x41d1fa
Capabilities:
Check if file exists
Create process on windows
Delete file
Move file
Write and execute a file
Write file on windows

Disassembly:
push ebp
je 0x41cf84
jne 0x41cf84
cmp eax, 0x5f7
push 0x1149e35c
movzx eax, byte [eax + 0x73718c]
mov byte [0xcc0075f6], al
sub ebx, dword [edi + 0x18]
mov word [ebp + 0x70], cs
test byte [esi + 0x6a], dl
add bh, bh
adc eax, sym.imp.KERNEL32.dll_SizeofResource
mov ebx, eax
test ebx, ebx
je 0x41d08a
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jmp 0x41d1e7
pop ebx
mov esp, ebp
pop ebp
je 0x41d079
jne 0x41d079
mov eax, 0x1019e514
mov dword [0x699b1d4c], eax
push 0x1001866c
mov ebx, 0x64c982e6
mov dword [0], ecx
pop ecx
pop edi
push 0x41d239
ret
mov dword [ebp - 4], 0
test edi, edi
je 0x41d08a
mov ecx, edi
lea edx, [ecx + 2]
jmp 0x41d2bb
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x41d08a
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 0x28]
push ecx
push ebx
push eax
mov byte [ebp - 4], 1
call fcn.0040b0b0
add esp, 0xc
test eax, eax
je 0x41d1a9
jmp 0x41ced5
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
je 0x41d0b7
jne 0x41d0b7
test bl, 0x1c
push 0xa34e50
mov dword [0x1061eae4], eax
mov eax, dword [eax + 0x820]
push dword [0x425310]
sub dl, byte [0x8b49a48f]
dec ebp
hlt
push 0x6b
push 0x41d03e
ret
cmp eax, dword [ebp - 0x24]
je 0x41d1a9
je 0x41cf2b
jne 0x41cf2b
mov eax, 0x4297d4
and eax, 0x25ba1114
push 0x1149977c
inc esp
insd dword es:[edi], dx
mov eax, dword ss:[ebp - 0x28]
mov eax, dword [ebp - 0x28]
jmp 0x41ceae
push 0x14
je 0x41cfc8
jne 0x41cfc8
cmp edi, 0x800a
mov dword [0x111fcbd4], eax
push 0x1025d369
mov dword [0xddb138], 0x995150
mov eax, 0x1057f42c
and dword [ecx], esp
mov gs, word [eax + 0x3c]
leave
inc ebx
add byte [ebp + 0x5057ec45], cl
push 0x43c93c
lea eax, [ebp - 0x14]
push edi
push eax
mov dword [ebp - 0x14], 0
call fcn.0042fea0
add esp, 0xc
test eax, eax
jne 0x41d1a9
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x41d1a9
mov eax, dword [ebp - 0x28]
mov esi, dword [ebp - 0x24]
push ecx
sub esi, eax
jmp 0x41d13e
mov ebp, esp
push 0xffffffffffffffff
push 0x43b3a8
mov eax, dword fs:[0]
jmp 0x41d1fa
push 1
je 0x41d0e1
jne 0x41d0e1
mov dword [esp + 0x30], edi
push 0x472438
mov byte [0xceb32a], bl
int1
push 0x65
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x41d313
push 0x41cd5a
ret
je 0x41d1a9
mov eax, dword [0x499670]
mov ecx, 0x499670
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
je 0x41ce8e
jne 0x41ce8e
add esi, 0xfffffe48
mov dword [ebp - 0x98], edx
mov ecx, dword [0xd8d3c4]
adc dword [0x2f1112b2], ebx
push 0x697a6f48
xor byte [ecx + 0x4d8d92a9], 0xe8
mov byte [ebp - 4], 2
jmp 0x41d263
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
je 0x41d11c
jne 0x41d11c
mov eax, 0x1057d73c
push 0x697c6190
mov dword [ebp - 0x102c], ebx
lodsb al, byte [esi]
stosd dword es:[edi], eax
sub al, 0xa0
or eax, 0x845c7c3
add byte [eax], al
add byte [eax], al
mov eax, 0x41d0c5
ret
ret
push eax
call fcn.00430796
push dword [ebp - 0x14]
xor ebx, ebx
cmp esi, eax
sete bl
call fcn.0043001b
add esp, 0x14
test ebx, ebx
jmp 0x41cff7
pop ecx
pop edi
pop esi
jmp 0x41cd85
push esi
jmp 0x41cfaa
call fcn.00419d40
push esi
lea ecx, [ebp + 8]
call fcn.00417580
test eax, eax
je 0x41d199
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x41d199
push 1
push 0
push 0
push dword [ebp + 8]
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x1c], 1
lea ecx, [ebp + 8]
call fcn.00417270
lea ecx, [ebp - 0x18]
call int.00408200
lea ecx, [ebp - 0x28]
call fcn.0040b010
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
je 0x41ce42
jne 0x41ce42
sub eax, dword [ebx*4 + 0x4429e8]
mov dword [ebp - 0x4038], eax
push 0x453398
movzx ecx, byte [eax + 0x698311fe]
ror dword [esi - 0x627bf0c7], cl
invalid
je 0x41d08a
push eax
jmp 0x41cdf8
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x4997cc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 8]
mov dword [ebp - 0x1c], 0
je 0x41cdbe
jne 0x41cdbe
push 0x609
mov edx, dword [edi + 0x1b0]
add byte [ebx + 0x6a], dl
pop esi
pop ebx
mov esp, ebp
pop ebp
push 0x41d089
ret
call 0x4093c0
test eax, eax
je 0x41d1a1
mov esi, dword [ebp - 0x18]
cmp dword [esi - 0xc], 0
je 0x41d1a1
push edi
lea ecx, [ebp + 8]
call fcn.00407e90
lea ecx, [ebp + 8]
mov byte [ebp - 4], 3
je 0x41d157
jne 0x41d157
mov ecx, dword [0x424cfc]
mov dword [0x425db8], 0xc0000409
lea ecx, [eax + 4]
adc bh, byte [esi - 0x41f3ffba]
or byte [esi + 4], 0x80
xchg edx, eax
aas
popal
in al, dx
and ecx, dword [ebp + 0x24a4]
add byte [eax], al
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41d2c2
sub ecx, edx
sar ecx, 1
je 0x41d08a
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41d08a
je 0x41cefb
jne 0x41cefb
push 0x697a78cc
mov dword [0xd5153c], ebx
add byte [ecx - 0x2effb4bc], cl
push 0x9fbe88
loop 0x41d37d
mov ebp, 0xc35de58b
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, 1
mov ecx, dword [ebp - 0xc]
push 0x41cda8
ret
push 0xc700df81
push es
in al, dx
and byte [esi + 0x69], bh
lea ecx, [ebp - 0x17fc]
mov ecx, 0x20
push 0x697eabf4
inc esi
xlatb
in eax, 0x2b
cmp al, byte [edx + 3]
jne 0x41d679
xor eax, eax
push 0x41d674
ret
sbb eax, eax
or eax, 1
and edi, eax
je 0x41d96c
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 4], 1
jmp 0x41d6b1
push 6
push 0x43c9f8
jmp 0x41db8f
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
call fcn.0041a550
add esp, 4
jmp 0x41daae
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0042dbc5
mov esp, ebp
pop ebp
ret 0x10
mov dword [ebp - 4], 0
jmp 0x41d96c
push ebx
call 0x42f74e
add esp, 0xc
test eax, eax
je 0x41d74a
call fcn.00416020
xor eax, eax
mov word [ebp - reloc.wtsapi32.dll_WTSQueryUserToken], ax
push 0x206
push 0x41d4c4
ret