Function at 0x402080
Capabilities:
Accept command line arguments
Create directory
Create process on windows
Delete directory
Delete file
Extract resource via kernel32 functions
Get common file path
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10bc
call fcn.004137b0
mov eax, dword [0x41d004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
mov byte [ebp - 0x104e], 1
push ebx
push 0x81
push 0x41a8cc
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov esi, eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push ebx
mov dword [ebp - 0x1058], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x104c], eax
lea eax, [ebp - 0x210]
push eax
push ebx
push ebx
push 0x23
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push str.ForensiT_
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.00408001
add esp, 0xc
lea eax, [ebp - 0x210]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40212e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40297a
mov byte [ebp - 0x104e], bl
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x620]
push 0x104
push eax
call fcn.00406827
add esp, 0xc
mov dword [ebp - 0x1060], 0
lea eax, [ebp - 0x1060]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
push 0x5c
push dword [esi]
call fcn.00404fe0
mov edx, eax
add esp, 8
test edx, edx
je 0x402180
add edx, 2
jmp 0x402182
mov edx, dword [esi]
mov ecx, edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x402187
sub ecx, edi
sar ecx, 1
lea eax, [ecx - 3]
push eax
push edx
lea eax, [ebp - 0x620]
push 0x104
push eax
call fcn.0040815f
push 0x41a9d8
lea eax, [ebp - 0x620]
push 0x104
push eax
call fcn.00408001
add esp, 0x1c
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0
push 0
push 2
push 0
push 1
push 0x10000000
lea eax, [ebp - 0x620]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x402221
push 0
lea eax, [ebp - 0x1054]
push eax
push dword [ebp - 0x104c]
push dword [ebp - 0x1058]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x402218
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40222a
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov ebx, eax
test ebx, ebx
jne 0x402978
push ebx
push 0x84
push 0x41a8cc
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov esi, eax
test esi, esi
je 0x4022f2
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x4022f2
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x104c], eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0xe40]
push 0x104
push eax
call fcn.00406827
add esp, 0xc
lea eax, [ebp - 0xe40]
push 0x41a8ac
push 0x104
push eax
call fcn.00408001
add esp, 0xc
lea eax, [ebp - 0xe40]
push ebx
push ebx
push 2
push ebx
push 1
push 0x10000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4022f2
push ebx
lea eax, [ebp - 0x1054]
push eax
push dword [ebp - 0x104c]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4022eb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x85
push 0x41a8cc
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov esi, eax
test esi, esi
je 0x4023ba
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x4023ba
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x104c], eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x1048]
push 0x104
push eax
call fcn.00406827
add esp, 0xc
lea eax, [ebp - 0x1048]
push 0x41a9e0
push 0x104
push eax
call fcn.00408001
add esp, 0xc
lea eax, [ebp - 0x1048]
push 0
push 0
push 2
push 0
push 1
push 0x10000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4023ba
push 0
lea eax, [ebp - 0x1054]
push eax
push dword [ebp - 0x104c]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4023b3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
push eax
push 0x88
push 0x41a8cc
push eax
mov word [ebp - 0x418], ax
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov edi, dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x4025b7
push esi
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x1054], eax
test eax, eax
je 0x4025b7
mov edx, str.129B4F31_7F87_41f1_979C_117BBD72E210
mov ecx, eax
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x402426
test al, al
je 0x402422
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x402426
add ecx, 2
add edx, 2
test al, al
jne 0x402406
xor eax, eax
jmp 0x40242b
sbb eax, eax
or eax, 1
test eax, eax
je 0x4025b7
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x105c], eax
lea ecx, [ebp - 0xe40]
lea eax, [ebp - 0x1058]
mov dword [ebp - 0x1058], 0
push eax
call fcn.00402ea0
mov eax, dword [ebp - 0x1058]
add esp, 4
test eax, eax
je 0x4025b7
push 0x22
push eax
xor esi, esi
mov byte [ebp - 0x104d], 0
call fcn.004041bf
mov edi, eax
add esp, 8
test edi, edi
je 0x4024e5
add edi, 2
push 0x22
lea ecx, [edi + 2]
push ecx
call fcn.004041bf
mov esi, eax
add esp, 8
test esi, esi
je 0x402536
sub esi, edi
sar esi, 1
lea ecx, [esi*2 + 2]
push ecx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x104c], eax
test eax, eax
je 0x4024df
push esi
push edi
lea ecx, [esi + 1]
push ecx
push eax
call fcn.00406992
add esp, 0x10
mov byte [ebp - 0x104d], 1
mov esi, dword [ebp - 0x104c]
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x418]
push 0x104
push eax
call fcn.00406827
add esp, 0xc
lea eax, [ebp - 0x418]
cmp byte [ebp - 0x104d], 0
je 0x40253a
push esi
push 0x104
push eax
call fcn.00408001
add esp, 0xc
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [ebp - 0x1058]
jmp 0x40254f
xor esi, esi
jmp 0x4024e5
mov edi, dword [ebp - 0x1058]
push edi
push 0x104
push eax
call fcn.00408001
add esp, 0xc
push 0
push 0
push 2
push 0
push 1
push 0x10000000
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4025a1
push 0
lea eax, [ebp - 0x104c]
push eax
push dword [ebp - 0x105c]
push dword [ebp - 0x1054]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40259a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [sym.imp.KERNEL32.dll_LoadResource]
xor eax, eax
push eax
push 0x89
push 0x41a8cc
push eax
mov word [ebp - 0x828], ax
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov esi, eax
test esi, esi
je 0x4026b9
push esi
push 0
call edi
mov edi, dword [sym.imp.KERNEL32.dll_LockResource]
push eax
call edi
mov dword [ebp - 0x1054], eax
test eax, eax
je 0x4026bf
mov edx, str.129B4F31_7F87_41f1_979C_117BBD72E210
mov ecx, eax
nop
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x402620
test al, al
je 0x40261c
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x402620
add ecx, 2
add edx, 2
test al, al
jne 0x402600
xor eax, eax
jmp 0x402625
sbb eax, eax
or eax, 1
test eax, eax
je 0x4026bf
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x828]
push 0x104
push eax
call fcn.00406827
add esp, 0xc
lea eax, [ebp - 0x828]
push str.Users.csv
push 0x104
push eax
call fcn.00408001
add esp, 0xc
lea eax, [ebp - 0x828]
push 0
push 0
push 2
push 0
push 1
push 0x10000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4026b9
push 0
lea eax, [ebp - 0x105c]
push eax
push edi
push dword [ebp - 0x1054]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4026b2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [sym.imp.KERNEL32.dll_LockResource]
xor eax, eax
push eax
push 0x8a
push 0x41a8cc
push eax
mov word [ebp - 0xa30], ax
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov esi, eax
test esi, esi
je 0x4027be
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call edi
mov dword [ebp - 0x1054], eax
test eax, eax
je 0x4027be
mov edx, str.129B4F31_7F87_41f1_979C_117BBD72E210
mov ecx, eax
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x402725
test al, al
je 0x402721
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x402725
add ecx, 2
add edx, 2
test al, al
jne 0x402705
xor eax, eax
jmp 0x40272a
sbb eax, eax
or eax, 1
test eax, eax
je 0x4027be
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0xa30]
push 0x104
push eax
call fcn.00406827
add esp, 0xc
lea eax, [ebp - 0xa30]
push str.Computers.csv
push 0x104
push eax
call fcn.00408001
add esp, 0xc
lea eax, [ebp - 0xa30]
push 0
push 0
push 2
push 0
push 1
push 0x10000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4027be
push 0
lea eax, [ebp - 0x105c]
push eax
push edi
push dword [ebp - 0x1054]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4027b7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.wscript.exe
lea eax, [ebp - 0xc38]
push 0x104
push eax
call fcn.00406827
add esp, 0xc
lea eax, [ebp - 0xc38]
push 0x41aa3c
push 0x104
push eax
call fcn.00408001
add esp, 0xc
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0xc38]
push 0x104
push eax
call fcn.00408001
add esp, 0xc
lea eax, [ebp - 0xc38]
push 0x41aa3c
push 0x104
push eax
call fcn.00408001
add esp, 0xc
lea eax, [ebp - 0x10b8]
push 0x44
push 0
push eax
call fcn.00405540
add esp, 0xc
mov dword [ebp - 0x10b8], 0x44
lea eax, [ebp - 0x1070]
xorps xmm0, xmm0
movups xmmword [ebp - 0x1070], xmm0
push eax
lea eax, [ebp - 0x10b8]
push eax
lea eax, [ebp - 0x210]
push eax
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc38]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x402938
push 0xffffffffffffffff
push dword [ebp - 0x1070]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x620]
push eax
call esi
lea eax, [ebp - 0xe40]
push eax
call esi
lea eax, [ebp - 0x1048]
push eax
call esi
lea ecx, [ebp - 0x418]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4028c0
sub ecx, edx
sar ecx, 1
je 0x4028da
lea eax, [ebp - 0x418]
push eax
call esi
lea ecx, [ebp - 0x828]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4028e3
sub ecx, edx
sar ecx, 1
je 0x4028fd
lea eax, [ebp - 0x828]
push eax
call esi
lea ecx, [ebp - 0xa30]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x402906
sub ecx, edx
sar ecx, 1
je 0x402920
lea eax, [ebp - 0xa30]
push eax
call esi
cmp byte [ebp - 0x104e], 0
je 0x402940
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x402940
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
je 0x402978
lea edx, [ebp - 0x104c]
mov dword [ebp - 0x104c], 0
mov ecx, ebx
call fcn.00401a30
mov esi, dword [ebp - 0x104c]
push 0x30
push str.User_Profile_Wizard_Deployment_Kit
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004031c6
mov esp, ebp
pop ebp
ret