Function at 0x40575c
Capabilities:
Create process on windows
Delete file
Extract resource via kernel32 functions
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x657a6b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x128
push edi
mov dword [ebp - 0x134], ecx
mov dword [ebp - 4], 0
push 0x75254c
push 0xd8
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0
jne 0x4057bd
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00622566
jmp 0x4059c4
mov eax, dword [ebp - 0x130]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x124], eax
mov ecx, dword [ebp - 0x130]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
jne 0x405804
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00622566
jmp 0x4059c4
mov edx, dword [ebp - 0x124]
push edx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x405830
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00622566
jmp 0x4059c4
mov eax, dword [ebp - 0x124]
push eax
mov ecx, dword [ebp - 0x11c]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
mov edx, dword [ebp - 0x10]
push edx
call fcn.005fba00
add esp, 0xc
mov byte [ebp - 0x118], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x117]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [ebp - 0x118]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
lea ecx, [ebp - 0x118]
push ecx
call fcn.005fc2e0
add esp, 8
mov byte [eax], 0
push str.upx.exe
lea edx, [ebp - 0x118]
push edx
call fcn.005fc1d0
add esp, 8
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0
push 2
push 0
push 0
push 0x40000000
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
jne 0x4058f2
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00622566
jmp 0x4059c4
push 0
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x124]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x12c]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x128]
call fcn.00401d70
mov byte [ebp - 4], 1
push 0x75255c
lea ecx, [ebp - 0x128]
call fcn.00622942
lea ecx, [ebp + 8]
push ecx
lea ecx, [ebp - 0x128]
call fcn.0062297e
push 0x752560
lea ecx, [ebp - 0x128]
call fcn.00622942
push 0
push 0x781b70
lea ecx, [ebp - 0x128]
call fcn.00401d90
push eax
lea edx, [ebp - 0x118]
push edx
push 0x752564
mov eax, dword [ebp - 0x134]
mov ecx, dword [eax + 0x1c]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea edx, [ebp - 0x118]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
je 0x40598a
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x128]
call fcn.00622566
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00622566
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret 4