Function at 0x405890
Capabilities:
Create process on windows
Extract resource via kernel32 functions
Get common file path
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x42b55c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5bc
push ebx
push ebp
push esi
lea eax, [esp + 0xc4]
push edi
mov ebx, ecx
push eax
push 0x104
mov dword [esp + 0x34], ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
or ebp, 0xffffffff
lea edi, [esp + 0xc8]
mov ecx, ebp
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [esp + ecx + 0xc7], 0x5c
je 0x405914
mov edi, 0x4380c8
mov ecx, ebp
xor eax, eax
lea edx, [esp + 0xc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
mov ecx, ebp
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x43854c
mov ecx, ebp
xor eax, eax
lea edx, [esp + 0xc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0xa
mov esi, edi
mov edi, edx
mov edx, ecx
mov ecx, ebp
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x68
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x40595e
mov eax, 0xfffffffe
jmp 0x405cee
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x405ce9
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
lea eax, [esp + 0xc8]
push 0x1001
push eax
lea ecx, [esp + 0x24]
call fcn.00424181
push edi
push esi
lea ecx, [esp + 0x24]
mov dword [esp + 0x5dc], 0
call fcn.00424435
lea ecx, [esp + 0x1c]
call fcn.004244f9
lea ecx, [esp + 0x1c]
mov dword [esp + 0x5d4], ebp
call fcn.00424221
lea ecx, [esp + 0xc8]
push ecx
lea ecx, [esp + 0x14]
call fcn.0041f470
push 0x5c
lea ecx, [esp + 0x14]
mov dword [esp + 0x5d8], 1
call fcn.0041e22d
test eax, eax
jle 0x405a27
push eax
lea edx, [esp + 0x1c]
push 0
push edx
lea ecx, [esp + 0x1c]
call fcn.0041e197
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x5d8], 2
call fcn.0041f53b
lea ecx, [esp + 0x18]
mov byte [esp + 0x5d4], 1
call fcn.0041f402
push 0x4384dc
lea ecx, [esp + 0x14]
call fcn.0041f76a
lea eax, [esp + 0x10]
mov ecx, ebx
push eax
call fcn.00405e80
test eax, eax
jne 0x405a5f
lea ecx, [esp + 0x10]
mov dword [esp + 0x5d4], ebp
call fcn.0041f402
mov eax, 0xfffffffc
jmp 0x405cee
lea ecx, [esp + 0x10]
push 0x43851c
lea edx, [esp + 0x18]
push ecx
push edx
call fcn.0041f697
push ecx
lea eax, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
mov byte [esp + 0x5dc], 3
call fcn.0041f177
mov ecx, ebx
call fcn.00405580
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x3cd]
mov byte [esp + 0x3cc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x80
xor eax, eax
lea edi, [esp + 0x3cc]
lea edx, [esp + 0x3cc]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x10]
push ecx
push 0x438538
push edx
call fcn.0040fee1
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x90]
add esp, 0xc
rep stosd dword es:[edi], eax
mov dword [esp + 0x1c], eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x20], eax
lea edx, [esp + 0x84]
mov dword [esp + 0x24], eax
push ecx
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x14]
push edx
mov ebp, dword [sym.imp.KERNEL32.dll_CreateProcessA]
push eax
push 0
push 0x20
push 0
push 0
lea ecx, [esp + 0x3e8]
push 0
push ecx
push 0
mov dword [esp + 0xac], 0x44
call ebp
test eax, eax
jne 0x405b64
lea ecx, [esp + 0x14]
mov byte [esp + 0x5d4], 1
call fcn.0041f402
lea ecx, [esp + 0x10]
mov dword [esp + 0x5d4], 0xffffffff
call fcn.0041f402
mov eax, 0xfffffffb
jmp 0x405cee
mov edx, dword [esp + 0x1c]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x1cd]
mov byte [esp + 0x1cc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x1cc]
push eax
push 0x438528
push ecx
call fcn.0040fee1
mov edx, dword [0x43c718]
add esp, 0xc
test edx, edx
je 0x405c1d
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x405c1d
mov edi, 0x438344
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea ebx, [esp + 0x1cc]
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea ebx, [esp + 0x1cc]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ebx, dword [esp + 0x2c]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x1cc]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x40]
lea edx, [esp + 0x30]
rep stosd dword es:[edi], eax
xor ecx, ecx
lea eax, [esp + 0x40]
mov dword [esp + 0x30], ecx
push edx
mov dword [esp + 0x38], ecx
push eax
mov dword [esp + 0x40], ecx
mov dword [esp + 0x48], 0x44
push ecx
push ecx
push 0x20
push ecx
push ecx
mov dword [esp + 0x58], ecx
push ecx
lea ecx, [esp + 0x1ec]
push ecx
push 0
call ebp
test eax, eax
jne 0x405c9f
lea ecx, [esp + 0x14]
mov byte [esp + 0x5d4], 1
call fcn.0041f402
lea ecx, [esp + 0x10]
mov dword [esp + 0x5d4], 0xffffffff
call fcn.0041f402
mov eax, 0xfffffffa
jmp 0x405cee
mov ecx, dword [ebx + 0x1c]
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
push 0
push 0x64
push 0x65
push ecx
mov dword [ebx + 0x5c], edx
mov dword [ebx + 0xe0], eax
call dword [sym.imp.USER32.dll_SetTimer]
lea ecx, [esp + 0x14]
mov byte [esp + 0x5d4], 1
call fcn.0041f402
lea ecx, [esp + 0x10]
mov dword [esp + 0x5d4], 0xffffffff
call fcn.0041f402
xor eax, eax
jmp 0x405cee
mov eax, 0xfffffffd
mov ecx, dword [esp + 0x5cc]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x5c8
ret