Function at 0x401160
Capabilities:
Create process on windows
Extract resource via kernel32 functions
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x348
mov eax, dword [0x413004]
xor eax, esp
mov dword [esp + 0x344], eax
push esi
push edi
push 0
push 1
call dword [sym.imp.KERNEL32.dll_SetThreadErrorMode]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x401923
push 0xa
push 0
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x401923
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x401923
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [esp + 0x18], eax
test eax, eax
je 0x401923
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
shr eax, 1
lea ecx, [esp + 0x98]
push eax
push dword [esp + 0x1c]
mov dword [esp + 0xa0], 0
mov dword [esp + 0xb0], 0
mov dword [esp + 0xb4], 7
call fcn.004019c0
mov edi, dword [esp + 0xa8]
cmp edi, 0x1c
jbe 0x4018e5
lea eax, [esp + 0x140]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x40133f
lea ecx, [esp + 0x140]
mov dword [esp + 0xd0], 0
mov dword [esp + 0xe0], 0
lea edx, [ecx + 2]
mov dword [esp + 0xe4], 7
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401262
sub ecx, edx
lea eax, [esp + 0x140]
sar ecx, 1
push ecx
push eax
lea ecx, [esp + 0xd8]
call fcn.004019c0
lea ecx, [esp + 0x140]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401290
sub ecx, edx
sar ecx, 1
movzx eax, word [esp + ecx*2 + 0x13e]
push eax
push 0x411c88
call fcn.00402d51
add esp, 8
test eax, eax
jne 0x40131b
mov esi, dword [esp + 0xe4]
mov eax, esi
mov edx, dword [esp + 0xe0]
sub eax, edx
cmp eax, 1
jb 0x4012fd
cmp esi, 8
lea eax, [esp + 0xd0]
lea ecx, [edx + 1]
mov esi, 0x5c
cmovae eax, dword [esp + 0xd0]
mov dword [esp + 0xe0], ecx
mov word [eax + edx*2], si
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x40131b
push 1
push 0x411c88
mov byte [esp + 0x20], 0
lea ecx, [esp + 0xd8]
push dword [esp + 0x20]
push 1
call fcn.00401bf0
movaps xmm0, xmmword [esp + 0xd0]
movaps xmmword [esp + 0xb0], xmm0
movq xmm0, qword [esp + 0xe0]
movq qword [esp + 0xc0], xmm0
jmp 0x401373
push 0
push 0x411c8c
lea ecx, [esp + 0xb8]
mov dword [esp + 0xb8], 0
mov dword [esp + 0xc8], 0
mov dword [esp + 0xcc], 7
call fcn.004019c0
cmp dword [esp + 0xc0], 0
mov esi, dword [esp + 0xb0]
jbe 0x4018ae
mov ecx, 0x12
mov dword [esp + 0xf8], 0
cmp edi, ecx
mov dword [esp + 0x108], 0
lea eax, [esp + 0x98]
mov dword [esp + 0x10c], 7
cmovb ecx, edi
cmp dword [esp + 0xac], 8
push ecx
cmovae eax, dword [esp + 0x9c]
lea ecx, [esp + 0xfc]
push eax
call fcn.004019c0
mov eax, dword [esp + 0xa8]
mov dword [esp + 0x34], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 7
cmp eax, 0x12
jb 0x40193b
add eax, 0xffffffee
mov ecx, 7
cmp eax, ecx
cmovb ecx, eax
cmp dword [esp + 0xac], 8
lea eax, [esp + 0x98]
cmovae eax, dword [esp + 0x98]
push ecx
add eax, 0x24
lea ecx, [esp + 0x38]
push eax
call fcn.004019c0
push str..exe
lea edx, [esp + 0x38]
lea ecx, [esp + 0x114]
call fcn.00401b30
mov edx, dword [esp + 0x4c]
add esp, 4
cmp edx, 8
jb 0x401486
mov ecx, dword [esp + 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40147c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401940
push edx
push ecx
call fcn.00402009
add esp, 8
mov eax, dword [esp + 0xa8]
mov dword [esp + 0x128], 0
mov dword [esp + 0x138], 0
mov dword [esp + 0x13c], 7
cmp eax, 0x19
jb 0x401945
add eax, 0xffffffe7
or ecx, 0xffffffff
cmp eax, 0xffffffff
cmovb ecx, eax
cmp dword [esp + 0xac], 8
lea eax, [esp + 0x98]
cmovae eax, dword [esp + 0x98]
push ecx
add eax, 0x32
lea ecx, [esp + 0x12c]
push eax
call fcn.004019c0
mov ecx, 0x7ffffffe
mov dword [esp + 0x18], 1
sub ecx, dword [esp + 0xc0]
lea edi, [esp + 0x110]
mov dword [esp + 0x54], ecx
nop word [eax + eax]
mov eax, dword [esp + 0x108]
mov dword [esp + 0x4c], eax
cmp ecx, eax
jb 0x401954
cmp dword [esp + 0xc4], 8
lea edx, [esp + 0xb0]
lea ecx, [esp + 0xf8]
mov dword [esp + 0x34], 0
cmovae edx, esi
mov dword [esp + 0x44], 0
cmp dword [esp + 0x10c], 8
mov esi, 7
mov dword [esp + 0x1c], edx
cmovae ecx, dword [esp + 0xf8]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0xc0]
add ecx, eax
mov dword [esp + 0x48], 0
mov dword [esp + 0x14], ecx
lea eax, [esp + 0x34]
mov dword [esp + 0x10], eax
cmp ecx, esi
jbe 0x40161b
mov esi, ecx
or esi, 7
cmp esi, 0x7ffffffe
jbe 0x4015a7
mov esi, 0x7ffffffe
mov eax, 0xfffffffe
jmp 0x4015c9
cmp esi, 0xa
mov eax, 0xa
cmovb esi, eax
lea eax, [esi + 1]
cmp eax, 0x7fffffff
ja 0x40194a
add eax, eax
cmp eax, 0x1000
jb 0x4015fa
lea ecx, [eax + 0x23]
cmp ecx, eax
jbe 0x40194a
push ecx
call fcn.00401ec4
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x401940
mov edx, dword [esp + 0x1c]
lea eax, [ecx + 0x23]
and eax, 0xffffffe0
mov dword [eax - 4], ecx
mov ecx, dword [esp + 0x14]
jmp 0x401613
test eax, eax
je 0x401611
push eax
call fcn.00401ec4
mov ecx, dword [esp + 0x18]
add esp, 4
mov edx, dword [esp + 0x1c]
jmp 0x401613
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x44], ecx
mov ecx, dword [esp + 0xc0]
mov dword [esp + 0x48], esi
lea esi, [ecx + ecx]
push esi
push edx
push eax
call fcn.004036e0
mov eax, dword [esp + 0x58]
add esp, 0xc
add eax, eax
push eax
mov eax, dword [esp + 0x14]
push dword [esp + 0x24]
add eax, esi
push eax
call fcn.004036e0
mov eax, dword [esp + 0x1c]
add esp, 0xc
mov ecx, dword [esp + 0x14]
xor edx, edx
push 0x411c88
mov word [eax + ecx*2], dx
lea edx, [esp + 0x38]
lea ecx, [esp + 0x5c]
call fcn.00401b30
add esp, 4
mov dword [esp + 0x10], edi
cmp dword [edi + 0x14], 8
mov esi, eax
jb 0x401687
mov eax, dword [edi]
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x14]
mov edx, dword [esi + 0x10]
sub eax, edx
mov ecx, dword [edi + 0x10]
cmp ecx, eax
ja 0x4016d8
cmp dword [esi + 0x14], 8
lea eax, [edx + ecx]
mov dword [esp + 0x20], eax
mov dword [esi + 0x10], eax
mov dword [esp + 0x14], esi
jb 0x4016b0
mov eax, dword [esi]
mov dword [esp + 0x14], eax
lea eax, [ecx + ecx]
push eax
mov eax, dword [esp + 0x18]
push dword [esp + 0x14]
lea eax, [eax + edx*2]
push eax
call fcn.004036e0
mov eax, dword [esp + 0x20]
add esp, 0xc
mov ecx, dword [esp + 0x20]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x4016f0
push ecx
push dword [esp + 0x14]
mov byte [esp + 0x58], 0
push dword [esp + 0x58]
push ecx
mov ecx, esi
call fcn.00401bf0
mov esi, eax
movups xmm0, xmmword [esi]
xor eax, eax
movq xmm1, qword [esi + 0x10]
mov word [esi], ax
lea eax, [esp + 0x70]
movaps xmmword [esp + 0xd0], xmm0
movaps xmmword [esp + 0x70], xmm0
movq qword [esp + 0x20], xmm1
movq qword [esp + 0x80], xmm1
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
cmp edi, eax
je 0x401787
mov ecx, dword [edi + 0x14]
cmp ecx, 8
jb 0x401776
mov eax, dword [edi]
lea ecx, [ecx*2 + 2]
cmp ecx, 0x1000
jb 0x40175e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401940
mov eax, edx
push ecx
push eax
call fcn.00402009
movaps xmm0, xmmword [esp + 0xd8]
add esp, 8
movq xmm1, qword [esp + 0x20]
mov dword [edi + 0x10], 0
movups xmmword [edi], xmm0
movq qword [edi + 0x10], xmm1
jmp 0x4017c6
mov edx, dword [esp + 0x84]
cmp edx, 8
jb 0x4017c6
mov ecx, dword [esp + 0x70]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4017bc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401940
push edx
push ecx
call fcn.00402009
add esp, 8
mov edx, dword [esp + 0x6c]
cmp edx, 8
jb 0x401802
mov ecx, dword [esp + 0x58]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4017f8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401940
push edx
push ecx
call fcn.00402009
add esp, 8
mov edx, dword [esp + 0x48]
xor eax, eax
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 7
mov word [esp + 0x58], ax
cmp edx, 8
jb 0x401855
mov ecx, dword [esp + 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40184b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401940
push edx
push ecx
call fcn.00402009
add esp, 8
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x40185f
mov eax, dword [edi]
push 1
push 0
push 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [esp + 0x18]
add edi, 0x18
inc ecx
mov dword [esp + 0x18], ecx
cmp ecx, 3
jge 0x401891
mov esi, dword [esp + 0xb0]
mov ecx, dword [esp + 0x54]
jmp 0x401510
push 0x401960
push 3
push 0x18
lea eax, [esp + 0x104]
push eax
call fcn.00401ef4
mov esi, dword [esp + 0xb0]
mov eax, dword [esp + 0xc4]
cmp eax, 8
jb 0x4018e5
lea ecx, [eax*2 + 2]
mov eax, esi
cmp ecx, 0x1000
jb 0x4018db
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40194f
push ecx
push esi
call fcn.00402009
add esp, 8
mov edx, dword [esp + 0xac]
cmp edx, 8
jb 0x401923
mov ecx, dword [esp + 0x98]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x401919
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40194f
push edx
push ecx
call fcn.00402009
add esp, 8
mov ecx, dword [esp + 0x34c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.00401eb6
mov esp, ebp
pop ebp
ret 0x10
call fcn.00401b20
call fcn.00403e4c
call fcn.00401b20
call fcn.004010b0
call fcn.00403e4c
call fcn.00401150
int3