Function at 0x401d20
Capabilities:
Create process on windows
Extract resource via kernel32 functions
Get common file path
Self delete
Write and execute a file
Write file on windows

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x40335b
push eax
mov eax, 0x1064
mov dword fs:[0], esp
call fcn.00403050
mov dl, byte [0x405958]
push ebx
push ebp
push esi
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x475]
mov byte [esp + 0x474], dl
mov byte [esp + 0x74], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x75]
mov byte [esp + 0x874], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x875]
push str.48bitScanUpdate::LaunchSelfExtractable
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], 1
stosb byte es:[edi], al
call fcn.00402fd4
mov eax, dword [0x405960]
xor ebp, ebp
cmp eax, ebp
mov dword [esp + 0x107c], ebp
je 0x401dd3
mov ecx, dword [str.__Entering]
mov edx, dword [esp + 0x14]
push ecx
push edx
push str._s__s
push eax
call fcn.00402b30
add esp, 0x10
mov edi, dword [esp + 0x1084]
mov dword [esp + 0x2c], ebp
mov esi, str.Zelda
mov eax, edi
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x401e0d
test cl, cl
je 0x401e09
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x401e0d
add eax, 2
add esi, 2
test cl, cl
jne 0x401de5
xor eax, eax
jmp 0x401e12
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebp
jne 0x401e22
push str.SCANMODULE
push 0x69
jmp 0x401ea6
mov esi, str.Spider
mov eax, edi
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x401e51
test cl, cl
je 0x401e4d
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x401e51
add eax, 2
add esi, 2
test cl, cl
jne 0x401e29
xor eax, eax
jmp 0x401e56
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebp
jne 0x401e63
push str.SCANMODULE
push 0x6e
jmp 0x401ea6
mov esi, str.Sonic
mov eax, edi
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x401e92
test cl, cl
je 0x401e8e
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x401e92
add eax, 2
add esi, 2
test cl, cl
jne 0x401e6a
xor eax, eax
jmp 0x401e97
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebp
jne 0x4020f0
push str.SCANMODULE
push 0x73
push ebp
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
cmp esi, ebp
je 0x4020f0
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebp
je 0x402110
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
cmp ebx, ebp
je 0x402130
push esi
push ebp
mov dword [esp + 0x20], ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, eax
lea eax, [esp + 0x74]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edi, [esp + 0x74]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xc74]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x874]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x74]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 0x1084]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, str.Zelda
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x401f76
test cl, cl
je 0x401f72
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x401f76
add eax, 2
add esi, 2
test cl, cl
jne 0x401f52
xor eax, eax
jmp 0x401f7b
sbb eax, eax
sbb eax, 0xffffffff
xor edi, edi
cmp eax, edi
jne 0x401f8d
lea eax, [esp + 0x74]
push str.CIT207355_Zelda_HPCOM_V6.exe
push eax
jmp 0x401f97
lea ecx, [esp + 0x74]
push str.CIT207355_Spider_HPCOM_V6.exe
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
mov eax, dword [0x405960]
cmp eax, edi
je 0x401fb4
push str.PathAppend_failed_for_HPPSCANMODULE
push eax
call fcn.00402aa0
add esp, 8
push edi
push 0x80
push 2
push edi
push edi
lea edx, [esp + 0x88]
push 0x40000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x402150
lea eax, [esp + 0x18]
push edi
push eax
push ebp
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp ebp, dword [esp + 0x18]
jne 0x40216d
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x30]
lea edx, [esp + 0x74]
rep stosd dword es:[edi], eax
xor ecx, ecx
push 0x405958
mov dword [esp + 0x20], ecx
push edx
mov dword [esp + 0x28], ecx
lea eax, [esp + 0x47c]
mov dword [esp + 0x2c], ecx
push str.__s___s
push eax
mov dword [esp + 0x40], 0x44
mov dword [esp + 0x38], ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x30]
xor ebx, ebx
push ecx
push edx
push ebx
push ebx
push 0x8000200
push ebx
push ebx
lea eax, [esp + 0x490]
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp eax, ebx
je 0x40218a
mov ecx, dword [esp + 0x1c]
push 0xea60
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, eax
cmp edi, 0x102
je 0x4021d0
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x2c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ecx, dword [0x405960]
cmp ecx, ebx
je 0x4020c5
cmp eax, ebx
je 0x4020c5
lea edx, [esp + 0x474]
push edi
push edx
push str.The_create_process_for__s_returned_error_code_as__d
push ecx
call fcn.00402aa0
add esp, 0x10
mov eax, dword [esp + 0x20]
cmp eax, ebx
je 0x4020d4
push eax
call esi
mov dword [esp + 0x20], ebx
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x4021d0
push eax
call esi
mov dword [esp + 0x1c], 0
jmp 0x4021d0
mov eax, dword [0x405960]
cmp eax, ebp
je 0x402147
push str.48bitScanUpdate.cpp::_Resource_Handle_for_P4tw_Exe_is_Invalid
push eax
call fcn.00402aa0
add esp, 8
mov dword [esp + 0x10], ebp
jmp 0x4021d0
mov eax, dword [0x405960]
cmp eax, ebp
je 0x402147
push str._48bitScanUpdate.cpp::_Resource_is_not_Loaded_Properly
push eax
call fcn.00402aa0
add esp, 8
mov dword [esp + 0x10], ebp
jmp 0x4021d0
mov eax, dword [0x405960]
cmp eax, ebp
je 0x402147
push str._48bitScanUpdate.cpp::_Resource_is_not_Locked._The_Problem_is_with_LpBuffer
push eax
call fcn.00402aa0
add esp, 8
mov dword [esp + 0x10], ebp
jmp 0x4021d0
mov eax, dword [0x405960]
cmp eax, edi
je 0x402184
push str.__Invalid_File_Handle_Value_While_Creating_File
push eax
call fcn.00402aa0
add esp, 8
mov dword [esp + 0x10], edi
jmp 0x4021d0
mov eax, dword [0x405960]
cmp eax, edi
je 0x402184
push str._The_File_is_not_Completely_Written._Problem_with_FileWrite
push eax
call fcn.00402aa0
add esp, 8
mov dword [esp + 0x10], edi
jmp 0x4021d0
mov eax, dword [0x405960]
cmp eax, ebx
je 0x4021a1
push str._48bitScanUpdate.cpp::_CreateProcess_with_SetUp_Failed
push eax
call fcn.00402aa0
add esp, 8
lea eax, [esp + 0x874]
mov dword [esp + 0x10], ebx
push eax
call fcn.00402230
add esp, 4
cmp eax, ebx
jne 0x4021d0
mov eax, dword [0x405960]
cmp eax, ebx
je 0x4021f3
push str.DeleteFile_Failed_in_48bitScanUpdate.cpp
push eax
call fcn.00402aa0
add esp, 8
mov eax, dword [0x405960]
test eax, eax
je 0x4021f3
mov ecx, dword [str.__Exiting]
mov edx, dword [esp + 0x14]
push ecx
push edx
push str._s__s
push eax
call fcn.00402b30
add esp, 0x10
lea ecx, [esp + 0x14]
mov dword [esp + 0x107c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x1074]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1070
ret