Function at 0x40b9c5
Capabilities:
Check if file exists
Create directory
Delete file
Execute vbscript javascript or jscript in memory
Extract resource via kernel32 functions
Get common file path
Get file attributes
Set current directory
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push edx
mov ecx, dword [ebp - 0x694]
call 0x411683
mov dword [ebp - 0x6e4], eax
jmp 0x40b9e3
mov eax, dword [ebp - 0x6e4]
mov dword [ebp - 0x138], eax
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 0x14]
mov dword [ebp - 0x6e8], edx
cmp dword [ebp - 0x6e8], 0
je 0x40ba1e
cmp dword [ebp - 0x6e8], 1
je 0x40ba32
cmp dword [ebp - 0x6e8], 2
je 0x40ba46
jmp 0x4174bf
lea eax, [ebp - 0x128]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
jmp 0x40baa1
lea ecx, [ebp - 0x128]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
jmp 0x40baa1
mov ecx, dword [ebp - 0x138]
call 0x4119d3
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
adc eax, sym.imp.KERNEL32.dll_GetFileAttributesA
mov dword [ebp - 0x628], eax
cmp dword [ebp - 0x628], 0xffffffff
je 0x40ba8f
mov edx, dword [ebp - 0x628]
and edx, 0x10
test edx, edx
je 0x40ba8f
mov ecx, dword [ebp - 0x138]
call 0x411a01
push eax
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x40baa1
lea ecx, [ebp - 0x128]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea edx, [ebp - 0x128]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x3d4], eax
cmp dword [ebp - 0x3d4], 0
jle 0x40bade
mov eax, dword [ebp - 0x3d4]
movsx ecx, byte [ebp + eax - 0x129]
cmp ecx, 0x5c
jne 0x40bade
mov edx, dword [ebp - 0x3d4]
mov byte [ebp + edx - 0x129], 0
call 0x418a6e
mov dword [ebp - 0x244], eax
mov eax, dword [ebp - 0x244]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x40bb0b
mov ecx, dword [ebp - 0x138]
call 0x411aa9
mov dword [ebp - 0x244], eax
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x36c]
push edx
lea eax, [ebp - 0x128]
push eax
push 0x40f1dc
mov ecx, dword [ebp - 0x260]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0
push 0x80
push 3
push 0
push 7
push 0x40000000
mov edx, dword [ebp - 0x260]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x4e0], eax
cmp dword [ebp - 0x4e0], 0xffffffff
jne 0x40bb93
mov dword [ebp - 0x24], 1
push 0
push 0x80
push 1
push 0
push 7
push 0x40000000
mov eax, dword [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x4e0], eax
cmp dword [ebp - 0x4e0], 0xffffffff
jne 0x40bbed
lea ecx, [ebp - 0x128]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edx, [ebp - 0x128]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x3d4], eax
cmp dword [ebp - 0x3d4], 0
jle 0x40bbeb
mov eax, dword [ebp - 0x3d4]
movsx ecx, byte [ebp + eax - 0x129]
cmp ecx, 0x5c
jne 0x40bbeb
mov edx, dword [ebp - 0x3d4]
mov byte [ebp + edx - 0x129], 0
jmp 0x40bc0d
mov eax, dword [ebp - 0x4e0]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x24], 0
je 0x40bc0d
mov ecx, dword [ebp - 0x260]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [ebp - 0x138]
mov eax, dword [edx + 0x10]
mov ecx, dword [eax + 8]
invalid
invalid