Function at 0x4019e0
Capabilities:
Accept command line arguments
Create process on windows
Extract resource via kernel32 functions
Set environment variable
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xf4
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0xf0], eax
push ebx
push esi
push edi
push 0x1000
mov edx, str._TEMP_onefile__PID___TIME_
mov ecx, 0x420c80
call fcn.00401140
add esp, 4
test al, al
je 0x401de5
push 1
push 0x4019a0
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
test eax, eax
je 0x401def
push 0xa
push 0x1b
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push 0
mov dword [0x42c488], eax
mov dword [0x424480], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, dword [0x424480]
mov ax, word [edi]
mov word [esp + 0x10], ax
mov al, byte [edi + 2]
add edi, 3
cmp byte [esp + 0x10], 0x4b
mov dword [0x424480], edi
jne 0x401de0
cmp byte [esp + 0x11], 0x41
jne 0x401de0
cmp al, 0x58
jne 0x401de0
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [0x41e478], 1
nop word [eax + eax]
movzx eax, word [edi]
mov ecx, 0x422c80
add edi, 2
mov word [0x422c80], ax
mov dword [0x424480], edi
test ax, ax
je 0x401ccd
mov edx, edi
movzx eax, word [edi]
lea ecx, [ecx + 2]
mov word [ecx], ax
lea edi, [edx + 2]
mov edx, edi
test ax, ax
jne 0x401ad2
mov dword [0x424480], edi
cmp word [0x422c80], ax
je 0x401ccd
xor eax, eax
mov edx, 0x1000
mov ecx, 0x41ec80
mov word [0x41ec80], ax
cmp word [0x420c80], ax
je 0x401b3b
mov esi, 0x420c80
sub esi, ecx
nop word [eax + eax]
cmp edx, 1
jb 0x401e03
mov ax, word [esi + ecx]
dec edx
mov word [ecx], ax
add ecx, 2
cmp word [esi + ecx], 0
jne 0x401b20
xor eax, eax
mov word [ecx], ax
mov ecx, 0x1000
cmp word [0x41ec80], 0
mov eax, 0x41ec80
je 0x401b67
add eax, 2
dec ecx
cmp word [eax], 0
jne 0x401b54
cmp ecx, 1
jb 0x401e03
mov dword [eax], 0x5c
mov edx, 0x1000
cmp word [0x41ec80], 0
mov eax, 0x41ec80
je 0x401b8b
add eax, 2
dec edx
cmp word [eax], 0
jne 0x401b81
mov esi, 0x422c80
sub esi, eax
cmp edx, 1
jb 0x401e03
mov cx, word [esi + eax]
dec edx
mov word [eax], cx
add eax, 2
cmp word [esi + eax], 0
jne 0x401b92
xor ecx, ecx
mov word [eax], cx
cmp word [0x41e480], cx
jne 0x401bf6
cmp word [0x41ec80], 0
mov edx, 0x1000
mov ecx, 0x41e480
je 0x401bf1
mov esi, 0x41ec80
sub esi, ecx
cmp edx, 1
jb 0x401e03
mov ax, word [esi + ecx]
dec edx
mov word [ecx], ax
add ecx, 2
cmp word [esi + ecx], 0
jne 0x401bd6
xor eax, eax
mov word [ecx], ax
mov esi, dword [edi + 4]
mov ecx, 0x41ec80
mov ebx, dword [edi]
add edi, 8
mov dword [esp + 0x18], esi
mov dword [0x424480], edi
call fcn.00401790
push 0
push 0
push 2
push 0
push 2
push 0x40000000
push 0x41ec80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
je 0x401dfe
test esi, esi
jne 0x401c43
test ebx, ebx
je 0x401cb9
test esi, esi
ja 0x401c53
jb 0x401c4f
cmp ebx, 0x8000
ja 0x401c53
mov edi, ebx
jmp 0x401c58
mov edi, 0x8000
mov esi, dword [0x424480]
push edi
push esi
push 0x424488
call fcn.004037a0
add esp, 0xc
mov dword [esp + 0x1c], 0
lea eax, [esp + 0x1c]
add esi, edi
mov dword [0x424480], esi
push 0
push eax
push edi
push 0x424488
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x401df9
mov esi, dword [esp + 0x18]
mov eax, edi
cdq
sub ebx, eax
sbb esi, edx
mov dword [esp + 0x18], esi
test esi, esi
ja 0x401c53
jb 0x401cb5
test ebx, ebx
jne 0x401c41
mov eax, dword [esp + 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call ebx
mov edi, dword [0x424480]
jmp 0x401ab0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x41ac74
lea eax, [esp + 0x80]
push 0x80
push eax
call fcn.00401040
add esp, 0x10
lea eax, [esp + 0x78]
push eax
push 0x41abd8
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea eax, [esp + 0x20]
mov dword [esp + 0x30], 0x44
push eax
lea eax, [esp + 0x34]
xorps xmm0, xmm0
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
movlpd qword [esp + 0x54], xmm0
movlpd qword [esp + 0x5c], xmm0
movlpd qword [esp + 0x64], xmm0
movlpd qword [esp + 0x6c], xmm0
movlpd qword [esp + 0x74], xmm0
movlpd qword [esp + 0x7c], xmm0
movlpd qword [esp + 0x84], xmm0
movlpd qword [esp + 0x8c], xmm0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
push 0x41e480
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x401e08
push dword [esp + 0x24]
call ebx
mov eax, dword [esp + 0x20]
mov dword [0x41e474], eax
mov dword [esp + 0x14], 0
test eax, eax
je 0x401dc2
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [esp + 0x14]
push eax
push dword [0x41e474]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x401db0
mov dword [esp + 0x14], 1
push dword [0x41e474]
call ebx
mov dword [0x41e474], 0
call fcn.00401890
mov ecx, dword [esp + 0xfc]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401e16
mov esp, ebp
pop ebp
ret
call fcn.004015d0
mov ecx, str._TEMP_onefile__PID___TIME_
call fcn.00401620
mov ecx, str.Error__failed_to_register_signal_handler.
call fcn.00401580
call fcn.004015b0
call fcn.004015f0
call fcn.00404fe5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
call fcn.004015e0
int3