Function at 0x401000
Capabilities:
Create process on windows
Delete file
Enumerate gui resources
Get common file path
Read file on windows
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x898
push ebx
push esi
push edi
mov byte [ebp - 0x10], 0
mov dword [ebp - 4], 0
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleA]
test eax, eax
je 0x401038
mov dword [ebp - 4], 1
push 0x104
lea eax, [ebp - 0x118]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0x8000000
push 3
push 0
push 1
push 0x80000000
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x40108c
push str.Cannot_open_myself
call fcn.004019ad
add esp, 4
jmp 0x4017e0
mov dword [ebp - 0x220], 0x402014
push 0
lea eax, [ebp - 0x83c]
push eax
push 1
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4010bc
jmp 0x401755
cmp dword [ebp - 0x83c], 0
jne 0x4010ce
jmp 0x401755
movsx eax, byte [ebp - 0x10]
cmp eax, 0x27
je 0x4010f5
movsx eax, byte [ebp - 0x10]
cmp eax, 0x2f
je 0x4010f5
movsx eax, byte [ebp - 0x10]
cmp eax, 0x3c
jne 0x401750
push 0
lea eax, [ebp - 0x83c]
push eax
push 0x15
mov eax, dword [ebp - 0x220]
push eax
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
push str.Begin_VBS_r_n
mov eax, dword [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x401144
cmp dword [ebp - 0x83c], 0x15
jne 0x401144
mov dword [ebp - 8], str..vbs
jmp 0x401217
push str.Begin_VBE_r_n
mov eax, dword [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x401177
cmp dword [ebp - 0x83c], 0x15
jne 0x401177
mov dword [ebp - 8], str..vbe
jmp 0x401217
push str._Begin_JS_r_n
mov eax, dword [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x4011aa
cmp dword [ebp - 0x83c], 0x15
jne 0x4011aa
mov dword [ebp - 8], 0x402084
jmp 0x401217
push str._Begin_JSE_r_n
mov eax, dword [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x4011dd
cmp dword [ebp - 0x83c], 0x15
jne 0x4011dd
mov dword [ebp - 8], str..jse
jmp 0x401217
push str.___Begin_WSF____r_n
mov eax, dword [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x401210
cmp dword [ebp - 0x83c], 0x15
jne 0x401210
mov dword [ebp - 8], str..wsf
jmp 0x401217
mov dword [ebp - 8], 0
cmp dword [ebp - 8], 0
je 0x401750
mov byte [ebp - 0x324], 0
lea eax, [ebp - 0x21c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
movsx eax, byte [ebp - 0x324]
test eax, eax
je 0x401256
lea eax, [ebp - 0x324]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x324]
push eax
push 0
push 0x4020c8
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x401283
mov eax, 1
jmp 0x4017e0
push 0
push 0x8000000
push 3
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x324]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 0xffffffff
je 0x4012f9
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x83c], eax
push 0
lea eax, [ebp - 0x83c]
push eax
mov eax, dword [ebp - 0x83c]
push eax
lea eax, [ebp - 0x118]
push eax
mov eax, dword [ebp - 0x32c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x32c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x328], 0
jmp 0x40130e
inc dword [ebp - 0x328]
mov eax, dword [ebp - 0x328]
mov al, byte [ebp + eax - 0x324]
mov ecx, dword [ebp - 0x328]
mov byte [ebp + ecx - 0x838], al
mov eax, dword [ebp - 0x328]
movsx eax, byte [ebp + eax - 0x838]
test eax, eax
je 0x401343
jmp 0x401308
mov dword [ebp - 0x734], 0
jmp 0x401358
inc dword [ebp - 0x734]
mov eax, dword [ebp - 0x328]
mov dword [ebp - 0x894], eax
inc dword [ebp - 0x328]
mov eax, dword [ebp - 0x734]
mov ecx, dword [ebp - 8]
mov al, byte [eax + ecx]
mov ecx, dword [ebp - 0x894]
mov byte [ebp + ecx - 0x838], al
mov eax, dword [ebp - 0x894]
movsx eax, byte [ebp + eax - 0x838]
test eax, eax
je 0x40139e
jmp 0x401352
push 0
push 0x8000000
push 1
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x838]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 0xffffffff
je 0x40123a
push 0
lea eax, [ebp - 0x83c]
push eax
push 0x400
lea eax, [ebp - 0x730]
push eax
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0x83c], 0
jne 0x401401
jmp 0x40143f
push 0
lea eax, [ebp - 0x83c]
push eax
mov eax, dword [ebp - 0x83c]
push eax
lea eax, [ebp - 0x730]
push eax
mov eax, dword [ebp - 0x32c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 0x83c], 0x400
jae 0x40143a
jmp 0x40143f
jmp 0x4013d0
mov eax, dword [ebp - 0x32c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], 0
je 0x4014ae
mov dword [ebp - 0x328], 0
jmp 0x401475
inc dword [ebp - 0x328]
mov eax, dword [ebp - 0x328]
mov al, byte [eax + str.cscript.exe___Nologo__]
mov ecx, dword [ebp - 0x328]
mov byte [ebp + ecx - 0x730], al
mov eax, dword [ebp - 0x328]
movsx eax, byte [ebp + eax - 0x730]
test eax, eax
je 0x4014a9
jmp 0x40146f
jmp 0x4014f7
mov dword [ebp - 0x328], 0
jmp 0x4014c3
inc dword [ebp - 0x328]
mov eax, dword [ebp - 0x328]
mov al, byte [eax + str.wscript.exe__]
mov ecx, dword [ebp - 0x328]
mov byte [ebp + ecx - 0x730], al
mov eax, dword [ebp - 0x328]
movsx eax, byte [ebp + eax - 0x730]
test eax, eax
je 0x4014f7
jmp 0x4014bd
mov dword [ebp - 0x734], 0
jmp 0x40150c
inc dword [ebp - 0x328]
mov eax, dword [ebp - 0x734]
mov al, byte [ebp + eax - 0x838]
mov ecx, dword [ebp - 0x328]
mov byte [ebp + ecx - 0x730], al
inc dword [ebp - 0x734]
mov eax, dword [ebp - 0x328]
movsx eax, byte [ebp + eax - 0x730]
test eax, eax
je 0x401547
jmp 0x401506
mov dword [ebp - 0x734], 0
jmp 0x40155c
inc dword [ebp - 0x328]
mov eax, dword [ebp - 0x734]
mov al, byte [eax + 0x4020f4]
mov ecx, dword [ebp - 0x328]
mov byte [ebp + ecx - 0x730], al
inc dword [ebp - 0x734]
mov eax, dword [ebp - 0x328]
movsx eax, byte [ebp + eax - 0x730]
test eax, eax
je 0x401596
jmp 0x401556
cmp dword [ebp + 0x10], 0
je 0x401600
mov dword [ebp - 0x734], 0
jmp 0x4015b5
inc dword [ebp - 0x734]
mov eax, dword [ebp - 0x328]
mov dword [ebp - 0x898], eax
inc dword [ebp - 0x328]
mov eax, dword [ebp - 0x734]
mov ecx, dword [ebp + 0x10]
mov al, byte [eax + ecx]
mov ecx, dword [ebp - 0x898]
mov byte [ebp + ecx - 0x730], al
mov eax, dword [ebp - 0x898]
movsx eax, byte [ebp + eax - 0x730]
test eax, eax
je 0x4015fb
jmp 0x4015af
jmp 0x40160e
mov eax, dword [ebp - 0x328]
mov byte [ebp + eax - 0x731], 0
push 0x44
lea eax, [ebp - 0x880]
push eax
call fcn.0040196a
add esp, 8
push 0x10
lea eax, [ebp - 0x890]
push eax
call fcn.0040196a
add esp, 8
mov dword [ebp - 0x880], 0x44
mov dword [ebp - 0x854], 1
mov eax, dword [ebp + 0x14]
mov word [ebp - 0x850], ax
lea eax, [ebp - 0x890]
push eax
lea eax, [ebp - 0x880]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x730]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x401743
push 0
mov eax, dword [ebp - 0x890]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x40169e
jmp 0x40167f
mov eax, dword [ebp - 0x884]
push eax
push 0x4018e4
call dword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
je 0x4016dc
push 0
mov eax, dword [ebp - 0x890]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x4016d7
jmp 0x4016dc
jmp 0x40169e
push 0xffffffffffffffff
mov eax, dword [ebp - 0x890]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x328]
push eax
mov eax, dword [ebp - 0x890]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [ebp - 0x88c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x890]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x838]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x324]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 0x328]
jmp 0x4017e0
push str.Cannot_start_process
call fcn.004019ad
add esp, 4
jmp 0x401096
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.makeexe.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x401789
push str.Loading_makeexe.dll_failed
call fcn.004019ad
add esp, 4
jmp 0x4017e0
push str.MakeExe
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x330], eax
cmp dword [ebp - 0x330], 0
jne 0x4017bd
push str.MakeExe_not_found_in_makeexe.dll.
call fcn.004019ad
add esp, 4
jmp 0x4017e0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [ebp - 0x330]
mov dword [ebp - 0x328], eax
mov eax, dword [ebp - 0x328]
jmp 0x4017e0
pop edi
pop esi
pop ebx
leave
ret 0x10