Function at 0x401160
Capabilities:
Create process on windows
Extract resource via kernel32 functions
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x348
mov eax, dword [0x413004]
xor eax, esp
mov dword [esp + 0x344], eax
push esi
push edi
push 0
push 1
call dword [sym.imp.KERNEL32.dll_SetThreadErrorMode]
push 0xa
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x401913
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x401913
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x401913
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
shr eax, 1
lea ecx, [esp + 0x98]
push eax
push edi
mov dword [esp + 0xa0], 0
mov dword [esp + 0xb0], 0
mov dword [esp + 0xb4], 7
call fcn.004019b0
mov edi, dword [esp + 0xa8]
cmp edi, 0x1c
jbe 0x4018d5
lea eax, [esp + 0x140]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x40132f
lea ecx, [esp + 0x140]
mov dword [esp + 0xd0], 0
mov dword [esp + 0xe0], 0
lea edx, [ecx + 2]
mov dword [esp + 0xe4], 7
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401250
sub ecx, edx
lea eax, [esp + 0x140]
sar ecx, 1
push ecx
push eax
lea ecx, [esp + 0xd8]
call fcn.004019b0
lea ecx, [esp + 0x140]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401280
sub ecx, edx
sar ecx, 1
movzx eax, word [esp + ecx*2 + 0x13e]
push eax
push 0x411c88
call fcn.00402d41
add esp, 8
test eax, eax
jne 0x40130b
mov esi, dword [esp + 0xe4]
mov eax, esi
mov edx, dword [esp + 0xe0]
sub eax, edx
cmp eax, 1
jb 0x4012ed
cmp esi, 8
lea eax, [esp + 0xd0]
lea ecx, [edx + 1]
mov esi, 0x5c
cmovae eax, dword [esp + 0xd0]
mov dword [esp + 0xe0], ecx
mov word [eax + edx*2], si
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x40130b
push 1
push 0x411c88
mov byte [esp + 0x20], 0
lea ecx, [esp + 0xd8]
push dword [esp + 0x20]
push 1
call fcn.00401be0
movaps xmm0, xmmword [esp + 0xd0]
movaps xmmword [esp + 0xb0], xmm0
movq xmm0, qword [esp + 0xe0]
movq qword [esp + 0xc0], xmm0
jmp 0x401363
push 0
push 0x411c8c
lea ecx, [esp + 0xb8]
mov dword [esp + 0xb8], 0
mov dword [esp + 0xc8], 0
mov dword [esp + 0xcc], 7
call fcn.004019b0
cmp dword [esp + 0xc0], 0
mov esi, dword [esp + 0xb0]
jbe 0x40189e
mov ecx, 0x12
mov dword [esp + 0xf8], 0
cmp edi, ecx
mov dword [esp + 0x108], 0
lea eax, [esp + 0x98]
mov dword [esp + 0x10c], 7
cmovb ecx, edi
cmp dword [esp + 0xac], 8
push ecx
cmovae eax, dword [esp + 0x9c]
lea ecx, [esp + 0xfc]
push eax
call fcn.004019b0
mov eax, dword [esp + 0xa8]
mov dword [esp + 0x34], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 7
cmp eax, 0x12
jb 0x40192b
add eax, 0xffffffee
mov ecx, 7
cmp eax, ecx
cmovb ecx, eax
cmp dword [esp + 0xac], 8
lea eax, [esp + 0x98]
cmovae eax, dword [esp + 0x98]
push ecx
add eax, 0x24
lea ecx, [esp + 0x38]
push eax
call fcn.004019b0
push str..exe
lea edx, [esp + 0x38]
lea ecx, [esp + 0x114]
call fcn.00401b20
mov edx, dword [esp + 0x4c]
add esp, 4
cmp edx, 8
jb 0x401476
mov ecx, dword [esp + 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40146c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401930
push edx
push ecx
call fcn.00401ff9
add esp, 8
mov eax, dword [esp + 0xa8]
mov dword [esp + 0x128], 0
mov dword [esp + 0x138], 0
mov dword [esp + 0x13c], 7
cmp eax, 0x19
jb 0x401935
add eax, 0xffffffe7
or ecx, 0xffffffff
cmp eax, 0xffffffff
cmovb ecx, eax
cmp dword [esp + 0xac], 8
lea eax, [esp + 0x98]
cmovae eax, dword [esp + 0x98]
push ecx
add eax, 0x32
lea ecx, [esp + 0x12c]
push eax
call fcn.004019b0
mov ecx, 0x7ffffffe
mov dword [esp + 0x18], 1
sub ecx, dword [esp + 0xc0]
lea edi, [esp + 0x110]
mov dword [esp + 0x54], ecx
nop word [eax + eax]
mov eax, dword [esp + 0x108]
mov dword [esp + 0x4c], eax
cmp ecx, eax
jb 0x401944
cmp dword [esp + 0xc4], 8
lea edx, [esp + 0xb0]
lea ecx, [esp + 0xf8]
mov dword [esp + 0x34], 0
cmovae edx, esi
mov dword [esp + 0x44], 0
cmp dword [esp + 0x10c], 8
mov esi, 7
mov dword [esp + 0x1c], edx
cmovae ecx, dword [esp + 0xf8]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0xc0]
add ecx, eax
mov dword [esp + 0x48], 0
mov dword [esp + 0x14], ecx
lea eax, [esp + 0x34]
mov dword [esp + 0x10], eax
cmp ecx, esi
jbe 0x40160b
mov esi, ecx
or esi, 7
cmp esi, 0x7ffffffe
jbe 0x401597
mov esi, 0x7ffffffe
mov eax, 0xfffffffe
jmp 0x4015b9
cmp esi, 0xa
mov eax, 0xa
cmovb esi, eax
lea eax, [esi + 1]
cmp eax, 0x7fffffff
ja 0x40193a
add eax, eax
cmp eax, 0x1000
jb 0x4015ea
lea ecx, [eax + 0x23]
cmp ecx, eax
jbe 0x40193a
push ecx
call fcn.00401eb4
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x401930
mov edx, dword [esp + 0x1c]
lea eax, [ecx + 0x23]
and eax, 0xffffffe0
mov dword [eax - 4], ecx
mov ecx, dword [esp + 0x14]
jmp 0x401603
test eax, eax
je 0x401601
push eax
call fcn.00401eb4
mov ecx, dword [esp + 0x18]
add esp, 4
mov edx, dword [esp + 0x1c]
jmp 0x401603
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x44], ecx
mov ecx, dword [esp + 0xc0]
mov dword [esp + 0x48], esi
lea esi, [ecx + ecx]
push esi
push edx
push eax
call fcn.004036d0
mov eax, dword [esp + 0x58]
add esp, 0xc
add eax, eax
push eax
mov eax, dword [esp + 0x14]
push dword [esp + 0x24]
add eax, esi
push eax
call fcn.004036d0
mov eax, dword [esp + 0x1c]
add esp, 0xc
mov ecx, dword [esp + 0x14]
xor edx, edx
push 0x411c88
mov word [eax + ecx*2], dx
lea edx, [esp + 0x38]
lea ecx, [esp + 0x5c]
call fcn.00401b20
add esp, 4
mov dword [esp + 0x10], edi
cmp dword [edi + 0x14], 8
mov esi, eax
jb 0x401677
mov eax, dword [edi]
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x14]
mov edx, dword [esi + 0x10]
sub eax, edx
mov ecx, dword [edi + 0x10]
cmp ecx, eax
ja 0x4016c8
cmp dword [esi + 0x14], 8
lea eax, [edx + ecx]
mov dword [esp + 0x20], eax
mov dword [esi + 0x10], eax
mov dword [esp + 0x14], esi
jb 0x4016a0
mov eax, dword [esi]
mov dword [esp + 0x14], eax
lea eax, [ecx + ecx]
push eax
mov eax, dword [esp + 0x18]
push dword [esp + 0x14]
lea eax, [eax + edx*2]
push eax
call fcn.004036d0
mov eax, dword [esp + 0x20]
add esp, 0xc
mov ecx, dword [esp + 0x20]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x4016e0
push ecx
push dword [esp + 0x14]
mov byte [esp + 0x58], 0
push dword [esp + 0x58]
push ecx
mov ecx, esi
call fcn.00401be0
mov esi, eax
movups xmm0, xmmword [esi]
xor eax, eax
movq xmm1, qword [esi + 0x10]
mov word [esi], ax
lea eax, [esp + 0x70]
movaps xmmword [esp + 0xd0], xmm0
movaps xmmword [esp + 0x70], xmm0
movq qword [esp + 0x20], xmm1
movq qword [esp + 0x80], xmm1
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
cmp edi, eax
je 0x401777
mov ecx, dword [edi + 0x14]
cmp ecx, 8
jb 0x401766
mov eax, dword [edi]
lea ecx, [ecx*2 + 2]
cmp ecx, 0x1000
jb 0x40174e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401930
mov eax, edx
push ecx
push eax
call fcn.00401ff9
movaps xmm0, xmmword [esp + 0xd8]
add esp, 8
movq xmm1, qword [esp + 0x20]
mov dword [edi + 0x10], 0
movups xmmword [edi], xmm0
movq qword [edi + 0x10], xmm1
jmp 0x4017b6
mov edx, dword [esp + 0x84]
cmp edx, 8
jb 0x4017b6
mov ecx, dword [esp + 0x70]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4017ac
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401930
push edx
push ecx
call fcn.00401ff9
add esp, 8
mov edx, dword [esp + 0x6c]
cmp edx, 8
jb 0x4017f2
mov ecx, dword [esp + 0x58]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4017e8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401930
push edx
push ecx
call fcn.00401ff9
add esp, 8
mov edx, dword [esp + 0x48]
xor eax, eax
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 7
mov word [esp + 0x58], ax
cmp edx, 8
jb 0x401845
mov ecx, dword [esp + 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40183b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401930
push edx
push ecx
call fcn.00401ff9
add esp, 8
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x40184f
mov eax, dword [edi]
push 1
push 0
push 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [esp + 0x18]
add edi, 0x18
inc ecx
mov dword [esp + 0x18], ecx
cmp ecx, 3
jge 0x401881
mov esi, dword [esp + 0xb0]
mov ecx, dword [esp + 0x54]
jmp 0x401500
push 0x401950
push 3
push 0x18
lea eax, [esp + 0x104]
push eax
call fcn.00401ee4
mov esi, dword [esp + 0xb0]
mov eax, dword [esp + 0xc4]
cmp eax, 8
jb 0x4018d5
lea ecx, [eax*2 + 2]
mov eax, esi
cmp ecx, 0x1000
jb 0x4018cb
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40193f
push ecx
push esi
call fcn.00401ff9
add esp, 8
mov edx, dword [esp + 0xac]
cmp edx, 8
jb 0x401913
mov ecx, dword [esp + 0x98]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x401909
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40193f
push edx
push ecx
call fcn.00401ff9
add esp, 8
mov ecx, dword [esp + 0x34c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.00401ea6
mov esp, ebp
pop ebp
ret 0x10
call fcn.00401b10
call fcn.00403e3c
call fcn.00401b10
call fcn.004010b0
call fcn.00403e3c
call fcn.00401150
int3