Function at 0x424e80
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Extract resource via kernel32 functions
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a3f98
mov eax, dword fs:[0]
push eax
sub esp, 0x244
mov eax, dword [0x4c3014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x100
lea eax, [ebp - 0x110]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x214]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
lea ecx, [ebp - 0x220]
mov dword [ebp - 4], 0
call dword [sym.imp.mfc140u.dll_Ordinal_296]
lea ecx, [ebp - 0x21c]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
lea ecx, [ebp - 0x218]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
push 0x104
push 0x105
lea ecx, [ebp - 0x214]
mov byte [ebp - 4], 3
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::GetBufferSetLength]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x214]
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::ReleaseBuffer]
push 0x5c
lea ecx, [ebp - 0x214]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__1]
inc eax
lea ecx, [ebp - 0x214]
push eax
lea eax, [ebp - 0x244]
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t_]
push eax
lea ecx, [ebp - 0x214]
mov byte [ebp - 4], 4
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__2]
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 3
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x21c]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__2]
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x218]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__2]
push str.libcurl.dll
lea ecx, [ebp - 0x214]
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::operator]
push 0x4b9b0c
lea ecx, [ebp - 0x220]
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::operator]
push 0x4b9b1c
lea ecx, [ebp - 0x21c]
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::operator]
push str.MapCode.ini
lea ecx, [ebp - 0x218]
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::operator]
push 0x100
lea eax, [ebp - 0x110]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x214]
lea ecx, [ebp - 0x244]
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__10]
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x244]
push 0
push 0
push 0
push 0
push dword [eax - 0xc]
lea ecx, [ebp - 0x244]
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::GetBuffer]
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push eax
push 0
push 0
call edi
mov ecx, dword [ebp - 0x244]
mov esi, eax
push 0
push 0
push esi
lea eax, [ebp - 0x110]
push eax
push dword [ecx - 0xc]
lea ecx, [ebp - 0x244]
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::GetBuffer]
push eax
push 0
push 0
call edi
lea ecx, [ebp - 0x244]
mov byte [ebp + esi - 0x110], 0
mov byte [ebp - 4], 3
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
push 0x1c
lea eax, [ebp - 0x240]
push eax
push fcn.00424e80
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov esi, dword [ebp - 0x23c]
push str.libcurldll
push 0x87
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x425338
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov dword [ebp - 0x250], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x24c], eax
lea eax, [ebp - 0x110]
push 0x4b9af0
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov ebx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 8
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov dword [ebp - 0x244], eax
test eax, eax
je 0x42511a
push eax
push dword [ebp - 0x250]
push 1
push dword [ebp - 0x24c]
call ebx
push dword [ebp - 0x244]
call edi
push dword [ebp - 0x244]
call edi
add esp, 0x18
push str.Networkdll
push 0x88
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x24c], eax
test eax, eax
je 0x4251d4
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 0x24c]
mov dword [ebp - 0x250], eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push 0x100
mov dword [ebp - 0x24c], eax
lea eax, [ebp - 0x110]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 8
lea eax, [ebp - 0x21c]
mov ecx, esp
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__10]
lea ecx, [ebp - 0x110]
call fcn.0042be40
lea eax, [ebp - 0x110]
push 0x4b9af0
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
add esp, 0xc
mov dword [ebp - 0x244], eax
test eax, eax
je 0x4251d4
push eax
push dword [ebp - 0x250]
push 1
push dword [ebp - 0x24c]
call ebx
push dword [ebp - 0x244]
call edi
push dword [ebp - 0x244]
call edi
add esp, 0x18
push str.TerSafedll
push 0x8a
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x24c], eax
test eax, eax
je 0x42528e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 0x24c]
mov dword [ebp - 0x250], eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push 0x100
mov dword [ebp - 0x24c], eax
lea eax, [ebp - 0x110]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 8
lea eax, [ebp - 0x220]
mov ecx, esp
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__10]
lea ecx, [ebp - 0x110]
call fcn.0042be40
lea eax, [ebp - 0x110]
push 0x4b9af0
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
add esp, 0xc
mov dword [ebp - 0x244], eax
test eax, eax
je 0x42528e
push eax
push dword [ebp - 0x250]
push 1
push dword [ebp - 0x24c]
call ebx
push dword [ebp - 0x244]
call edi
push dword [ebp - 0x244]
call edi
add esp, 0x18
push str.MapCodeini
push 0x89
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x24c], eax
test eax, eax
je 0x425338
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 0x24c]
mov dword [ebp - 0x250], eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push 0x100
mov dword [ebp - 0x24c], eax
lea eax, [ebp - 0x110]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 8
lea eax, [ebp - 0x218]
mov ecx, esp
lea esi, [ebp - 0x110]
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__10]
mov ecx, esi
call fcn.0042be40
mov eax, esi
push 0x4b9af0
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov esi, eax
add esp, 0xc
test esi, esi
je 0x425338
push esi
push dword [ebp - 0x250]
push 1
push dword [ebp - 0x24c]
call ebx
push esi
call edi
push esi
call edi
add esp, 0x18
lea ecx, [ebp - 0x218]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x21c]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x220]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x214]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
push 0x100
lea eax, [ebp - 0x210]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x210]
push 0
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.t1.dll
call esi
mov ebx, eax
push str.CreateObj
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.t2.dll
mov edi, eax
call esi
add eax, 0x2ce400
push str.QQTPPP2ND.dll
mov dword [0x4c52c8], eax
call esi
lea eax, [ebx + 0xa584fa]
mov dword [0x4c52d8], eax
lea ecx, [ebx + 0x35e598]
lea eax, [ebx + 0xa18094]
mov dword [0x4c52dc], ecx
mov dword [0x4c52d4], eax
lea esi, [ebx + 0xe21e1]
lea eax, [ebx + 0x9cb469]
mov dword [0x4c52d0], eax
lea eax, [ebx + 0x92a218]
push edi
mov dword [0x4c52cc], eax
call fcn.00424db0
add esp, 4
mov dword [ebp - 0x224], 0
lea eax, [ebp - 0x224]
push eax
push 0x40
push 0xa
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x24c], 0x9051118b
mov cl, 0x57
mov eax, dword [ebp - 0x24c]
mov dword [esi], eax
mov byte [esi + 4], cl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044632d
mov esp, ebp
pop ebp
ret