Function at 0x401205
Capabilities:
Accept command line arguments
Create process on windows
Extract resource via kernel32 functions
Get common file path
Query or enumerate registry value
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9b8
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x390], eax
push 0x104
lea eax, [ebp - 0x968]
push eax
push 0x72
mov ecx, dword [ebp - 0x390]
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
lea edx, [ebp - 0x968]
push edx
call section..text
add esp, 4
test eax, eax
jne 0x4012a0
push 0x104
lea eax, [ebp - 0x968]
push eax
push 0x77
mov ecx, dword [ebp - 0x390]
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
push 0x104
lea edx, [ebp - 0x494]
push edx
push 0x76
mov eax, dword [ebp - 0x390]
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
push 0x10
lea ecx, [ebp - 0xff68]
push ecx
lea edx, [ebp - 0x494]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 0x9ac], 0
mov dword [ebp - 0x9a8], 0
mov word [ebp - 0x97e], 0
mov dword [ebp - 0x97c], 0
mov dword [ebp - 0x9a4], 0
mov dword [ebp - 0x9a0], 0
mov dword [ebp - 0x99c], 0
mov dword [ebp - 0x998], 0
mov dword [ebp - 0x994], 0
mov dword [ebp - 0x990], 0
mov dword [ebp - 0x98c], 0
mov dword [ebp - 0x988], 0
mov word [ebp - 0x980], 5
mov dword [ebp - 0x978], 0xffffffff
mov dword [ebp - 0x9b0], 0x44
mov dword [ebp - 0x984], 1
mov dword [ebp - 0x4d4], 0
mov dword [ebp - 0x4d0], 1
mov dword [ebp - 0x4d8], 0xc
mov dword [ebp - 0x4cc], 0
mov dword [ebp - 0x4c8], 0x64
mov dword [ebp - 0x858], 0x64
mov dword [ebp - 0x374], 1
mov dword [ebp - 0x49c], 0
push 0x104
lea eax, [ebp - 0x968]
push eax
push 0x67
mov ecx, dword [ebp - 0x390]
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
push 0
lea edx, [ebp - 0x4dc]
push edx
push 0
push 0x20019
push 0
push 0
push 0
lea eax, [ebp - 0x968]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4014a1
push 0x104
lea ecx, [ebp - 0x968]
push ecx
push 0x68
mov edx, dword [ebp - 0x390]
push edx
call dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [ebp - 0x858]
push eax
lea ecx, [ebp - 0x64]
push ecx
lea edx, [ebp - 0x374]
push edx
push 0
lea eax, [ebp - 0x4c8]
push eax
lea ecx, [ebp - 0x748]
push ecx
mov edx, dword [ebp - 0x4cc]
mov dword [ebp - 0x9b8], edx
mov eax, dword [ebp - 0x9b8]
push eax
mov ecx, dword [ebp - 0x4dc]
push ecx
mov edx, dword [ebp - 0x4cc]
add edx, 1
mov dword [ebp - 0x4cc], edx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
je 0x401457
cmp dword [ebp - 0x68], 0xea
jne 0x401494
lea eax, [ebp - 0x968]
push eax
lea ecx, [ebp - 0x748]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x40147b
mov dword [ebp - 0x49c], 1
jmp 0x401494
mov dword [ebp - 0x4c8], 0x64
mov dword [ebp - 0x858], 0x64
jmp 0x4013f4
mov edx, dword [ebp - 0x4dc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x49c], 0
je 0x4014bd
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x494]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x4014f3
push 0x104
lea edx, [ebp - 0x968]
push edx
push 0x69
mov eax, dword [ebp - 0x390]
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
push 0
push 0
lea ecx, [ebp - 0x968]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x104
lea edx, [ebp - 0x968]
push edx
push 0x70
mov eax, dword [ebp - 0x390]
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
lea ecx, [ebp - 0x968]
push ecx
push 0x78
mov edx, dword [ebp - 0x390]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x860], eax
cmp dword [ebp - 0x860], 0
je 0x401573
mov eax, dword [ebp - 0x860]
push eax
mov ecx, dword [ebp - 0x390]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x854], eax
cmp dword [ebp - 0x854], 0
je 0x401573
mov edx, dword [ebp - 0x854]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
lea eax, [ebp - 0x4c4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x4015a9
push 0x104
lea ecx, [ebp - 0x968]
push ecx
push 0x71
mov edx, dword [ebp - 0x390]
push edx
call dword [sym.imp.USER32.dll_LoadStringA]
push 0
push 0
lea eax, [ebp - 0x968]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
movsx ecx, byte [ebp - 0x4c4]
cmp ecx, 0x49
jne 0x4015bd
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 0x370], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp - 0x9b4], eax
mov edx, dword [ebp - 0x9b4]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x38c], eax
mov eax, dword [ebp - 0x38c]
add eax, 1
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x864], eax
cmp dword [ebp - 0x864], 0
je 0x4018e4
mov ecx, dword [ebp - 0x9b4]
push ecx
mov edx, dword [ebp - 0x864]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp - 0x864]
movsx ecx, byte [eax]
cmp ecx, 0x22
jne 0x4016a9
mov edx, dword [ebp - 0x864]
add edx, 1
mov dword [ebp - 0x864], edx
mov eax, dword [ebp - 0x864]
mov dword [ebp - 0x370], eax
mov ecx, dword [ebp - 0x864]
movsx edx, byte [ecx]
test edx, edx
je 0x40167b
mov eax, dword [ebp - 0x864]
movsx ecx, byte [eax]
cmp ecx, 0x22
je 0x40167b
mov edx, dword [ebp - 0x864]
add edx, 1
mov dword [ebp - 0x864], edx
jmp 0x40164f
mov eax, dword [ebp - 0x864]
movsx ecx, byte [eax]
test ecx, ecx
je 0x4016a2
mov edx, dword [ebp - 0x864]
mov byte [edx], 0
mov eax, dword [ebp - 0x864]
add eax, 1
mov dword [ebp - 0x864], eax
jmp 0x4016a7
jmp 0x401b68
jmp 0x401717
mov ecx, dword [ebp - 0x864]
mov dword [ebp - 0x370], ecx
mov edx, dword [ebp - 0x864]
movsx eax, byte [edx]
test eax, eax
je 0x4016f2
mov ecx, dword [ebp - 0x864]
movsx edx, byte [ecx]
cmp edx, 0x20
je 0x4016f2
mov eax, dword [ebp - 0x864]
movsx ecx, byte [eax]
cmp ecx, 0x5c74
je 0x4016f2
mov edx, dword [ebp - 0x864]
add edx, 1
mov dword [ebp - 0x864], edx
jmp 0x4016b5
mov eax, dword [ebp - 0x864]
movsx ecx, byte [eax]
test ecx, ecx
je 0x401717
mov edx, dword [ebp - 0x864]
mov byte [edx], 0
mov eax, dword [ebp - 0x864]
add eax, 1
mov dword [ebp - 0x864], eax
mov dword [ebp - 0x378], 1
mov ecx, 1
test ecx, ecx
je 0x4018e2
mov edx, dword [ebp - 0x864]
movsx eax, byte [edx]
test eax, eax
je 0x401749
mov ecx, dword [ebp - 0x864]
movsx edx, byte [ecx]
cmp edx, 0x20
je 0x40175a
mov eax, dword [ebp - 0x864]
movsx ecx, byte [eax]
cmp ecx, 0x5c74
jne 0x40176b
mov edx, dword [ebp - 0x864]
add edx, 1
mov dword [ebp - 0x864], edx
jmp 0x40172e
mov eax, dword [ebp - 0x864]
movsx ecx, byte [eax]
test ecx, ecx
jne 0x40177d
jmp 0x4018e2
mov edx, dword [ebp - 0x864]
movsx eax, byte [edx]
cmp eax, 0x22
jne 0x401839
mov ecx, dword [ebp - 0x864]
add ecx, 1
mov dword [ebp - 0x864], ecx
mov edx, dword [ebp - 0x378]
mov eax, dword [ebp - 0x864]
mov dword [ebp + edx*4 - 0x370], eax
mov ecx, dword [ebp - 0x378]
add ecx, 1
mov dword [ebp - 0x378], ecx
mov edx, dword [ebp - 0x378]
mov dword [ebp + edx*4 - 0x370], 0
mov eax, dword [ebp - 0x864]
movsx ecx, byte [eax]
test ecx, ecx
je 0x4017fd
mov edx, dword [ebp - 0x864]
movsx eax, byte [edx]
cmp eax, 0x22
je 0x4017fd
mov ecx, dword [ebp - 0x864]
add ecx, 1
mov dword [ebp - 0x864], ecx
jmp 0x4017d1
mov edx, dword [ebp - 0x864]
movsx eax, byte [edx]
test eax, eax
jne 0x40180f
jmp 0x4018e2
mov ecx, dword [ebp - 0x864]
movsx edx, byte [ecx]
test edx, edx
je 0x401834
mov eax, dword [ebp - 0x864]
mov byte [eax], 0
mov ecx, dword [ebp - 0x864]
add ecx, 1
mov dword [ebp - 0x864], ecx
jmp 0x4018dd
mov edx, dword [ebp - 0x378]
mov eax, dword [ebp - 0x864]
mov dword [ebp + edx*4 - 0x370], eax
mov ecx, dword [ebp - 0x378]
add ecx, 1
mov dword [ebp - 0x378], ecx
mov edx, dword [ebp - 0x378]
mov dword [ebp + edx*4 - 0x370], 0
mov eax, dword [ebp - 0x864]
movsx ecx, byte [eax]
test ecx, ecx
je 0x4018a9
mov edx, dword [ebp - 0x864]
movsx eax, byte [edx]
cmp eax, 0x20
je 0x4018a9
mov ecx, dword [ebp - 0x864]
movsx edx, byte [ecx]
cmp edx, 0x5c74
je 0x4018a9
mov eax, dword [ebp - 0x864]
add eax, 1
mov dword [ebp - 0x864], eax
jmp 0x40186c
mov ecx, dword [ebp - 0x864]
movsx edx, byte [ecx]
test edx, edx
jne 0x4018b8
jmp 0x4018e2
mov eax, dword [ebp - 0x864]
movsx ecx, byte [eax]
test ecx, ecx
je 0x4018dd
mov edx, dword [ebp - 0x864]
mov byte [edx], 0
mov eax, dword [ebp - 0x864]
add eax, 1
mov dword [ebp - 0x864], eax
jmp 0x401721
jmp 0x40191a
push 0x104
lea ecx, [ebp - 0x968]
push ecx
push 0x6b
mov edx, dword [ebp - 0x390]
push edx
call dword [sym.imp.USER32.dll_LoadStringA]
push 0
push 0
lea eax, [ebp - 0x968]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 0x96c], 0
push 0x104
lea ecx, [ebp - 0x968]
push ecx
push 0x6e
mov edx, dword [ebp - 0x390]
push edx
call dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [ebp - 0x16c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x4019a4
lea ecx, [ebp - 0x850]
push ecx
push 0
lea edx, [ebp - 0x968]
push edx
lea eax, [ebp - 0x16c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x4019a4
push 0
push 0x80000080
push 2
push 0
push 1
push 0x40000000
lea ecx, [ebp - 0x850]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x96c], eax
cmp dword [ebp - 0x96c], 0
jne 0x4019da
push 0x104
lea edx, [ebp - 0x968]
push edx
push 0x6c
mov eax, dword [ebp - 0x390]
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
push 0
push 0
lea ecx, [ebp - 0x968]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x104
lea edx, [ebp - 0x968]
push edx
push 0x6d
mov eax, dword [ebp - 0x390]
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
push 0
lea ecx, [ebp - 0x498]
push ecx
lea edx, [ebp - 0x4c4]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x4c4]
push eax
mov ecx, dword [ebp - 0x96c]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea edx, [ebp - 0x498]
push edx
push 1
lea eax, [ebp - 0x968]
push eax
mov ecx, dword [ebp - 0x96c]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x85c], 1
jmp 0x401a5a
mov edx, dword [ebp - 0x85c]
add edx, 1
mov dword [ebp - 0x85c], edx
mov eax, dword [ebp - 0x85c]
cmp eax, dword [ebp - 0x378]
jge 0x401ac2
push 0
lea ecx, [ebp - 0x498]
push ecx
mov edx, dword [ebp - 0x85c]
mov eax, dword [ebp + edx*4 - 0x370]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov ecx, dword [ebp - 0x85c]
mov edx, dword [ebp + ecx*4 - 0x370]
push edx
mov eax, dword [ebp - 0x96c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [ebp - 0x498]
push ecx
push 1
lea edx, [ebp - 0x968]
push edx
mov eax, dword [ebp - 0x96c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x401a4b
mov byte [ebp - 0x74c], 0x1a
push 0
lea ecx, [ebp - 0x498]
push ecx
push 1
lea edx, [ebp - 0x74c]
push edx
mov eax, dword [ebp - 0x96c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 0x96c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x104
lea edx, [ebp - 0x968]
push edx
push 0x66
mov eax, dword [ebp - 0x390]
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
lea ecx, [ebp - 0x850]
push ecx
lea edx, [ebp - 0x494]
push edx
lea eax, [ebp - 0x968]
push eax
lea ecx, [ebp - 0x6e4]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea edx, [ebp - 0x388]
push edx
lea eax, [ebp - 0x9b0]
push eax
push 0
push 0
push 0x10
push 1
push 0
push 0
lea ecx, [ebp - 0x6e4]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x4018e4