Function at 0x40d380
Capabilities:
Accept command line arguments
Create process on windows
Extract resource via kernel32 functions
Set environment variable
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ecx, 0x1000
mov edx, str.TEMPonefile_PID_TIME
mov eax, 0x4290a0
push edi
push esi
push ebx
sub esp, 0x27c
call fcn.00407710
test al, al
je 0x40ddd2
mov dword [esp + 4], 1
mov dword [esp], 0x4083a0
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
sub esp, 8
test eax, eax
je 0x40de5f
mov dword [esp + 8], 0xa
mov dword [esp + 4], 0x1b
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
sub esp, 0xc
mov ebx, eax
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
sub esp, 8
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
sub esp, 4
mov dword [0x429090], eax
mov dword [esp + 4], ebx
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [0x42908c], 0
mov dword [0x429088], eax
mov edi, eax
mov eax, dword [0x429090]
sub esp, 8
cmp byte [eax], 0x4b
lea ebp, [eax + 3]
movzx ecx, byte [eax + 2]
setne dl
cmp byte [eax + 1], 0x41
mov dword [0x429090], ebp
setne al
or dl, al
jne 0x40de55
cmp cl, 0x59
jne 0x40de55
mov dword [esp], 0x20000
mov dword [0x42c0a8], 0
call sub.msvcrt.dll_malloc
mov dword [0x42c0b4], eax
test eax, eax
je 0x40ddc8
mov dword [esp], 0x27420
call sub.msvcrt.dll_malloc
mov esi, eax
test eax, eax
je 0x40ddbe
mov dword [eax + 0x736c], 0
mov dword [eax + 0x7370], 0
mov dword [eax + 0x7374], 0
mov dword [eax + 0x7380], 0
mov dword [eax + 0x738c], 0
mov dword [eax + 0x7388], 0
mov dword [eax + 0x72b8], 0
mov dword [eax + 0x7394], 0
mov dword [eax + 0x7398], 0
mov dword [eax + 0x73a0], 0
mov dword [eax + 0x73a4], 0
mov dword [eax + 0x73b4], 0
mov dword [eax + 0x739c], 0
mov dword [eax + 0x73c4], 0
mov dword [eax + 0x73c8], 0
mov dword [eax + 0x73d4], 0
mov dword [eax + 0x2741c], 0
xor eax, eax
cpuid
xor ecx, ecx
cmp eax, 6
ja 0x40d933
mov dword [esi + 0x7384], ecx
mov dword [esi + 0x735c], 0
mov dword [esi + 0x73ac], 0x8000001
mov dword [esi + 0x73d8], 0
mov dword [esi + 0x7360], 0
mov dword [esi + 0x7364], 1
mov dword [0x42c0a4], esi
mov dword [0x42c0a8], ebp
mov dword [0x42c0b0], 0
mov dword [0x42c0ac], edi
mov byte [0x429080], 1
mov ebp, 0x428880
mov ebx, dword [0x42c0b8]
mov edi, dword [0x42c0bc]
mov dword [esp + 0x4c], ebp
lea esi, [esi]
lea eax, [esp + 0x170]
xor edx, edx
mov esi, 2
mov dword [esp + 0x3c], eax
lea esi, [esi]
mov eax, ebx
sub eax, edi
jne 0x40d64d
mov ebp, dword [0x42c0b0]
mov ecx, dword [0x42c0ac]
cmp ebp, ecx
setb al
or dl, al
je 0x40d6b0
mov eax, dword [0x42c0a4]
mov dword [0x42c0bc], 0
mov dword [0x42c0b8], 0x20000
call fcn.0040c020
mov ebx, dword [0x42c0bc]
cmp dword [0x42c0b8], ebx
sete dl
cmp eax, 0xffffff88
ja 0x40d6b8
xor edi, edi
mov eax, ebx
mov dword [0x42c0b8], ebx
mov dword [0x42c0bc], 0
sub eax, edi
je 0x40d5e6
cmp eax, esi
mov byte [esp + 0x48], dl
cmova eax, esi
mov ebp, eax
mov eax, dword [0x42c0b4]
mov dword [esp + 8], ebp
add eax, edi
add edi, ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
add dword [esp + 0x3c], ebp
sub esi, ebp
movzx edx, byte [esp + 0x48]
mov dword [0x42c0bc], edi
jne 0x40d5e0
movzx eax, word [esp + 0x170]
mov esi, dword [esp + 0x4c]
mov word [esi], ax
test ax, ax
je 0x40d6c2
add esi, 2
mov dword [esp + 0x4c], esi
jmp 0x40d5c8
cmp ebp, ecx
je 0x40d5e0
mov eax, str.Error__couldnt_decode_attached_data.
call fcn.00407f70
movzx ecx, word [0x428880]
test cx, cx
je 0x40d947
movzx edx, word [0x4290a0]
xor esi, esi
mov eax, 2
mov word [0x426880], si
test dx, dx
jne 0x40d706
jmp 0x40d929
add eax, 2
cmp eax, 0x2002
je 0x415124
mov word [eax + 0x42687e], dx
movzx edx, word [eax + 0x4290a0]
test dx, dx
jne 0x40d6f8
add eax, 0x426880
xor ebx, ebx
mov word [eax], bx
cmp word [0x426880], 0
je 0x40d91f
mov edx, 0x1000
mov eax, 0x426880
lea esi, [esi]
nop
add eax, 2
sub edx, 1
cmp word [eax], 0
jne 0x40d740
test edx, edx
je 0x40deb4
mov dword [eax], 0x5c
cmp word [0x426880], 0
je 0x40d910
mov edx, 0x1000
mov eax, 0x426880
lea esi, [esi]
add eax, 2
sub edx, 1
cmp word [eax], 0
jne 0x40d778
test edx, edx
je 0x40deaf
mov ebx, 0x428880
jmp 0x40d7a0
test edx, edx
je 0x40deaa
add ebx, 2
mov word [eax], cx
add eax, 2
sub edx, 1
movzx ecx, word [ebx]
test cx, cx
jne 0x40d798
xor edx, edx
cmp word [0x426080], 0
mov word [eax], dx
je 0x40d8c6
mov edx, 8
lea eax, [esp + 0x170]
call fcn.0040d290
mov esi, dword [esp + 0x170]
mov edi, dword [esp + 0x174]
call fcn.00408180
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 2
mov dword [esp + 4], 0x40000000
mov dword [esp], 0x426880
call dword [sym.imp.KERNEL32.dll_CreateFileW]
sub esp, 0x1c
mov ebx, eax
cmp eax, 0xffffffff
jne 0x40d8af
jmp 0x40de24
xor eax, eax
mov edx, 0x8000
mov ecx, eax
cmp edx, esi
sbb ecx, edi
cmovae eax, edi
cmovae edx, esi
mov dword [esp + 0x44], eax
mov eax, 0x41c040
mov dword [esp + 0x40], edx
call fcn.0040d290
lea eax, [esp + 0x170]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x170], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 0x41c040
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
test eax, eax
je 0x40de06
sub esi, dword [esp + 0x40]
sbb edi, dword [esp + 0x44]
mov eax, esi
or eax, edi
jne 0x40d840
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
jmp 0x40d5af
movzx edx, word [0x426880]
mov eax, 2
test dx, dx
jne 0x40d8ee
jmp 0x40ddb4
add eax, 2
cmp eax, 0x2002
je 0x415124
mov word [eax + 0x42607e], dx
movzx edx, word [eax + 0x426880]
test dx, dx
jne 0x40d8e0
add eax, 0x426080
xor ebp, ebp
mov word [eax], bp
jmp 0x40d7c7
mov eax, 0x426880
mov edx, 0x1000
jmp 0x40d78c
mov eax, 0x426880
jmp 0x40d754
mov eax, 0x426880
jmp 0x40d71e
mov eax, 7
cpuid
mov ecx, ebx
shr ecx, 8
and ecx, 1
jmp 0x40d554
mov ebx, dword [0x42c0a4]
test ebx, ebx
je 0x40da0d
mov edi, dword [ebx + 0x7380]
test edi, edi
jne 0x40da0d
mov eax, dword [ebx + 0x7374]
mov esi, dword [ebx + 0x7388]
mov edi, dword [ebx + 0x7370]
mov dword [esp + 0x3c], eax
test esi, esi
je 0x40d9b5
mov eax, dword [esi]
mov ebp, dword [esi + 0x6ab4]
mov edx, dword [esi + 0x6ab8]
test eax, eax
je 0x40ddf1
test ebp, ebp
je 0x40de9d
mov dword [esp], edx
mov dword [esp + 0x48], edx
mov dword [esp + 4], eax
call ebp
mov edx, dword [esp + 0x48]
mov dword [esp + 4], esi
mov dword [esp], edx
call ebp
mov dword [ebx + 0x7388], 0
mov eax, dword [ebx + 0x73a0]
mov dword [ebx + 0x738c], 0
mov dword [ebx + 0x7398], 0
test eax, eax
je 0x40dddc
test edi, edi
je 0x40de90
mov dword [esp + 4], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call edi
mov dword [ebx + 0x73a0], 0
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call edi
mov eax, dword [0x42c0b4]
xor esi, esi
mov ebp, pe_nt_image_headers32
lea edi, [esp + 0x170]
mov dword [esp], eax
call sub.msvcrt.dll_free
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 8], 0x41710c
mov dword [esp + 0xc], eax
lea eax, [esp + 0xf0]
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp], eax
call fcn.00401ad0
mov word [esp + 0x170], si
movzx esi, byte [esp + 0xf0]
mov eax, esi
test al, al
je 0x40dae2
cmp word [edi], 0
mov eax, ebp
mov ebx, edi
je 0x40da84
lea esi, [esi]
add ebx, 2
sub eax, 1
cmp word [ebx], 0
jne 0x40da78
test eax, eax
je 0x415124
mov dword [esp], ebx
add edi, 2
call sub.msvcrt.dll_wcslen
mov ecx, esi
lea esi, [esp + 0xa0]
mov dword [esp + 8], 2
lea eax, [ebx + eax*2]
mov dword [esp + 4], esi
mov dword [esp], eax
mov byte [esp + 0xa0], cl
mov byte [esp + 0xa1], 0
call sub.msvcrt.dll_mbstowcs
mov edx, 1
lea eax, [ebp - 1]
sub edx, ebp
movzx esi, byte [esp + edx + 0x170]
mov ecx, esi
test cl, cl
je 0x40dae2
mov ebp, eax
jmp 0x40da67
xor ebx, ebx
lea ecx, [esp + 0x50]
mov ebp, 0x28
mov edx, 0x4e
mov word [esp + 0x50], bx
mov edi, ecx
lea esi, [esp + 0xa0]
cmp word [edi], 0
mov eax, ebp
mov ebx, edi
je 0x40db1c
lea esi, [esi]
add ebx, 2
sub eax, 1
cmp word [ebx], 0
jne 0x40db10
mov byte [esp + 0x3c], dl
test eax, eax
je 0x415124
mov dword [esp], ebx
add edi, 2
call sub.msvcrt.dll_wcslen
mov dword [esp + 4], esi
movzx edx, byte [esp + 0x3c]
lea eax, [ebx + eax*2]
mov dword [esp + 8], 2
mov dword [esp], eax
mov byte [esp + 0xa0], dl
mov byte [esp + 0xa1], 0
call sub.msvcrt.dll_mbstowcs
mov edx, 1
lea eax, [ebp - 1]
lea ecx, [esp + 0x50]
sub edx, ebp
movzx edx, byte [edx + 0x417354]
test dl, dl
je 0x40db7b
mov ebp, eax
jmp 0x40db00
lea eax, [esp + 0x170]
mov dword [esp], ecx
mov ebx, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [esp + 4], eax
call ebx
sub esp, 8
mov dword [esp + 8], 0x1001
mov dword [esp + 4], 0x424060
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, 0x424060
sub esp, 0xc
cmp word [0x424060], 0
je 0x40dbe0
add eax, 2
cmp word [eax], 0
je 0x40dbe0
cmp eax, 0x426062
jne 0x40dbc3
jmp 0x415124
xor edx, edx
xor ecx, ecx
mov ebp, 0x28
mov edi, esi
mov word [eax], dx
mov edx, 0x4e
mov word [esp + 0xa0], cx
mov ecx, ebx
cmp word [edi], 0
mov eax, ebp
mov ebx, edi
je 0x40dc1c
lea esi, [esi]
nop
add ebx, 2
sub eax, 1
cmp word [ebx], 0
jne 0x40dc10
mov dword [esp + 0x48], ecx
mov byte [esp + 0x3c], dl
test eax, eax
je 0x415124
mov dword [esp], ebx
add edi, 2
call sub.msvcrt.dll_wcslen
lea ecx, [esp + 0x170]
mov dword [esp + 8], 2
movzx edx, byte [esp + 0x3c]
lea eax, [ebx + eax*2]
mov dword [esp + 4], ecx
mov dword [esp], eax
mov byte [esp + 0x170], dl
mov byte [esp + 0x171], 0
call sub.msvcrt.dll_mbstowcs
mov edx, 1
mov ecx, dword [esp + 0x48]
lea eax, [ebp - 1]
sub edx, ebp
movzx edx, byte [edx + 0x41736a]
test dl, dl
je 0x40dc89
mov ebp, eax
jmp 0x40dbfd
mov dword [esp + 4], 0x424060
mov dword [esp], esi
call ecx
xor eax, eax
mov ecx, 0x10
sub esp, 8
lea edx, [esp + 0x174]
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [esp + 0x170], 0x44
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [esp + 0xf0]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x170]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x20
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0x426080
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
sub esp, 0x28
test eax, eax
je 0x40de69
mov eax, dword [esp + 0xf4]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp], eax
call ebx
sub esp, 4
mov eax, dword [esp + 0xf0]
mov dword [esp + 0xa0], 0
mov dword [0x424040], eax
test eax, eax
je 0x40dd9d
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x424040]
sub esp, 8
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
sub esp, 8
test eax, eax
jne 0x40dd86
mov dword [esp + 0xa0], 1
mov eax, dword [0x424040]
mov dword [esp], eax
call ebx
mov dword [0x424040], 0
sub esp, 4
call fcn.00408240
mov eax, dword [esp + 0xa0]
add esp, 0x27c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 0x426080
jmp 0x40d906
mov dword [0x42c0a4], 0
mov eax, str.Error__couldnt_allocate_memory.
call fcn.00407f70
mov eax, str.TEMPonefile_PID_TIME
call fcn.00407ec0
test edi, edi
jne 0x40da00
mov dword [esp], ebx
call sub.msvcrt.dll_free
jmp 0x40da0d
test ebp, ebp
jne 0x40d9ac
mov dword [esp], esi
call sub.msvcrt.dll_free
jmp 0x40d9b5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov eax, str.Error__couldnt_unpack_file_to_target_path.
call fcn.00407ef0
mov dword [esp], 2
call sub.msvcrt.dll_exit
mov dword [esp], 2
call dword [0x416054]
mov dword [esp + 8], 0x426880
mov dword [esp + 4], str.Error__failed_to_open__ls_for_writing._n
mov dword [esp], eax
call fcn.00401aa0
mov dword [esp], 2
call sub.msvcrt.dll_exit
mov eax, str.Error__couldnt_find_attached_data_header.
call fcn.00407f70
mov eax, str.Error__failed_to_register_signal_handler.
call fcn.00407f70
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov eax, str.Error__couldnt_launch_child
call fcn.00407ef0
mov dword [esp], 2
call sub.msvcrt.dll_exit
lea esi, [esi]
nop
mov dword [esp], eax
call sub.msvcrt.dll_free
jmp 0x40dde4
mov dword [esp], eax
call sub.msvcrt.dll_free
jmp 0x40ddf9
jmp 0x415124
jmp 0x415124
jmp 0x415124
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
jmp fcn.004014c0