Function at 0x402070
Capabilities:
Create directory
Create process on windows
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x42046c
mov eax, dword fs:[0]
push eax
sub esp, 0x4d8
mov eax, dword [0x425544]
xor eax, esp
mov dword [esp + 0x4d0], eax
push ebx
push esi
push edi
mov eax, dword [0x425544]
xor eax, esp
push eax
lea eax, [esp + 0x4e8]
mov dword fs:[0], eax
mov eax, dword [0x428074]
push eax
lea ecx, [esp + 0x3e0]
push 0x100
push ecx
call fcn.00415859
add esp, 0xc
push 8
push str._s__l__1
mov ecx, 0x426380
call fcn.00403590
sub esp, 0x1c
mov ecx, esp
xor ebx, ebx
mov edi, 0xf
lea eax, [esp + 0x3f8]
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
mov dword [esp + 0x30], esp
mov byte [ecx + 4], bl
lea esi, [eax + 1]
nop
mov dl, byte [eax]
add eax, 1
cmp dl, bl
jne 0x402100
sub eax, esi
push eax
lea edx, [esp + 0x3fc]
push edx
call fcn.00403590
lea esi, [esp + 0x2f]
call fcn.004049a0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push 1
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push 0x4230e4
mov byte [ecx + 4], bl
call fcn.00403590
call fcn.00401890
push str.IPMx
push 0x423061
mov byte [esp + 0x1b], al
call fcn.00414cd1
mov esi, eax
add esp, 8
cmp esi, ebx
jne 0x40216b
mov eax, 0x3039
jmp 0x402539
push esi
lea eax, [esp + 0x1d0]
push 0x104
push eax
call fcn.00415859
add esp, 0xc
push esi
call fcn.00414f67
mov edi, dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
add esp, 4
lea ecx, [esp + 0x1cc]
push ecx
call edi
push ebx
lea edx, [esp + 0x1d0]
push edx
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExA]
push str.IPMx
push 0x423061
call fcn.00414cd1
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x402161
push esi
lea eax, [esp + 0xc8]
push 0x104
push eax
call fcn.00415859
add esp, 0xc
push esi
call fcn.00414f67
add esp, 4
lea ecx, [esp + 0xc4]
push ecx
call edi
push ebx
lea edx, [esp + 0xc8]
push edx
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExA]
lea eax, [esp + 0xc4]
push eax
push 0x4ec
mov ecx, str.IPMres.cab
call fcn.00402560
add esp, 8
cmp eax, ebx
jne 0x402539
sub esp, 0x1c
lea edx, [esp + 0xe0]
mov ecx, esp
mov dword [esp + 0x30], esp
push edx
call fcn.00402dd0
lea esi, [esp + 0x48]
call fcn.00405a40
mov dword [esp + 0x4f0], ebx
mov dword [esp + 0xc0], 0xf
mov dword [esp + 0xbc], ebx
mov byte [esp + 0xac], bl
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x4230fc
mov byte [esp + 0x510], 1
call fcn.00402dd0
call fcn.00401890
cmp al, bl
je 0x4022b8
sub esp, 0x1c
mov dword [esp + 0x30], esp
mov esi, esp
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x4c], esp
push 0x4230fc
call fcn.00402dd0
call fcn.00401900
lea edx, [esp + 0x5c]
lea ecx, [esp + 0x48]
call fcn.00405e50
mov byte [esp + 0x4f0], 2
jmp 0x4022cd
lea eax, [esp + 0x40]
lea esi, [esp + 0x2c]
call fcn.00405ee0
mov byte [esp + 0x4f0], 3
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0xb4]
call fcn.004030b0
lea ecx, [esp + 0x40]
mov byte [esp + 0x4f0], 1
call fcn.00402e10
cmp dword [esp + 0xc0], 0x10
mov eax, dword [esp + 0xac]
jae 0x402306
lea eax, [esp + 0xac]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
jne 0x402316
mov eax, dword [0x428078]
cmp byte [esp + 0x13], bl
mov cx, word [esp + 0x3c]
mov word [0x42807c], cx
jne 0x402331
push eax
call fcn.00404470
add esp, 4
lea edx, [esp + 0x1cc]
push edx
push 0x4b0
mov ecx, str.IPM.cab
call fcn.00402560
mov edi, eax
add esp, 8
cmp edi, ebx
jne 0x402522
mov eax, dword [0x428078]
push str.EXENAME
push 0x4bc
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
cmp esi, ebx
je 0x4023ba
mov ecx, dword [0x428078]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
cmp edi, ebx
je 0x4023ba
mov edx, dword [0x428078]
push esi
push edx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
call fcn.00406797
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp eax, ebx
je 0x4023ba
push eax
push 0x104
push 0x428080
call fcn.00415859
add esp, 0xc
lea eax, [esp + 0x1cc]
push eax
lea ecx, [esp + 0x2d8]
push 0x104
push ecx
call fcn.00415859
add esp, 0xc
push 0x428080
lea edx, [esp + 0x2d8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
push 0x44
lea eax, [esp + 0x60]
push ebx
push eax
call fcn.0041a870
add esp, 0xc
xor eax, eax
push 0x423108
lea ecx, [esp + 0x2d8]
push 0x104
push ecx
mov dword [esp + 0x68], 0x44
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
call fcn.0041660d
mov edx, dword [0x428074]
add esp, 0xc
push edx
lea eax, [esp + 0x2d8]
push 0x104
push eax
call fcn.0041660d
add esp, 0xc
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x60]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0x2f4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp byte [esp + 0x13], bl
jne 0x402493
mov eax, dword [0x428298]
cmp eax, ebx
je 0x402486
push ebx
push ebx
push 0xdc5
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [0x42829c]
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov edx, dword [esp + 0x1c]
push 0xffffffffffffffff
push edx
mov dword [esp + 0x20], ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov edx, dword [esp + 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 0x20]
push eax
call esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea ecx, [esp + 0xc4]
push ecx
call esi
sub esp, 0x1c
lea edx, [esp + 0xe0]
mov ecx, esp
mov dword [esp + 0x30], esp
push edx
call fcn.00402dd0
call fcn.00402ac0
add esp, 0x1c
lea eax, [esp + 0x1cc]
push eax
call esi
sub esp, 0x1c
lea edx, [esp + 0x1e8]
mov ecx, esp
mov dword [esp + 0x30], esp
push edx
call fcn.00402dd0
call fcn.00402ac0
mov edi, dword [esp + 0x34]
add esp, 0x1c
lea ecx, [esp + 0xa8]
call fcn.00402e10
lea esi, [esp + 0x2c]
call fcn.00403020
mov eax, edi
mov ecx, dword [esp + 0x4e8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x4d0]
xor ecx, esp
call fcn.00414cc2
mov esp, ebp
pop ebp
ret