Function at 0x401000
Capabilities:
Check if file exists
Create process on windows
Create process suspended
Extract resource via kernel32 functions
Get common file path
Get file attributes
Write and execute a file
Write file on windows

Disassembly:
mov eax, 0x12a0
call fcn.0040d590
push ebx
push ebp
push esi
push edi
push 0x30c
lea eax, [esp + 0x378]
mov ebp, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
xor edx, edx
nop word [eax + eax]
mov al, byte [esp + edx + 0x374]
lea edx, [edx + 1]
mov byte [esp + edx + 0x67], al
test al, al
jne 0x401030
lea ecx, [esp + 0x68]
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x401047
mov eax, dword [str._rundll32.exe]
mov dword [ecx], eax
mov eax, dword [0x412d00]
mov dword [ecx + 4], eax
mov eax, dword [0x412d04]
mov dword [ecx + 8], eax
mov ax, word [0x412d08]
mov word [ecx + 0xc], ax
lea eax, [esp + 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4010e2
push 0x30c
lea eax, [esp + 0x378]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
xor ecx, ecx
nop word [eax + eax]
mov al, byte [esp + ecx + 0x374]
lea ecx, [ecx + 1]
mov byte [esp + ecx + 0x67], al
test al, al
jne 0x4010a0
lea ecx, [esp + 0x68]
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x4010b7
mov eax, dword [str._rundll32.exe]
mov dword [ecx], eax
mov eax, dword [0x412d00]
mov dword [ecx + 4], eax
mov eax, dword [0x412d04]
mov dword [ecx + 8], eax
mov ax, word [0x412d08]
mov word [ecx + 0xc], ax
lea eax, [esp + 0xc98]
push eax
push 0x30c
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x30c
lea eax, [esp + 0xfa8]
push eax
lea eax, [esp + 0xca0]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
push 0x104
lea eax, [esp + 0x990]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edi, [esp + 0x98c]
dec edi
nop dword [eax]
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x401130
mov ax, word [0x412d0c]
xor ecx, ecx
mov word [edi], ax
mov al, byte [esp + ecx + 0xfa4]
lea ecx, [ecx + 1]
mov byte [esp + ecx + 0x67f], al
test al, al
jne 0x401145
lea ecx, [esp + 0x680]
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x401162
mov eax, dword [0x412d10]
mov dword [ecx], eax
mov eax, dword [0x412d14]
mov dword [ecx + 4], eax
mov eax, dword [0x412d18]
mov dword [ecx + 8], eax
mov eax, dword [0x412d1c]
mov dword [ecx + 0xc], eax
mov eax, dword [0x412d20]
push pe_nt_image_headers32
mov dword [ecx + 0x10], eax
mov al, byte [0x412d24]
push 0xc8
push ebp
mov byte [ecx + 0x14], al
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push ebp
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0
push 0x80
push 2
push 0
push 0
mov edi, eax
lea eax, [esp + 0x694]
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
mov esi, eax
lea eax, [esp + 0x14]
push eax
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x68]
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x401207
mov ax, word [0x412d28]
lea edx, [esp + 0x680]
mov word [ecx], ax
mov esi, edx
mov al, byte [0x412d2a]
mov byte [ecx + 2], al
nop dword [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x401230
lea edi, [esp + 0x68]
sub edx, esi
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x401240
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x68]
dec ecx
nop dword [eax + eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x401260
mov eax, dword [str.__UninstallMC__]
lea edx, [esp + 0x98c]
mov dword [ecx], eax
mov esi, edx
mov eax, dword [0x412d30]
mov dword [ecx + 4], eax
mov eax, dword [0x412d34]
mov dword [ecx + 8], eax
mov eax, dword [0x412d38]
mov dword [ecx + 0xc], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x401292
lea edi, [esp + 0x68]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4012a0
mov ecx, edx
lea eax, [esp + 0x24]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x44
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
push eax
call fcn.00402250
add esp, 0xc
mov dword [esp + 0x50], 0x80
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x28]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
lea eax, [esp + 0x88]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x12a0
ret