Function at 0x402300
Capabilities:
Create process on windows
Extract resource via kernel32 functions
Get common file path

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x405e7a
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x550
mov eax, dword [0x40a040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 0x528], esi
mov dword [ebp - 0x52c], 0
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x402376
push 0
push 0x40744c
push str.Error:_Debugger_detected.
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x402a67
lea eax, [ebp - 0x428]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x220]
push eax
push 0
push 0x40748c
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
xorps xmm0, xmm0
mov dword [ebp - 0x430], 0
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x42c], 0
movups xmmword [ebp - 0x440], xmm0
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4023d0
sub ecx, edx
lea eax, [ebp - 0x220]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x440]
call fcn.00404330
mov dword [ebp - 4], 0
lea edx, [ebp - 0x440]
cmp dword [ebp - 0x42c], 7
mov edi, dword [ebp - 0x430]
cmova edx, dword [ebp - 0x440]
test edi, edi
je 0x402443
or ecx, 0xffffffff
lea eax, [edi - 1]
cmp eax, ecx
cmovb ecx, eax
cmp word [edx + ecx*2], 0x2e
lea ecx, [edx + ecx*2]
je 0x40243d
nop dword [eax]
cmp ecx, edx
je 0x402443
sub ecx, 2
cmp word [ecx], 0x2e
jne 0x402430
sub ecx, edx
sar ecx, 1
jmp 0x402446
or ecx, 0xffffffff
cmp edi, ecx
mov dword [ebp - 0x534], 0
lea eax, [ebp - 0x440]
mov dword [ebp - 0x530], 0
cmovb ecx, edi
xorps xmm0, xmm0
cmp dword [ebp - 0x42c], 7
push ecx
cmova eax, dword [ebp - 0x440]
lea ecx, [ebp - 0x544]
push eax
movups xmmword [ebp - 0x544], xmm0
call fcn.00404330
mov edi, 4
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x530]
mov eax, edx
mov ecx, dword [ebp - 0x534]
sub eax, ecx
mov dword [ebp - 0x52c], ecx
cmp eax, edi
jb 0x4024f4
cmp edx, 7
lea esi, [ebp - 0x544]
lea eax, [ecx + 4]
cmova esi, dword [ebp - 0x544]
push 8
mov dword [ebp - 0x534], eax
push 0x407494
lea eax, [esi + ecx*2]
push eax
call sub.VCRUNTIME140.dll_memmove
mov eax, dword [ebp - 0x52c]
add esp, 0xc
xor ecx, ecx
mov word [esi + eax*2 + 8], cx
lea eax, [ebp - 0x544]
mov esi, dword [ebp - 0x528]
jmp 0x40250a
push 4
push ecx
push dword [ebp - 0x52c]
lea ecx, [ebp - 0x544]
push 4
call fcn.004041b0
movups xmm0, xmmword [eax]
xor ecx, ecx
or edi, 8
movq xmm1, qword [eax + 0x10]
movups xmmword [ebp - 0x558], xmm0
movq qword [ebp - 0x450], xmm1
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov ecx, dword [ebp - 0x42c]
mov dword [ebp - 0x528], edi
cmp ecx, 7
jbe 0x402588
mov edx, dword [ebp - 0x440]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40256f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4025cd
push ecx
push edx
call fcn.00404ee7
movups xmm0, xmmword [ebp - 0x558]
add esp, 8
movq xmm1, qword [ebp - 0x450]
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x530]
movq qword [ebp - 0x430], xmm1
movups xmmword [ebp - 0x440], xmm0
cmp ecx, 7
jbe 0x4025dd
mov edx, dword [ebp - 0x544]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4025d3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4025d3
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00404ee7
add esp, 8
cmp dword [esi + 0x14], 7
jbe 0x4025e5
mov esi, dword [esi]
push esi
push 0x65
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x40260d
push eax
push 0x40744c
push str.Error:_Resource_not_found.
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x402a25
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x402633
push eax
push 0x40744c
push str.Error:_Failed_to_load_resource.
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x402a25
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov dword [ebp - 0x52c], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x402666
push eax
push 0x40744c
push str.Error:_Failed_to_lock_resource.
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x402a25
push 0xb0
lea eax, [ebp - 0x520]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
cmp dword [ebp - 0x42c], 7
lea eax, [ebp - 0x440]
lea ecx, [ebp - 0x520]
cmova eax, dword [ebp - 0x440]
push eax
call fcn.00403d50
mov eax, dword [ebp - 0x520]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ofstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x520]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0x524], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x520]
mov eax, dword [ebp - 0x520]
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_bool___thiscall_std::ios_base::operator__void_const]
push 0
test al, al
je 0x4026ee
push 0x40744c
push str.Error:_Failed_to_create_file.
jmp 0x402a12
push dword [ebp - 0x52c]
lea ecx, [ebp - 0x520]
push esi
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const___long_long___int64__]
lea ecx, [ebp - 0x51c]
call fcn.00403cc0
test eax, eax
jne 0x402729
mov eax, dword [ebp - 0x520]
lea ecx, [ebp - 0x520]
push 0
push 2
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
cmp dword [ebp - 0x42c], 7
lea eax, [ebp - 0x440]
push dword [ebp - 0x430]
cmova eax, dword [ebp - 0x440]
lea ecx, [ebp - 0x544]
xorps xmm0, xmm0
mov dword [ebp - 0x534], 0
push eax
movups xmmword [ebp - 0x544], xmm0
mov dword [ebp - 0x530], 0
call fcn.00404330
mov eax, dword [ebp - 0x528]
or eax, 0x30
or eax, 1
mov byte [ebp - 4], 3
cmp dword [ebp - 0x530], 7
lea ecx, [ebp - 0x470]
push 0xffffffffffffffff
mov dword [ebp - 0x528], eax
mov dword [ebp - 0x52c], eax
lea eax, [ebp - 0x544]
cmova eax, dword [ebp - 0x544]
push 3
push ecx
push eax
call fcn.00404bfe
mov esi, eax
test esi, esi
jne 0x402806
mov edx, dword [ebp - 0x460]
mov ecx, 0x1ff
test dl, 1
mov eax, 0x16d
cmovne ecx, eax
mov dword [ebp - 0x44c], ecx
test edx, 0x400
je 0x4027f8
mov eax, dword [ebp - 0x45c]
cmp eax, 0xa000000c
jne 0x4027ea
lea eax, [esi + 4]
jmp 0x40282f
cmp eax, 0xa0000003
jne 0x4027f8
mov eax, 0xa
jmp 0x40282f
movzx eax, dl
and eax, 0x10
or eax, 0x20
shr eax, 4
jmp 0x40282f
lea eax, [esi - 2]
mov dword [ebp - 0x44c], 0xffff
cmp eax, 0x79
ja case.0x40281f.4
movzx eax, byte [eax + 0x402ab0]
jmp dword [eax*4 + 0x402aa8]
mov eax, 1
jmp 0x40282f
xor eax, eax
mov dword [ebp - 0x44c], esi
mov dword [ebp - 0x448], 0x40a0a0
test eax, eax
je 0x4028fb
cmp eax, 1
je 0x402903
cmp dword [ebp - 0x42c], 7
lea eax, [ebp - 0x440]
push dword [ebp - 0x430]
cmova eax, dword [ebp - 0x440]
lea ecx, [ebp - 0x560]
xorps xmm0, xmm0
mov dword [ebp - 0x550], 0
push eax
movups xmmword [ebp - 0x560], xmm0
mov dword [ebp - 0x54c], 0
call fcn.00404330
mov eax, dword [ebp - 0x528]
or eax, 0xc0
or eax, 2
mov dword [ebp - 4], 4
cmp dword [ebp - 0x54c], 7
lea ecx, [ebp - 0x470]
push 0xffffffffffffffff
mov dword [ebp - 0x528], eax
mov dword [ebp - 0x52c], eax
lea eax, [ebp - 0x560]
cmova eax, dword [ebp - 0x560]
push 9
push ecx
push eax
call fcn.00404bfe
test eax, eax
jne 0x402a85
cmp dword [ebp - 0x464], eax
ja 0x4028f2
cmp dword [ebp - 0x468], eax
jbe 0x402903
mov byte [ebp - 0x521], 1
jmp 0x40290a
test esi, esi
jne 0x402a93
mov byte [ebp - 0x521], 0
mov eax, dword [ebp - 0x528]
test al, 2
je 0x40297c
mov ecx, dword [ebp - 0x54c]
and eax, 0xfffffffd
mov dword [ebp - 0x528], eax
cmp ecx, 7
jbe 0x40295f
mov edx, dword [ebp - 0x560]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40294f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4029b2
push ecx
push edx
call fcn.00404ee7
mov eax, dword [ebp - 0x528]
add esp, 8
xor ecx, ecx
mov dword [ebp - 0x550], 0
mov dword [ebp - 0x54c], 7
mov word [ebp - 0x560], cx
test al, 1
je 0x4029c2
mov ecx, dword [ebp - 0x530]
cmp ecx, 7
jbe 0x4029c2
mov edx, dword [ebp - 0x544]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4029b8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4029b8
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00404ee7
add esp, 8
cmp byte [ebp - 0x521], 0
je 0x402a06
cmp dword [ebp - 0x42c], 7
lea eax, [ebp - 0x440]
push 1
cmova eax, dword [ebp - 0x440]
push 0
push 0
push eax
push 0x407594
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jg 0x402a1a
push 0
push 0x40744c
push str.Error:_Failed_to_execute_file.
jmp 0x402a12
push 0
push 0x40744c
push str.Error:_File_integrity_check_failed.
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0x520]
call fcn.00402b30
mov ecx, dword [ebp - 0x42c]
cmp ecx, 7
jbe 0x402a67
mov edx, dword [ebp - 0x440]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x402a5d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x402a5d
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00404ee7
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00404ea4
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
lea ecx, [ebp - 0x560]
mov edx, eax
push ecx
call fcn.004021f0
lea eax, [ebp - 0x544]
push eax
lea edx, [ebp - 0x44c]
call fcn.00402280
nop dword [eax]
sub byte es:[eax], al
sub eax, 16424
add byte [ecx], al
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add byte [ecx], al
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add ah, cl
int3