Function at 0x403270
Capabilities:
Create process on windows
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc8c
movzx edx, byte [0x401df7]
mov dword [esp + 8], 0x103
mov dword [esp + 4], 0
mov byte [ebp - 0x128], dl
lea edx, [ebp - 0x127]
mov dword [esp], edx
call sub.msvcrt.dll_memset
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
sub esp, 4
test eax, eax
je 0x4032e1
mov dword [esp + 8], 0x104
lea ecx, [ebp - 0x128]
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
sub esp, 0xc
test eax, eax
jne 0x403c14
mov eax, 0xffffffff
mov dword [ebp - 0xc6c], eax
cmp dword [ebp - 0xc6c], 0xffffffff
je 0x403be0
lea edx, [ebp - 0x128]
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x403b2d
mov dword [esp + 0xc], 0x400
mov dword [esp + 8], 0xa
mov dword [esp + 4], 0xa
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
sub esp, 0x10
test eax, eax
je 0x40337f
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
sub esp, 8
test eax, eax
je 0x40337f
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
sub esp, 4
mov ecx, eax
test eax, eax
je 0x40337f
xor edx, edx
lea esi, [esi]
lea edi, [edi]
movzx eax, byte [edx + ecx]
mov byte [edx + str.launch4j], al
inc edx
test al, al
jne 0x403370
movzx ecx, byte [0x401df7]
lea esi, [ebp - 0x637]
mov dword [esp + 8], 0x103
mov dword [esp + 4], 0
mov dword [esp], esi
mov byte [ebp - 0x638], cl
call sub.msvcrt.dll_memset
mov dword [esp + 0xc], 0x400
mov dword [esp + 8], 8
mov dword [esp + 4], 0xa
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
sub esp, 0x10
test eax, eax
je 0x403476
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
sub esp, 8
test eax, eax
je 0x403476
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
sub esp, 4
mov ecx, eax
test eax, eax
je 0x403476
xor edx, edx
lea esi, [esi]
lea edi, [edi]
movzx eax, byte [edx + ecx]
mov byte [edx + ebp - 0x638], al
inc edx
test al, al
jne 0x403410
mov dword [esp], 0x405280
mov edx, dword [ebp - 0xc6c]
lea eax, [ebp - 0x128]
mov dword [esp + 4], eax
lea edi, [ebp - 0x638]
mov dword [esp + 8], edx
call sub.msvcrt.dll_strncpy
mov dword [esp + 4], 0x40298a
mov dword [esp], 0x405280
call sub.msvcrt.dll_strcat
mov dword [esp + 4], edi
mov dword [esp], 0x405280
call sub.msvcrt.dll_strcat
mov dword [esp], 0x405280
call sub.msvcrt.dll__chdir
movzx ecx, byte [0x401df7]
xor eax, eax
lea edi, [ebp - 0x647]
cld
mov byte [ebp - 0x648], cl
mov ecx, 2
rep stosd dword es:[edi], eax
mov byte [edi], 0
mov dword [esp + 0xc], 0x400
mov dword [esp + 8], 9
mov dword [esp + 4], 0xa
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
sub esp, 0x10
test eax, eax
je 0x403500
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
sub esp, 8
test eax, eax
je 0x403500
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
sub esp, 4
mov ecx, eax
test eax, eax
je 0x403500
xor edx, edx
lea esi, [esi]
lea edi, [edi]
movzx eax, byte [edx + ecx]
mov byte [edx + ebp - 0x648], al
inc edx
test al, al
jne 0x4034f0
cld
mov edi, 0x40298c
mov ecx, 5
lea esi, [ebp - 0x648]
repe cmpsb byte [esi], byte es:[edi]
sete dl
mov dword [esp + 0xc], 0x400
mov dword [esp + 8], 1
mov dword [esp + 4], 0xa
movzx edi, dl
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
sub esp, 0x10
test eax, eax
je 0x4035ca
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
sub esp, 8
test eax, eax
je 0x4035ca
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
sub esp, 4
mov ecx, eax
test eax, eax
je 0x4035ca
xor edx, edx
lea esi, [esi]
movzx eax, byte [edx + ecx]
mov byte [edx + ebp - 0x638], al
inc edx
test al, al
jne 0x403570
mov dword [esp], 0x4053a0
mov eax, dword [ebp - 0xc6c]
lea ecx, [ebp - 0x128]
mov dword [esp + 4], ecx
lea esi, [ebp - 0x638]
mov dword [esp + 8], eax
call sub.msvcrt.dll_strncpy
mov dword [esp + 4], 0x40298a
mov dword [esp], 0x4053a0
call sub.msvcrt.dll_strcat
mov dword [esp + 4], esi
mov dword [esp], 0x4053a0
call sub.msvcrt.dll_strcat
cmp byte [0x4053a0], 0
jne 0x403ad6
mov dword [esp + 0xc], 0x400
mov dword [esp + 8], 2
mov dword [esp + 4], 0xa
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
sub esp, 0x10
test eax, eax
je 0x403aa2
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
sub esp, 8
test eax, eax
je 0x403aa2
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
sub esp, 4
mov ecx, eax
test eax, eax
je 0x403aa2
xor edx, edx
lea esi, [esi]
lea edi, [edi]
movzx eax, byte [edx + ecx]
mov byte [edx + 0x405100], al
inc edx
test al, al
jne 0x403640
mov dword [esp + 0xc], 0x400
mov dword [esp + 8], 3
mov dword [esp + 4], 0xa
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
sub esp, 0x10
test eax, eax
je 0x4036af
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
sub esp, 8
test eax, eax
je 0x4036af
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
sub esp, 4
mov ecx, eax
test eax, eax
je 0x4036af
xor edx, edx
nop
movzx eax, byte [edx + ecx]
mov byte [edx + 0x405180], al
inc edx
test al, al
jne 0x4036a0
mov dword [esp], 0x4053a0
call fcn.00402200
test eax, eax
je 0x40397a
cmp byte [0x4053a0], 0
jne 0x403732
mov esi, dword [0x406020]
test esi, esi
je 0x4036fe
mov dword [esp + 8], 0x4029a0
mov esi, esi
mov dword [esp + 4], str.launch4j
mov dword [esp], 0x4029cf
call sub.msvcrt.dll_printf
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.launch4j
mov dword [esp + 4], 0x4029a0
lea esi, [esi]
lea edi, [edi]
mov dword [esp], 0
call dword [sym.imp.USER32.dll_MessageBoxA]
sub esp, 0x10
jmp 0x4036f4
mov dword [esp + 4], 0x4053a0
lea esi, [ebp - 0xc68]
mov dword [esp], esi
call sub.msvcrt.dll_strcpy
mov ecx, dword [0x406020]
test ecx, ecx
je 0x40396d
mov dword [esp + 4], 0x402647
mov dword [esp], esi
call sub.msvcrt.dll_strcat
mov dword [esp + 4], 0x4060a0
mov dword [esp], esi
call sub.msvcrt.dll__stat
test eax, eax
jne 0x4036cc
mov dword [esp], edi
mov ecx, dword [ebp - 0xc6c]
lea eax, [ebp - 0x128]
mov dword [esp + 4], eax
lea edi, [ebp - 0xb57]
lea esi, [ebp - 0xb58]
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 0x4053a0
call fcn.00402680
movzx edx, byte [0x401df7]
mov dword [esp + 8], 0x3ff
mov dword [esp + 4], 0
mov dword [esp], edi
mov byte [ebp - 0xb58], dl
call sub.msvcrt.dll_memset
mov dword [esp + 0xc], 0x400
mov dword [esp + 8], 0xd
mov dword [esp + 4], 0xa
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
sub esp, 0x10
test eax, eax
je 0x40383c
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
sub esp, 8
test eax, eax
je 0x40383c
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
sub esp, 4
mov ecx, eax
test eax, eax
je 0x40383c
xor edx, edx
lea esi, [esi]
lea edi, [edi]
movzx eax, byte [edx + ecx]
mov byte [edx + esi], al
inc edx
test al, al
jne 0x403830
mov dword [esp + 0xc], 0x400
mov dword [esp + 8], 0xc
mov dword [esp + 4], 0xa
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
sub esp, 0x10
test eax, eax
je 0x40389f
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
sub esp, 8
test eax, eax
je 0x40389f
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
sub esp, 4
mov ecx, eax
test eax, eax
je 0x40389f
xor edx, edx
lea esi, [esi]
movzx ebx, byte [edx + ecx]
mov byte [edx + 0x4054c0], bl
inc edx
test bl, bl
jne 0x403890
cmp byte [0x4054c0], 0
jne 0x403954
mov dword [esp + 4], 0x4029d7
lea edi, [ebp - 0x128]
mov dword [esp], 0x4054c0
call sub.msvcrt.dll_strcat
mov dword [esp + 4], edi
mov dword [esp], 0x4054c0
call sub.msvcrt.dll_strcat
mov dword [esp + 4], 0x4029de
mov dword [esp], 0x4054c0
call sub.msvcrt.dll_strcat
cmp byte [ebp - 0xb58], 0
jne 0x40392e
mov esi, dword [ebp + 0xc]
cmp byte [esi], 0
jne 0x403905
mov eax, 1
jmp 0x4036f6
mov dword [esp + 4], 0x4029e0
mov dword [esp], 0x4054c0
call sub.msvcrt.dll_strcat
mov dword [esp], 0x4054c0
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
call sub.msvcrt.dll_strcat
jmp 0x4038fb
mov dword [esp + 4], 0x4029e0
mov dword [esp], 0x4054c0
call sub.msvcrt.dll_strcat
mov dword [esp + 4], esi
mov dword [esp], 0x4054c0
call sub.msvcrt.dll_strcat
jmp 0x4038f3
mov dword [esp + 4], 0x4029e0
mov dword [esp], 0x4054c0
call sub.msvcrt.dll_strcat
jmp 0x4038ac
mov dword [esp + 4], 0x402655
jmp 0x40375e
movzx edx, word [0x4029f2]
mov dword [esp + 8], 0x3ee
mov edi, dword [0x4029e2]
mov dword [esp + 4], 0
mov ebx, dword [0x4029e6]
mov ecx, dword [0x4029ea]
mov dword [ebp - 0xb58], edi
mov esi, dword [0x4029ee]
lea edi, [ebp - 0xb46]
mov dword [ebp - 0xb54], ebx
lea ebx, [ebp - 0xb58]
mov dword [ebp - 0xb50], ecx
mov word [ebp - 0xb48], dx
mov dword [ebp - 0xb4c], esi
mov dword [esp], edi
call sub.msvcrt.dll_memset
mov dword [esp + 4], 0x405100
mov dword [esp], ebx
call sub.msvcrt.dll_strcat
cmp byte [0x405180], 0
jne 0x403a7d
mov edx, dword [0x406020]
test edx, edx
je 0x403a57
mov dword [esp + 8], ebx
mov dword [esp + 4], str.launch4j
mov dword [esp], 0x4029cf
call sub.msvcrt.dll_printf
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x402de2
mov dword [esp + 4], 0x402df2
mov dword [esp], 0
call sub.SHELL32.DLL_ShellExecuteA
sub esp, 0x18
jmp 0x4036f4
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.launch4j
mov dword [esp + 4], ebx
mov dword [esp], 0
call dword [sym.imp.USER32.dll_MessageBoxA]
sub esp, 0x10
jmp 0x403a1b
mov dword [esp + 4], 0x402df7
mov dword [esp], ebx
call sub.msvcrt.dll_strcat
mov dword [esp + 4], 0x405180
mov dword [esp], ebx
call sub.msvcrt.dll_strcat
jmp 0x4039f9
mov ebx, dword [0x406020]
test ebx, ebx
je 0x403ab9
mov dword [esp + 8], 0x402e00
jmp 0x4036e0
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.launch4j
mov dword [esp + 4], 0x402e00
jmp 0x403720
mov dword [esp + 4], 0x4053a0
lea esi, [ebp - 0x758]
mov dword [esp], esi
call sub.msvcrt.dll_strcpy
mov ecx, dword [0x406020]
test ecx, ecx
je 0x403b23
mov dword [esp + 4], 0x402647
mov dword [esp], esi
call sub.msvcrt.dll_strcat
mov dword [esp + 4], 0x4060a0
mov dword [esp], esi
call sub.msvcrt.dll__stat
test eax, eax
je 0x40377e
jmp 0x4035d7
mov dword [esp + 4], 0x402655
jmp 0x403afe
movzx esi, word [0x402e41]
mov dword [esp + 8], 0x3ed
mov edx, dword [0x402e31]
mov dword [esp + 4], 0
mov ebx, dword [0x402e35]
mov ecx, dword [0x402e39]
mov dword [ebp - 0x528], edx
mov edi, dword [0x402e3d]
movzx edx, byte [0x402e43]
mov dword [ebp - 0x524], ebx
lea ebx, [ebp - 0x515]
mov dword [ebp - 0x520], ecx
mov byte [ebp - 0x516], dl
mov dword [esp], ebx
lea ebx, [ebp - 0x528]
mov dword [ebp - 0x51c], edi
mov word [ebp - 0x518], si
call sub.msvcrt.dll_memset
mov dword [esp], ebx
lea ecx, [ebp - 0x128]
mov dword [esp + 4], ecx
call sub.msvcrt.dll_strcat
mov eax, dword [0x406020]
test eax, eax
je 0x403bc0
mov dword [esp + 8], ebx
jmp 0x4036e0
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.launch4j
mov dword [esp + 4], ebx
jmp 0x403720
mov edi, dword [0x406020]
test edi, edi
je 0x403bf7
mov dword [esp + 8], 0x403240
jmp 0x4036e0
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.launch4j
mov dword [esp + 4], 0x403240
jmp 0x403720
mov dword [esp + 4], 0x5c
lea esi, [ebp - 0x128]
lea ebx, [ebp - 0x128]
mov dword [esp], esi
call sub.msvcrt.dll_strrchr
mov dword [ebp - 0xc6c], eax
sub dword [ebp - 0xc6c], ebx
jmp 0x4032ec