Function at 0x401160
Capabilities:
Create process on windows
Extract resource via kernel32 functions
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x318
mov eax, dword [0x413004]
xor eax, esp
mov dword [esp + 0x314], eax
push esi
push edi
push 0
push 1
call dword [sym.imp.KERNEL32.dll_SetThreadErrorMode]
push 0xa
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x40165f
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40165f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x40165f
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
shr eax, 1
mov dword [esp + 0x88], 0
mov dword [esp + 0x98], 0
mov dword [esp + 0x9c], 7
cmp eax, 7
ja 0x401217
lea esi, [eax + eax]
mov dword [esp + 0x98], eax
push esi
lea eax, [esp + 0x8c]
push edi
push eax
call fcn.00403510
add esp, 0xc
xor eax, eax
mov word [esp + esi + 0x88], ax
jmp 0x40122e
push edi
mov byte [esp + 0x14], 0
lea ecx, [esp + 0x8c]
push dword [esp + 0x14]
push eax
call fcn.004019a0
cmp dword [esp + 0x98], 0x1d
jbe 0x401621
lea eax, [esp + 0x110]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x401621
lea ecx, [esp + 0x110]
mov dword [esp + 0x60], 0
mov dword [esp + 0x70], 0
lea edx, [ecx + 2]
mov dword [esp + 0x74], 7
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401280
sub ecx, edx
lea eax, [esp + 0x110]
sar ecx, 1
cmp ecx, 7
ja 0x4012ba
lea esi, [ecx + ecx]
mov dword [esp + 0x70], ecx
push esi
push eax
lea eax, [esp + 0x68]
push eax
call fcn.00403510
add esp, 0xc
xor eax, eax
mov word [esp + esi + 0x60], ax
jmp 0x4012ce
push eax
mov byte [esp + 0x14], 0
push dword [esp + 0x14]
push ecx
lea ecx, [esp + 0x6c]
call fcn.004019a0
mov edx, dword [esp + 0x74]
mov eax, edx
mov ecx, dword [esp + 0x70]
sub eax, ecx
cmp eax, 1
jb 0x4012fb
lea eax, [ecx + 1]
cmp edx, 8
mov dword [esp + 0x70], eax
lea eax, [esp + 0x60]
cmovae eax, dword [esp + 0x60]
mov dword [eax + ecx*2], 0x5c
jmp 0x401316
push 1
push 0x411c98
mov byte [esp + 0x18], 0
lea ecx, [esp + 0x68]
push dword [esp + 0x18]
push 1
call fcn.00401ad0
movaps xmm0, xmmword [esp + 0x60]
movaps xmmword [esp + 0xa0], xmm0
movq xmm0, qword [esp + 0x70]
movq qword [esp + 0xb0], xmm0
cmp dword [esp + 0xb0], 0
jbe 0x4015e3
push 0x12
push 0
lea eax, [esp + 0xd0]
push eax
lea ecx, [esp + 0x94]
call fcn.00401690
push 0xb
push 0x12
lea eax, [esp + 0xe8]
push eax
lea ecx, [esp + 0x94]
call fcn.00401690
push 0xffffffffffffffff
push 0x1d
lea eax, [esp + 0x100]
push eax
lea ecx, [esp + 0x94]
call fcn.00401690
mov eax, dword [esp + 0xb0]
lea ecx, [esp + 0xa0]
push 1
dec eax
push eax
lea eax, [esp + 0x68]
push eax
call fcn.00401690
mov dword [esp + 0x10], 1
lea esi, [esp + 0xe0]
push esi
lea eax, [esp + 0x64]
push eax
lea eax, [esp + 0xd0]
push eax
lea edx, [esp + 0xac]
lea ecx, [esp + 0x54]
call fcn.00401860
add esp, 4
lea ecx, [esp + 0x38]
mov edx, eax
call fcn.004017a0
add esp, 4
lea ecx, [esp + 0x1c]
mov edx, eax
call fcn.004017a0
add esp, 4
mov dword [esp + 0x14], eax
cmp esi, eax
je 0x401465
mov ecx, dword [esi + 0x14]
cmp ecx, 8
jb 0x401435
mov eax, dword [esi]
lea ecx, [ecx*2 + 2]
cmp ecx, 0x1000
jb 0x401427
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401677
mov eax, edx
push ecx
push eax
call fcn.00401eed
mov eax, dword [esp + 0x1c]
add esp, 8
mov dword [esi + 0x10], 0
xor ecx, ecx
mov dword [esi + 0x14], 7
mov word [esi], cx
movups xmm0, xmmword [eax]
movups xmmword [esi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], 7
mov word [eax], cx
mov ecx, dword [esp + 0x2c]
cmp ecx, 8
jb 0x4014a1
mov edx, dword [esp + 0x18]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x401497
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401677
push ecx
push edx
call fcn.00401eed
add esp, 8
mov ecx, dword [esp + 0x44]
xor eax, eax
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 7
mov word [esp + 0x18], ax
cmp ecx, 8
jb 0x4014f4
mov edx, dword [esp + 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4014ea
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401677
push ecx
push edx
call fcn.00401eed
add esp, 8
mov ecx, dword [esp + 0x5c]
xor eax, eax
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 7
mov word [esp + 0x30], ax
cmp ecx, 8
jb 0x401547
mov edx, dword [esp + 0x48]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40153d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401677
push ecx
push edx
call fcn.00401eed
add esp, 8
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x401551
mov eax, dword [esi]
push 1
push 0
push 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [esp + 0x10]
add esi, 0x18
inc eax
mov dword [esp + 0x10], eax
cmp eax, 3
jl 0x4013b3
mov ecx, dword [esp + 0x74]
cmp ecx, 8
jb 0x4015b3
mov edx, dword [esp + 0x60]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4015a9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401677
push ecx
push edx
call fcn.00401eed
add esp, 8
push 0x401730
xor eax, eax
mov dword [esp + 0x74], 0
push 3
mov word [esp + 0x68], ax
lea eax, [esp + 0xd0]
push 0x18
push eax
mov dword [esp + 0x84], 7
call fcn.00401dd8
mov ecx, dword [esp + 0xb4]
cmp ecx, 8
jb 0x401621
mov edx, dword [esp + 0xa0]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x401617
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40167c
push ecx
push edx
call fcn.00401eed
add esp, 8
mov ecx, dword [esp + 0x9c]
cmp ecx, 8
jb 0x40165f
mov edx, dword [esp + 0x88]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x401655
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401681
push ecx
push edx
call fcn.00401eed
add esp, 8
mov ecx, dword [esp + 0x31c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.00401d9a
mov esp, ebp
pop ebp
ret 0x10
call fcn.00403c7c
call fcn.00403c7c
call fcn.00403c7c
int3