Function at 0x401000
Capabilities:
Accept command line arguments
Create directory
Create process on windows
Delete directory
Extract resource via kernel32 functions
Get common file path
Set current directory
Terminate process
Timestomp file
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x364
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
xor ecx, ecx
mov al, byte [esi]
test al, al
je 0x40104a
cmp al, 0x22
jne 0x40102e
xor edx, edx
cmp ecx, ebx
sete dl
mov ecx, edx
cmp al, 0x20
jne 0x401036
cmp ecx, ebx
je 0x401044
inc esi
mov al, byte [esi]
test al, al
jne 0x401021
jmp 0x401044
cmp al, 0x20
jne 0x40104a
inc esi
mov al, byte [esi]
test al, al
jne 0x40103f
push 0x402078
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x40107f
push ebx
push 0x4011e6
push 0xa
push ebx
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
test eax, eax
jne 0x4011da
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x4011da
lea eax, [ebp - 0x364]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x401071
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
and eax, 0xffff
push eax
lea eax, [ebp - 0x364]
push eax
lea eax, [ebp - 0x15c]
push str._sRSPE_04X.TMP
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x15c]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x4010d7
inc edi
cmp edi, 0xa
jb 0x401097
cmp edi, 0xa
je 0x401071
lea eax, [ebp - 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x4010fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x4011cd
push ebx
push 0x4011e6
push 0xa
push ebx
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
test eax, eax
jne 0x40111c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x4011c0
mov ebx, 0x40208c
lea eax, [ebp - 0x260]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp byte [esi], 0
je 0x401143
dec esi
lea eax, [ebp - 0x260]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x11
xor eax, eax
pop ecx
lea edi, [ebp - 0x58]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x14]
xor esi, esi
push eax
lea eax, [ebp - 0x58]
push eax
push esi
push esi
push 0x20
push 1
push esi
lea eax, [ebp - 0x260]
push esi
push eax
push ebx
mov dword [ebp - 0x58], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x401183
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x4011b1
push 0xffffffffffffffff
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x4011a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push 0x4012a9
push 0xa
push esi
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
lea eax, [ebp - 0x364]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [ebp - 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ExitProcess]