Function at 0x40405a
Capabilities:
Create process on windows
Delete file
Extract resource via kernel32 functions
Query environment variable
Set file attributes
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov esi, dword [0x40abf5]
push esi
push 0x40a4ba
call sub.kernel32.dll_lstrcpyA
push 0x200
push 0x40a2ba
push 0x40a4ba
call sub.kernel32.dll_ExpandEnvironmentStringsA
push 0x40a2ba
push 0x40a8ba
call sub.kernel32.dll_lstrcpyA
push 0x40a2ba
call sub.shlwapi.dll_PathQuoteSpacesA
push 0x40a2ba
push 0x40a4ba
call sub.kernel32.dll_lstrcpyA
push 0x4091ce
push 0x40a4ba
call sub.kernel32.dll_lstrcatA
push esi
call sub.kernel32.dll_lstrlenA
inc eax
add esi, eax
push 0x200
push 0x40a6ba
push esi
call sub.kernel32.dll_ExpandEnvironmentStringsA
push 0x40a6ba
push 0x40a4ba
call sub.kernel32.dll_lstrcatA
push esi
call sub.kernel32.dll_lstrlenA
inc eax
add esi, eax
mov bl, byte [esi]
and bl, 0x80
or bl, bl
je 0x404114
call fcn.00404f20
or eax, eax
jne 0x404114
jmp 0x4042b8
mov al, byte [esi]
and al, 0x7f
mov byte [0x40abec], al
inc esi
movzx eax, word [esi]
mov dword [0x40abe8], eax
add esi, 2
movzx eax, word [esi]
push 0xa
push eax
push dword [0x409470]
call sub.kernel32.dll_FindResourceA
or eax, eax
jne 0x404143
jmp 0x4042b8
push eax
push eax
push dword [0x409470]
call sub.kernel32.dll_SizeofResource
mov dword [0x409582], eax
push dword [0x409470]
call sub.kernel32.dll_LoadResource
or eax, eax
jne 0x404169
jmp 0x4042b8
mov esi, eax
push dword [0x409582]
push 0
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
mov ecx, dword [0x409582]
push ecx
push esi
push eax
call fcn.004042fb
mov esi, dword [ebp - 8]
test byte [0x40abec], 2
je 0x4041d3
push 0x40a8ba
call fcn.00405230
or eax, eax
je 0x4041c4
push 0x44
push str.Overwrite_confirmation
push str.File_already_exists._Overwrite_it__
push dword [0x409474]
call sub.user32.dll_MessageBoxA
cmp eax, 7
jne 0x4041c4
jmp 0x4042b8
push 0x80
push 0x40a8ba
call sub.kernel32.dll_SetFileAttributesA
push 0
push dword [0x40abe8]
push 2
push 0
push 0
push 0x40000000
push 0x40a8ba
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x4041fa
jmp 0x4042b8
mov dword [0x40ab5a], eax
push 0
push 0x40abe0
push dword [0x409582]
push esi
push dword [0x40ab5a]
call sub.kernel32.dll_WriteFile
or eax, eax
jne 0x404221
jmp 0x4042b8
push dword [0x40ab5a]
call sub.kernel32.dll_FlushFileBuffers
push dword [0x40ab5a]
call sub.kernel32.dll_CloseHandle
or eax, eax
jne 0x40423d
jmp 0x4042b8
test byte [0x40abec], 1
je 0x4042b6
mov dword [0x40ab62], 0x44
push 0x40aba6
push 0x40ab62
push 0
push 0
push 0x20
push 0
push 0
push 0
push 0x40a4ba
push 0x40a8ba
call sub.kernel32.dll_CreateProcessA
or eax, eax
jne 0x40427b
jmp 0x4042b8
test byte [0x40abec], 4
je 0x40429b
push 0xffffffffffffffff
push dword [0x40aba6]
call sub.kernel32.dll_WaitForSingleObject
push 0x7d0
call sub.kernel32.dll_Sleep
push 0x409586
push dword [0x40aba6]
call sub.kernel32.dll_GetExitCodeProcess
cmp dword [0x409586], 0
je 0x4042b6
jmp 0x4042b8
jmp 0x4042bb
inc dword [ebp - 4]
test byte [0x40abec], 8
je 0x4042dd
push 0x80
push 0x40a8ba
call sub.kernel32.dll_SetFileAttributesA
push 0x40a8ba
call sub.kernel32.dll_DeleteFileA
or bl, bl
je 0x4042e6
call fcn.00404f4b
cmp dword [ebp - 8], 0
je 0x4042f4
push dword [ebp - 8]
call sub.kernel32.dll_GlobalFree
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret