Function at 0x40a030
Capabilities:
Create directory
Create process on windows
Extract resource via kernel32 functions
Get common file path
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x46b4
call fcn.00408df0
mov eax, dword [0x40e048]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
call fcn.00409f20
add esp, 4
push eax
call fcn.00401029
add esp, 4
lea eax, [ebp - 0x210]
push eax
push 0
push 0
push 0x801c
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push str.Temp
push 0x104
lea ecx, [ebp - 0x210]
push ecx
call fcn.0040108c
add esp, 0xc
mov dword [ebp - 0x4228], 0
mov dword [ebp - 0x4230], 0
push 0x17
push str.129
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x2218], eax
cmp dword [ebp - 0x2218], 0
je 0x40a10e
mov edx, dword [ebp - 0x2218]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x4238], eax
cmp dword [ebp - 0x4238], 0
je 0x40a10c
mov eax, dword [ebp - 0x4238]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x4228], eax
cmp dword [ebp - 0x4228], 0
je 0x40a10c
mov ecx, dword [ebp - 0x2218]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x4230], eax
jmp 0x40a115
xor eax, eax
jmp 0x40a6e9
mov edx, dword [ebp - 0x4228]
mov dword [ebp - 0x4224], edx
mov eax, dword [ebp - 0x4230]
shr eax, 1
mov dword [ebp - 0x2214], eax
mov dword [ebp - 0x422c], 0x82
mov dword [ebp - 0x221c], 1
mov byte [ebp - 0x221d], 1
mov byte [ebp - 0x4232], 1
mov byte [ebp - 0x4231], 0
mov dword [ebp - 0x423c], 1
jmp 0x40a173
mov ecx, dword [ebp - 0x423c]
add ecx, 1
mov dword [ebp - 0x423c], ecx
mov edx, dword [ebp - 0x423c]
cmp edx, dword [ebp - 0x2214]
jge 0x40a5cc
mov eax, dword [ebp - 0x423c]
mov ecx, dword [ebp - 0x4224]
movzx edx, word [ecx + eax*2]
cmp edx, 0x7c
jne 0x40a5c7
mov eax, dword [ebp - 0x423c]
sub eax, dword [ebp - 0x221c]
mov dword [ebp - 0x4240], eax
mov eax, dword [ebp - 0x4240]
add eax, 1
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00401173
add esp, 4
mov dword [ebp - 0x46ac], eax
mov eax, dword [ebp - 0x46ac]
mov dword [ebp - 0x4244], eax
mov ecx, dword [ebp - 0x4240]
lea edx, [ecx + ecx + 2]
push edx
push 0
mov eax, dword [ebp - 0x4244]
push eax
call fcn.004011e0
add esp, 0xc
mov ecx, dword [ebp - 0x4240]
push ecx
mov edx, dword [ebp - 0x221c]
mov eax, dword [ebp - 0x4224]
lea ecx, [eax + edx*2]
push ecx
mov edx, dword [ebp - 0x4240]
add edx, 1
push edx
mov eax, dword [ebp - 0x4244]
push eax
call fcn.0040125a
add esp, 0x10
mov ecx, dword [ebp - 0x423c]
add ecx, 1
mov dword [ebp - 0x221c], ecx
movzx edx, byte [ebp - 0x4232]
test edx, edx
je 0x40a2f9
push 0x40cb70
push 0x104
lea eax, [ebp - 0x210]
push eax
call fcn.0040108c
add esp, 0xc
mov ecx, dword [ebp - 0x4244]
push ecx
push 0x104
lea edx, [ebp - 0x210]
push edx
call fcn.0040108c
add esp, 0xc
mov eax, dword [ebp - 0x4244]
movzx ecx, word [eax + 2]
cmp ecx, 0x39
jne 0x40a298
mov byte [ebp - 0x4231], 1
push 0
lea edx, [ebp - 0x210]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov dword [ebp - 0x4248], eax
cmp dword [ebp - 0x4248], 0
je 0x40a2d4
cmp dword [ebp - 0x4248], 0xb7
je 0x40a2d4
cmp dword [ebp - 0x4248], 0x50
je 0x40a2d4
xor eax, eax
jmp 0x40a6e9
push 0x40cb74
push 0x104
lea eax, [ebp - 0x210]
push eax
call fcn.0040108c
add esp, 0xc
mov byte [ebp - 0x4232], 0
jmp 0x40a5ac
mov ecx, dword [ebp - 0x422c]
push ecx
push 0x40cb78
push 0x10
lea edx, [ebp - 0x4270]
push edx
call fcn.00409f40
add esp, 0x10
mov eax, dword [ebp - 0x422c]
add eax, 1
mov dword [ebp - 0x422c], eax
push 0x17
lea ecx, [ebp - 0x4270]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x424c], eax
mov edx, dword [ebp - 0x424c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x4250], eax
cmp dword [ebp - 0x4250], 0
je 0x40a5ac
push 0x5c
mov eax, dword [ebp - 0x4244]
push eax
call fcn.00409fe0
add esp, 8
mov dword [ebp - 0x447c], eax
cmp dword [ebp - 0x447c], 0
jl 0x40a3ed
mov ecx, dword [ebp - 0x447c]
push ecx
mov edx, dword [ebp - 0x4244]
push edx
push 0x104
lea eax, [ebp - 0x4688]
push eax
call fcn.0040125a
add esp, 0x10
lea ecx, [ebp - 0x210]
push ecx
push 0x104
lea edx, [ebp - 0x4478]
push edx
call fcn.0040144f
add esp, 0xc
lea eax, [ebp - 0x4688]
push eax
push 0x104
lea ecx, [ebp - 0x4478]
push ecx
call fcn.0040108c
add esp, 0xc
push 0
lea edx, [ebp - 0x4478]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov dword [ebp - 0x468c], eax
lea eax, [ebp - 0x210]
push eax
push 0x104
lea ecx, [ebp - 0x4478]
push ecx
call fcn.0040144f
add esp, 0xc
mov edx, dword [ebp - 0x4244]
push edx
push 0x104
lea eax, [ebp - 0x4478]
push eax
call fcn.0040108c
add esp, 0xc
movzx ecx, byte [ebp - 0x221d]
test ecx, ecx
je 0x40a450
lea edx, [ebp - 0x4478]
push edx
push 0x104
lea eax, [ebp - 0x4220]
push eax
call fcn.0040144f
add esp, 0xc
mov byte [ebp - 0x221d], 0
lea ecx, [ebp - 0x4478]
push ecx
call fcn.00409f80
add esp, 4
movzx edx, al
test edx, edx
jne 0x40a5ac
push 0
push 0x80
push 4
push 0
push 1
push 0x40000000
lea eax, [ebp - 0x4478]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x4690], eax
cmp dword [ebp - 0x4690], 0xffffffff
jne 0x40a49f
xor eax, eax
jmp 0x40a6e9
mov ecx, dword [ebp - 0x424c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x4698], eax
mov edx, dword [ebp - 0x4250]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x4694], eax
cmp dword [ebp - 0x4694], 0
je 0x40a59f
mov eax, dword [ebp - 0x4698]
add eax, 1
push eax
call fcn.00401173
add esp, 4
mov dword [ebp - 0x46b0], eax
mov ecx, dword [ebp - 0x46b0]
mov dword [ebp - 0x46a0], ecx
mov edx, dword [ebp - 0x4698]
push edx
mov eax, dword [ebp - 0x4694]
push eax
mov ecx, dword [ebp - 0x46a0]
push ecx
call fcn.004014c0
add esp, 0xc
mov edx, dword [ebp - 0x46a0]
add edx, dword [ebp - 0x4698]
mov byte [edx], 0
mov dword [ebp - 0x46a4], 0
jmp 0x40a53f
mov eax, dword [ebp - 0x46a4]
add eax, 1
mov dword [ebp - 0x46a4], eax
mov ecx, dword [ebp - 0x46a4]
cmp ecx, dword [ebp - 0x4698]
jae 0x40a56e
mov edx, dword [ebp - 0x46a0]
add edx, dword [ebp - 0x46a4]
movzx eax, byte [edx]
not eax
mov ecx, dword [ebp - 0x46a0]
add ecx, dword [ebp - 0x46a4]
mov byte [ecx], al
jmp 0x40a530
push 0
lea edx, [ebp - 0x469c]
push edx
mov eax, dword [ebp - 0x4698]
push eax
mov ecx, dword [ebp - 0x46a0]
push ecx
mov edx, dword [ebp - 0x4690]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x4690]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x4250]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov edx, dword [ebp - 0x4244]
mov dword [ebp - 0x46b4], edx
mov eax, dword [ebp - 0x46b4]
push eax
call fcn.00401825
add esp, 4
jmp 0x40a164
xor ecx, ecx
mov word [ebp - 0x2210], cx
push 0x40cb80
push 0x1000
lea edx, [ebp - 0x2210]
push edx
call fcn.0040108c
add esp, 0xc
lea eax, [ebp - 0x4220]
push eax
push 0x1000
lea ecx, [ebp - 0x2210]
push ecx
call fcn.0040108c
add esp, 0xc
push 0x40cb84
push 0x1000
lea edx, [ebp - 0x2210]
push edx
call fcn.0040108c
add esp, 0xc
mov dword [ebp - 0x46a8], 1
jmp 0x40a63d
mov eax, dword [ebp - 0x46a8]
add eax, 1
mov dword [ebp - 0x46a8], eax
mov ecx, dword [ebp - 0x46a8]
cmp ecx, dword [0x40ef74]
jge 0x40a6a3
push 0x40cb8c
push 0x1000
lea edx, [ebp - 0x2210]
push edx
call fcn.0040108c
add esp, 0xc
mov eax, dword [ebp - 0x46a8]
mov ecx, dword [0x40ef7c]
mov edx, dword [ecx + eax*4]
push edx
push 0x1000
lea eax, [ebp - 0x2210]
push eax
call fcn.0040108c
add esp, 0xc
push 0x40cb94
push 0x1000
lea ecx, [ebp - 0x2210]
push ecx
call fcn.0040108c
add esp, 0xc
jmp 0x40a62e
movzx edx, byte [ebp - 0x4231]
test edx, edx
je 0x40a6c7
push 0x40
push 0x40cb98
push str.This_executable_has_been_built_with_the_unregistered_version_of_HtaEdit._r_n_r_nThe_registered_version_does_not_display_this_notice.
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
push 5
push 0x40ccac
lea eax, [ebp - 0x2210]
push eax
push str.mshta.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401000
mov esp, ebp
pop ebp
ret 0x10