Function at 0x402ffa
Capabilities:
Create process on windows
Delete file
Extract resource via kernel32 functions
Query environment variable
Set file attributes
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov esi, dword [0x40abf5]
push esi
push 0x40a4ba
call sub.kernel32.dll_lstrcpyA
push 0x200
push 0x40a2ba
push 0x40a4ba
call sub.kernel32.dll_ExpandEnvironmentStringsA
push 0x40a2ba
push 0x40a8ba
call sub.kernel32.dll_lstrcpyA
push 0x40a2ba
call sub.shlwapi.dll_PathQuoteSpacesA
push 0x40a2ba
push 0x40a4ba
call sub.kernel32.dll_lstrcpyA
push 0x4091ce
push 0x40a4ba
call sub.kernel32.dll_lstrcatA
push esi
call sub.kernel32.dll_lstrlenA
inc eax
add esi, eax
push 0x200
push 0x40a6ba
push esi
call sub.kernel32.dll_ExpandEnvironmentStringsA
push 0x40a6ba
push 0x40a4ba
call sub.kernel32.dll_lstrcatA
push esi
call sub.kernel32.dll_lstrlenA
inc eax
add esi, eax
mov bl, byte [esi]
and bl, 0x80
or bl, bl
je 0x4030b4
call fcn.00403ec1
or eax, eax
jne 0x4030b4
jmp 0x403259
mov al, byte [esi]
and al, 0x7f
mov byte [0x40abec], al
inc esi
movzx eax, word [esi]
mov dword [0x40abe8], eax
add esi, 2
movzx eax, word [esi]
push 0xa
push eax
push dword [0x409470]
call sub.kernel32.dll_FindResourceA
or eax, eax
jne 0x4030e3
jmp 0x403259
push eax
push eax
push dword [0x409470]
call sub.kernel32.dll_SizeofResource
mov dword [0x409582], eax
push dword [0x409470]
call sub.kernel32.dll_LoadResource
or eax, eax
jne 0x403109
jmp 0x403259
mov esi, eax
push dword [0x409582]
push 0
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
mov ecx, dword [0x409582]
inc ecx
push ecx
push esi
push eax
call fcn.0040329c
mov esi, dword [ebp - 8]
test byte [0x40abec], 2
je 0x403174
push 0x40a8ba
call fcn.004041d0
or eax, eax
je 0x403165
push 0x44
push str.Overwrite_confirmation
push str.File_already_exists._Overwrite_it__
push dword [0x409474]
call sub.user32.dll_MessageBoxA
cmp eax, 7
jne 0x403165
jmp 0x403259
push 0x80
push 0x40a8ba
call sub.kernel32.dll_SetFileAttributesA
push 0
push dword [0x40abe8]
push 2
push 0
push 0
push 0x40000000
push 0x40a8ba
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x40319b
jmp 0x403259
mov dword [0x40ab5a], eax
push 0
push 0x40abe0
push dword [0x409582]
push esi
push dword [0x40ab5a]
call sub.kernel32.dll_WriteFile
or eax, eax
jne 0x4031c2
jmp 0x403259
push dword [0x40ab5a]
call sub.kernel32.dll_FlushFileBuffers
push dword [0x40ab5a]
call sub.kernel32.dll_CloseHandle
or eax, eax
jne 0x4031de
jmp 0x403259
test byte [0x40abec], 1
je 0x403257
mov dword [0x40ab62], 0x44
push 0x40aba6
push 0x40ab62
push 0
push 0
push 0x20
push 0
push 0
push 0
push 0x40a4ba
push 0x40a8ba
call sub.kernel32.dll_CreateProcessA
or eax, eax
jne 0x40321c
jmp 0x403259
test byte [0x40abec], 4
je 0x40323c
push 0xffffffffffffffff
push dword [0x40aba6]
call sub.kernel32.dll_WaitForSingleObject
push 0x7d0
call sub.kernel32.dll_Sleep
push 0x409586
push dword [0x40aba6]
call sub.kernel32.dll_GetExitCodeProcess
cmp dword [0x409586], 0
je 0x403257
jmp 0x403259
jmp 0x40325c
inc dword [ebp - 4]
test byte [0x40abec], 8
je 0x40327e
push 0x80
push 0x40a8ba
call sub.kernel32.dll_SetFileAttributesA
push 0x40a8ba
call sub.kernel32.dll_DeleteFileA
or bl, bl
je 0x403287
call fcn.00403eec
cmp dword [ebp - 8], 0
je 0x403295
push dword [ebp - 8]
call sub.kernel32.dll_GlobalFree
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret