Function at 0x1001287
Capabilities:
Accept command line arguments
Create process on windows
Delete file
Extract resource via kernel32 functions
Get common file path
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6ac
mov eax, dword [0x1002004]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov dword [ebp - 0x64c], 1
call fcn.01001239
mov dword [ebp - 0x658], eax
movzx eax, ax
push 0xa
push eax
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
cmp edi, esi
je 0x10014bd
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp eax, esi
mov dword [ebp - 0x654], eax
je 0x10014bd
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, esi
je 0x10014bd
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp eax, esi
mov dword [ebp - 0x648], eax
je 0x10014bd
lea eax, [ebp - 0x644]
push eax
push 0x2bc
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x10014bd
mov ebx, dword [sym.imp.msvcrt.dll_wcslen]
lea eax, [ebp - 0x644]
push eax
call ebx
pop ecx
lea edi, [ebp + eax*2 - 0x644]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
mov eax, dword [ebp - 0x658]
push 0x64
pop ecx
cdq
idiv ecx
push eax
push 0x1001128
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push esi
push 0x80
push 2
push esi
push 7
push 0x120116
lea eax, [ebp - 0x644]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x10014bd
push esi
lea eax, [ebp - 0x650]
push eax
push dword [ebp - 0x654]
push dword [ebp - 0x648]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10013a5
mov dword [ebp - 0x650], esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x654]
cmp dword [ebp - 0x650], eax
jne 0x100149b
push 0x11
pop ecx
xor eax, eax
lea edi, [ebp - 0x6ac]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x6ac]
push eax
mov dword [ebp - 0x6ac], 0x44
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xor eax, eax
lea edi, [ebp - 0x668]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor edi, edi
cmp eax, esi
mov dword [ebp - 0x648], eax
je 0x1001430
push eax
call ebx
pop ecx
lea eax, [eax + eax + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
cmp edi, esi
je 0x10014bd
push dword [ebp - 0x648]
push edi
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
lea eax, [ebp - 0x668]
push eax
lea eax, [ebp - 0x6ac]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push edi
lea eax, [ebp - 0x644]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x100149b
push dword [ebp - 0x664]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push 0xffffffffffffffff
push dword [ebp - 0x668]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x64c]
push eax
push dword [ebp - 0x668]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x1001493
mov dword [ebp - 0x64c], 1
push dword [ebp - 0x668]
call edi
lea eax, [ebp - 0x644]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x10014bd
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0x14
jl 0x100149b
push dword [ebp - 0x64c]
call dword [sym.imp.KERNEL32.dll_ExitProcess]