Function at 0x401016
Capabilities:
Check if file exists
Create process on windows
Delete file
Extract resource via kernel32 functions
Get common file path
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push 0x40eb84
xor esi, esi
push esi
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
je 0x40104b
push esi
push 0x40eba8
push 0x40ebb4
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x401271
mov eax, dword [0x411bf0]
push ebx
mov ebx, 0x411bf0
push edi
mov ecx, ebx
call dword [eax + 0xc]
add eax, 0x10
mov edi, 0xff
push edi
lea esi, [ebp - 4]
mov dword [ebp - 4], eax
call fcn.004012c9
mov esi, dword [ebp - 4]
cmp dword [esi - 8], edi
jge 0x401082
mov eax, 0x80070057
call fcn.00401000
mov dword [esi - 0xc], edi
push eax
xor ecx, ecx
mov edi, 0x104
push edi
mov word [esi + 0x1fe], cx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push dword [esi - 8]
push esi
call fcn.00401599
pop ecx
pop ecx
lea edx, [ebp - 4]
call fcn.00401368
push 0x40eb60
lea eax, [ebp - 4]
push eax
call fcn.00401295
push 0x40ebd0
lea eax, [ebp - 4]
push eax
call fcn.00401295
mov esi, dword [ebp - 4]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4010df
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x40ebdc
push 0x782
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x40115b
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp dword [esi - 4], 1
mov dword [ebp - 8], eax
jle 0x401120
push dword [esi - 0xc]
lea eax, [ebp - 4]
push eax
call fcn.004012ef
mov esi, dword [ebp - 4]
push 0x40ebec
push esi
call fcn.004018bd
pop ecx
pop ecx
push eax
push dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push 1
push dword [ebp - 8]
call fcn.00401a36
push dword [ebp - 0x10]
call fcn.00401b2f
add esp, 0x14
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FreeResource]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x401267
mov eax, dword [0x411bf0]
mov ecx, ebx
call dword [eax + 0xc]
add eax, 0x10
push edi
lea esi, [ebp - 8]
mov dword [ebp - 8], eax
call fcn.004012c9
mov esi, dword [ebp - 8]
cmp dword [esi - 8], edi
jl 0x401078
push edi
xor ecx, ecx
push eax
mov dword [esi - 0xc], edi
push ecx
mov word [esi + 0x208], cx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push dword [esi - 8]
push esi
call fcn.00401599
pop ecx
pop ecx
lea edx, [ebp - 8]
call fcn.00401368
push 0x5c
push esi
call fcn.004015b8
pop ecx
pop ecx
test eax, eax
je 0x401078
sub eax, esi
sar eax, 1
mov edi, eax
js 0x401078
mov eax, dword [esi - 0xc]
cmp edi, eax
mov dword [ebp - 0x10], eax
jge 0x401078
cmp dword [esi - 4], 1
jle 0x4011f6
push eax
lea eax, [ebp - 8]
push eax
call fcn.004012ef
mov esi, dword [ebp - 8]
xor eax, eax
mov word [esi + edi*2], ax
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 8]
call fcn.00401368
mov eax, dword [0x411bf0]
mov ecx, ebx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xc], eax
push esi
push 0x40ebf4
lea eax, [ebp - 0xc]
call fcn.00401486
mov eax, dword [ebp - 0xc]
cmp dword [eax - 4], 1
pop ecx
pop ecx
jle 0x40123f
push dword [eax - 0xc]
lea eax, [ebp - 0xc]
push eax
call fcn.004012ef
mov eax, dword [ebp - 0xc]
push 5
push 0x40ec00
push eax
push dword [ebp - 4]
push 0x40ec08
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea eax, [ebp - 0xc]
call fcn.00401278
lea eax, [ebp - 8]
call fcn.00401278
lea eax, [ebp - 4]
call fcn.00401278
pop edi
pop ebx
xor eax, eax
pop esi
leave
ret 0x10