Function at 0x42b110
Capabilities:
Extract resource via kernel32 functions
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x453d00]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x414]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edi, [ebp - 0x414]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x42b144
mov ecx, 7
mov esi, str.FeiBaoClient_
rep movsd dword es:[edi], dword [esi]
push 0x445e0c
lea ecx, [ebp - 0x418]
movsw word es:[edi], word [esi]
call fcn.00408290
lea ecx, [ebp - 0x414]
push ecx
lea edx, [ebp - 0x418]
push 0x448dd4
push edx
call fcn.00414200
mov ebx, dword [ebp - 0x418]
add esp, 0xc
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x41c], eax
mov eax, ebx
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42b1b0
sub eax, edx
sar eax, 1
lea edi, [eax + eax + 1]
push edi
call fcn.0042c198
mov esi, eax
add esp, 4
test esi, esi
jne 0x42b214
push edi
call fcn.0042c198
mov esi, eax
add esp, 4
test esi, esi
jne 0x42b214
add ebx, 0xfffffff0
lea eax, [ebx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x42b3be
mov ecx, dword [ebx]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push ebx
call eax
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042d3b1
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x41c]
push 0
push 0
push ecx
push esi
push 0xffffffffffffffff
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0x448dcc
push 0xe4
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test edi, edi
jne 0x42b285
lea eax, [ebx - 0x10]
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42b3be
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042d3b1
mov esp, ebp
pop ebp
ret
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x41c], eax
test eax, eax
jne 0x42b2aa
lea eax, [ebx - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x42b262
push edi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x42b2c9
lea eax, [ebx - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x42b262
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x42b3b3
push 0x20
call fcn.0042da57
push 0x448dc8
push esi
call fcn.0042fd9b
mov esi, eax
add esp, 0xc
test esi, esi
je 0x42b30e
mov ecx, dword [ebp - 0x41c]
push esi
push 1
push ecx
push edi
call fcn.0042f9d3
push esi
call fcn.0042fc6b
add esp, 0x14
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x20a]
push eax
mov word [ebp - 0x20c], dx
call fcn.0042d580
add esp, 0xc
lea ecx, [ebp - 0x20c]
push ecx
push 0
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x20c]
add eax, 0xfffffffe
lea ebx, [ebx]
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x42b350
mov edx, dword [0x448db4]
mov ecx, dword [0x448db8]
mov dword [eax], edx
mov edx, dword [0x448dbc]
mov dword [eax + 4], ecx
mov ecx, dword [0x448dc0]
mov dword [eax + 8], edx
mov edx, dword [0x448dc4]
mov dword [eax + 0xc], ecx
push ecx
mov dword [eax + 0x10], edx
lea eax, [ebp - 0x20c]
mov ecx, esp
push eax
call fcn.00408290
push ecx
add ebx, 0xfffffff0
mov esi, esp
push ebx
call fcn.00401c10
add eax, 0x10
add esp, 4
mov dword [esi], eax
call fcn.004209a0
add esp, 8
lea ecx, [ebp - 0x418]
call fcn.004021f0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0042d3b1
mov esp, ebp
pop ebp
ret