Function at 0x406e20
Capabilities:
Extract resource via kernel32 functions
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 8]
push edi
push 0
push 0
push 0
push 2
push ebx
push 0x422d94
call fcn.00407420
mov edi, eax
add esp, 0x18
test edi, edi
je 0x406e52
pop edi
mov eax, 8
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x42f7bc]
add eax, 0xffffffed
push esi
mov dword [ebp - 0x14], eax
lea eax, [ebp - 8]
push 0
push eax
push ebx
call fcn.00406be0
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x406e7d
lea eax, [esi + 8]
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 8]
xor eax, eax
mov dword [ebp - 4], eax
test ebx, ebx
je 0x406edc
nop dword [eax]
push 0xf
add eax, esi
push 0x422da4
push eax
call fcn.00416680
add esp, 0xc
test eax, eax
jne 0x406ed1
mov ecx, dword [ebp - 4]
movq xmm0, qword [str.SetupMode:Unins]
add ecx, esi
movq qword [ecx], xmm0
mov eax, dword [0x422dbc]
mov dword [ecx + 8], eax
mov ax, word [0x422dc0]
mov word [ecx + 0xc], ax
mov al, byte [0x422dc2]
mov byte [ecx + 0xe], al
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp eax, ebx
jb 0x406e90
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x406f15
push esi
mov edi, 8
call fcn.00416679
add esp, 4
mov eax, edi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 8]
cmp dword [ebp - 4], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x406f3d
mov edi, 8
jmp 0x40701f
push ebx
call eax
push 0xe
push 0x66
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebx, eax
test ebx, ebx
je 0x406fa5
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x406fa5
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x406fa5
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceA]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x406fa5
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, dword [ebp - 0x10]
push eax
push dword [ebp - 0xc]
push 0
push 0x65
push 0xe
push ebx
call dword [sym.imp.KERNEL32.dll_UpdateResourceA]
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceA]
push 0
push 0x80
push 3
push 0
push 0
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x406efe
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push 0
push eax
push ebx
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x406fef
mov edi, 8
jmp 0x40701a
mov ecx, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 8]
push 0
sub eax, ecx
push edx
push eax
mov dword [ebp - 0x14], eax
lea eax, [esi + ecx]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x14]
mov ecx, 8
cmp dword [ebp - 0x18], eax
cmovne edi, ecx
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call eax
push esi
call fcn.00416679
add esp, 4
mov eax, edi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret