Function at 0x422990
Capabilities:
Delete file
Extract resource via kernel32 functions
Get common file path
Write file on windows

Disassembly:
sub esp, 0x414
mov eax, dword [0x4e3e9c]
xor eax, esp
mov dword [esp + 0x410], eax
push ebp
push esi
push edi
mov esi, ecx
lea ebp, [esi + 0xa10]
push ebp
lea eax, [esi + 0x610]
push eax
push str._s_s
mov dword [esp + 0x20], eax
lea eax, [esp + 0x28]
push 0x200
push eax
call fcn.00436a40
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
add esp, 0x14
push 0
push 2
push 3
push 0
push 0
push SysReAllocString
lea ecx, [esp + 0x34]
push ecx
call edi
cmp eax, 0xffffffff
je 0x422a17
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebp
mov ecx, dword [esp + 0x410]
xor ecx, esp
call fcn.0048e5ae
add esp, 0x414
ret
mov edx, dword [esi + 0xb74]
push edx
call fcn.00408510
add esp, 4
test eax, eax
je 0x422b92
cmp byte [esi + 0x810], 0
lea eax, [esi + 0x810]
je 0x422b6f
push eax
lea eax, [esp + 0x220]
push 0x200
push eax
call fcn.0048ef9c
add esp, 0xc
push ebx
lea edx, [esp + 0x220]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
test ebx, ebx
je 0x422b65
movzx eax, word [esi + 0xb74]
push 0xa
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x422b65
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x422b65
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push ebx
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
test ebx, ebx
mov dword [esp + 0x14], ebx
je 0x422b65
push 0
push 2
push 2
push 0
push 0
push 0xc0000000
lea ecx, [esp + 0x38]
push ecx
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x422bbc
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 2
push 2
push 0
push 0
push 0xc0000000
lea eax, [esp + 0x38]
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x422bbc
mov ebx, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x200
lea ecx, [esp + 0x24]
push ecx
call ebx
push 0x4ba584
lea edx, [esp + 0x24]
push 0x200
push edx
call fcn.00436830
push ebp
lea eax, [esp + 0x30]
push 0x200
push eax
call fcn.00436830
add esp, 0x18
push 0
push 2
push 2
push 0
push 0
push 0xc0000000
lea ecx, [esp + 0x38]
push ecx
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x422bac
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
jmp 0x422be5
push 0x200
lea ecx, [esp + 0x220]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x422a57
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x410]
xor ecx, esp
call fcn.0048e5ae
add esp, 0x414
ret
mov edx, dword [esp + 0x18]
push 0x200
push edx
call ebx
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push 0
lea eax, [esp + 0x20]
push eax
push ebx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
test edi, edi
jne 0x422bdc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [esp + 0x420]
pop ebx
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.0048e5ae
add esp, 0x414
ret