Function at 0x418230
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x848
mov dword [esp + 8], 0x1f5
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_FindResourceA]
call eax
sub esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4182bd
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], str.___Missing_resource__s
call fcn.00411655
movzx eax, byte [0x46703d]
xor eax, 1
test al, al
je 0x4182b1
call fcn.0041afa7
mov dword [esp + 0xc], 0x30
mov dword [esp + 8], str.Soffid_ESSO_installer
mov dword [esp + 4], str.Installer_file_is_corrupt
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
call eax
sub esp, 0x10
mov dword [esp], 2
call sub.msvcrt.dll_exit
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_SizeofResource]
call eax
sub esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x418302
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov dword [esp], str.___Wrong_resource_size__d
call fcn.00411655
call fcn.00411b5a
mov dword [esp], 2
call sub.msvcrt.dll_exit
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_LoadResource]
call eax
sub esp, 8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x418347
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], str.___Cannot_load_resource__s
call fcn.00411655
call fcn.00411b5a
mov dword [esp], 2
call sub.msvcrt.dll_exit
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_LockResource]
call eax
sub esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x418384
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], str.___Cannot_lock_resource__s
call fcn.00411655
call fcn.00411b5a
mov dword [esp], 2
call sub.msvcrt.dll_exit
mov dword [esp + 4], 0x449a35
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x4183bd
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [esp], str.___Cannot_create_file__s
call fcn.00411655
mov eax, 0
jmp 0x41852e
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], 0x7d0
mov dword [esp + 8], 0x30
mov dword [esp + 4], 0
lea eax, [ebp - 0x830]
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x82c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x830], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
lea eax, [ebp - 0x830]
mov dword [esp], eax
call fcn.00402501
sub esp, 0xc
lea eax, [ebp - 0x800]
mov dword [ebp - 0x820], eax
mov dword [ebp - 0x81c], 0x7d0
lea eax, [ebp - 0x830]
mov dword [esp], eax
call fcn.00403da1
sub esp, 4
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x418451
cmp dword [ebp - 0x28], 4
jne 0x418496
mov edx, dword [ebp - 0x81c]
mov eax, 0x7d0
sub eax, edx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x820]
lea edx, [ebp - 0x800]
sub eax, edx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x1c]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 1
mov dword [esp + 4], eax
lea eax, [ebp - 0x800]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
cmp dword [ebp - 0x28], 0
jne 0x4184a1
jmp 0x41841b
cmp dword [ebp - 0x28], 0xfffffffe
je 0x4184c7
cmp dword [ebp - 0x28], 0xfffffffe
jg 0x418513
cmp dword [ebp - 0x28], 0xfffffffd
je 0x418500
cmp dword [ebp - 0x28], 0xfffffffd
jg 0x418513
cmp dword [ebp - 0x28], 0xfffffffb
je 0x4184ed
cmp dword [ebp - 0x28], 0xfffffffc
je 0x4184da
jmp 0x418513
mov dword [esp], str.___BZIP_ERROR:_Error_de_parametro
call fcn.00411655
mov eax, 0
jmp 0x41852e
mov dword [esp], str.___BZIP_ERROR:_Corrupt_resource
call fcn.00411655
mov eax, 0
jmp 0x41852e
mov dword [esp], str.___BZIP_ERROR:_Compression_error
call fcn.00411655
mov eax, 0
jmp 0x41852e
mov dword [esp], str.___BZIP_ERROR:_Out_of_memory
call fcn.00411655
mov eax, 0
jmp 0x41852e
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.msvcrt.dll_fflush
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov eax, 1
leave
ret