Function at 0x401800
Capabilities:
Check if file exists
Copy file
Create process on windows
Delete file
Extract resource via kernel32 functions
Get common file path
Get file attributes
Write and execute a file
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x40de4b
mov eax, dword fs:[0]
push eax
mov eax, 0x6838
mov dword fs:[0], esp
call fcn.00405510
mov eax, dword [0x412240]
xor eax, esp
push ebx
push ebp
push esi
mov esi, dword [esp + 0x6854]
push edi
lea ecx, [esp + 0x1444]
mov dword [esp + 0x6844], eax
mov eax, dword [esp + 0x6860]
push ecx
push 0x400
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea edx, [esp + 0x1444]
push edx
lea eax, [esp + 0x3048]
push eax
call fcn.004054e7
lea ecx, [esp + 0x304c]
push str.TurboMeeting
push ecx
call fcn.004054bd
add esp, 0x10
lea edx, [esp + 0x3044]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x400
lea eax, [esp + 0x5c48]
push eax
lea ecx, [esp + 0x304c]
push ecx
call fcn.00401000
add esp, 0xc
push str.ZIP_DATA_FILE
push 0x2711
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x401a1f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x401a1f
lea edx, [esp + 0x1444]
push edx
lea eax, [esp + 0x2448]
push eax
call fcn.004054e7
lea ecx, [esp + 0x244c]
push 0x40e280
push ecx
call fcn.004054bd
add esp, 0x10
lea edx, [esp + 0x2444]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x401a1f
push 0
push 0x80
push 2
push 0
push 1
push 0xc0000000
lea eax, [esp + 0x245c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
lea ecx, [esp + 0x14]
push ecx
push ebp
mov edi, eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x2444]
push 0x40e27c
push edx
call fcn.00404d94
mov edi, eax
add esp, 8
test edi, edi
je 0x401a1f
mov eax, dword [esp + 0x10]
inc eax
push eax
call fcn.004054b8
mov ecx, dword [esp + 0x14]
push edi
push ecx
mov ebp, eax
push 1
push ebp
call fcn.0040546c
mov edx, dword [esp + 0x24]
mov byte [edx + ebp], 0
mov eax, dword [esp + 0x24]
lea ecx, [eax + eax + 0x400]
push ecx
call fcn.004054b8
add esp, 0x18
push ebp
lea ecx, [esp + 0x2c]
mov ebx, eax
call fcn.004017c0
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x2c]
push ebx
push eax
call fcn.00401200
add esp, 0xc
lea ecx, [esp + 0x28]
call fcn.004015b0
mov ecx, dword [esp + 0x14]
push edi
mov byte [ecx + ebx], 0
call fcn.00404c89
lea edx, [esp + 0x2448]
push 0x40e18c
push edx
call fcn.00404d94
mov edi, eax
add esp, 0xc
test edi, edi
je 0x401a1f
push ebx
push 0x40e278
push edi
call fcn.00404cda
push edi
call fcn.00404c89
add esp, 0x10
push str.ZIP_DATA_FILE
push 0x2712
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x401dee
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x401dee
lea eax, [esp + 0x1444]
push eax
lea ecx, [esp + 0x3848]
push ecx
call fcn.004054e7
lea edx, [esp + 0x384c]
push str._turbo_meet.zip
push edx
call fcn.004054bd
add esp, 0x10
push 0
push 0x80
push 2
push 0
push 1
push 0xc0000000
lea eax, [esp + 0x385c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x401dee
push 0
lea ecx, [esp + 0x18]
push ecx
push ebp
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x1444]
push edx
lea eax, [esp + 0xc48]
push eax
call fcn.004054e7
lea ecx, [esp + 0xc4c]
push str.TurboMeeting
push ecx
call fcn.004054bd
add esp, 0x10
lea edx, [esp + 0xc44]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x400
lea eax, [esp + 0x2c48]
push eax
lea ecx, [esp + 0x384c]
push ecx
call fcn.00401000
push 0x400
lea edx, [esp + 0x4054]
push edx
lea eax, [esp + 0xc58]
push eax
call fcn.00401000
add esp, 0x18
lea ecx, [esp + 0x1c]
call fcn.00401e20
lea ecx, [esp + 0x4044]
push ecx
lea edx, [esp + 0x2c48]
push edx
lea ecx, [esp + 0x24]
mov dword [esp + 0x6858], 0
call fcn.00402150
push 0x400
lea eax, [esp + 0x448]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x400
lea ecx, [esp + 0x48]
push ecx
lea edx, [esp + 0x44c]
push edx
call fcn.00401000
lea eax, [esp + 0x50]
add esp, 0xc
lea edx, [eax + 1]
jmp 0x401ba0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401ba0
sub eax, edx
mov ebx, 0x5c
js 0x401bc0
cmp byte [esp + eax + 0x44], bl
je 0x401bbb
dec eax
jns 0x401bb0
jmp 0x401bc0
mov byte [esp + eax + 0x44], 0
push 0x400
lea eax, [esp + 0x5448]
push eax
push 0xffffffffffffffff
lea ecx, [esp + 0x50]
push ecx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea edx, [esp + 0x444]
push edx
call fcn.00404da7
add esp, 4
test eax, eax
jl 0x401c02
cmp word [esp + eax*2 + 0x444], bx
je 0x401c02
dec eax
jns 0x401bf5
lea eax, [esp + eax*2 + 0x446]
push eax
lea ecx, [esp + 0x448]
push 0x40e250
push ecx
call fcn.00405314
lea edx, [esp + 0x450]
push edx
call fcn.00404da7
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
add esp, 0x10
push 0
push 0
push 0
push 0
mov ebp, eax
push ebp
lea eax, [esp + 0x458]
push eax
push 0
push 0xfde9
call edi
mov esi, eax
cmp esi, 0x400
jge 0x401c7f
push 0
push 0
push esi
lea ecx, [esp + 0x1c50]
push ecx
push ebp
lea edx, [esp + 0x458]
push edx
push 0
push 0xfde9
call edi
mov byte [esp + esi + 0x1c44], 0
mov ebx, dword [esp + 0x18]
push ebx
call fcn.00404da7
add esp, 4
push 0
push 0
push 0
push 0
mov ebp, eax
push ebp
push ebx
push 0
push 0xfde9
call edi
mov esi, eax
cmp esi, 0x400
jge 0x401ccb
push 0
push 0
push esi
lea eax, [esp + 0x2050]
push eax
push ebp
push ebx
push 0
push 0xfde9
call edi
mov byte [esp + esi + 0x2044], 0
push str.TMPackageName.txt
lea ecx, [esp + 0xc48]
push ecx
lea edx, [esp + 0x604c]
push str._s_s
push edx
call fcn.00405314
lea eax, [esp + 0x6054]
push 0x40e18c
push eax
call fcn.00404d94
mov esi, eax
add esp, 0x18
test esi, esi
je 0x401d3f
lea ecx, [esp + 0x1c44]
push ecx
push esi
call fcn.00404cda
lea edx, [esp + 0x204c]
push edx
push 0x40e190
push esi
call fcn.00404cda
lea eax, [esp + 0x58]
push eax
push str._n___WorkingDirectory____s____WorkingDirectory___
push esi
call fcn.00404cda
push esi
call fcn.00404c89
add esp, 0x24
push 0x40e1d0
lea ecx, [esp + 0xc48]
push ecx
lea edx, [esp + 0x4c4c]
push 0x40e1c4
push edx
call fcn.00405314
push str.TMInstaller.exe
lea eax, [esp + 0xc58]
push eax
lea ecx, [esp + 0x445c]
push 0x40e1c4
push ecx
call fcn.00405314
add esp, 0x20
call fcn.00401060
test al, al
je 0x401dba
push 0
lea edx, [esp + 0x4448]
push edx
lea eax, [esp + 0x4c4c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x401dba
push 0
lea ecx, [esp + 0x5448]
push ecx
push ebx
lea edx, [esp + 0x4450]
push edx
jmp 0x401dcd
push 0
lea eax, [esp + 0x5448]
push eax
push ebx
lea ecx, [esp + 0x4c50]
push ecx
push 0x40e194
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x6850], 0xffffffff
call fcn.00401e30
mov ecx, dword [esp + 0x6848]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x6838]
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00404dee
add esp, 0x6844
ret 0x10