Function at 0x404850
Capabilities:
Check if file exists
Create directory
Create process on windows
Delete file
Extract resource via kernel32 functions
Move file
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x254
mov eax, dword [0x427004]
xor eax, esp
mov dword [esp + 0x250], eax
push ebx
push esi
push edi
mov esi, ecx
lea eax, [esp + 0x50]
push esi
push 0x104
push eax
xor edi, edi
call fcn.0040b8e8
push 0x425024
lea eax, [esp + 0x60]
push 0x104
push eax
call fcn.00406dd9
push 0x42505c
lea eax, [esp + 0x6c]
push 0x104
push eax
call fcn.00406dd9
push esi
push 0x104
push 0x42c648
call fcn.0040b8e8
add esp, 0x30
push edi
push 0x42c648
push edi
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push 0x425024
push 0x104
push 0x42c648
call fcn.00406dd9
cmp dword [0x428318], edi
mov ecx, 0x42505c
mov eax, 0x425028
cmove eax, ecx
push eax
push 0x104
push 0x42c648
call fcn.00406dd9
add esp, 0x18
push 0x42c648
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
push 0x425088
cmp dword [0x428318], edi
je 0x404925
push 0x7a
jmp 0x404927
push 0x75
push 0
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_LoadResource]
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
push esi
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
push 0
push 0x80
push 2
push 0
push 3
push 0xc0000000
push 0x42c648
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
test esi, esi
je 0x404991
push 0
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
push ebx
push esi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
call esi
jmp 0x404997
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp dword [0x428318], edi
je 0x4049d4
lea eax, [esp + 0x50]
push eax
push 0x42c648
call fcn.0040e9e6
add esp, 8
test eax, eax
jne 0x4049d4
xor ecx, ecx
nop word [eax + eax]
movzx eax, word [esp + ecx + 0x50]
lea ecx, [ecx + 2]
mov word [ecx + 0x42c646], ax
test ax, ax
jne 0x4049c0
mov ecx, 0x425344
mov eax, 0x42c648
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x404a06
test dx, dx
je 0x404a02
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x404a06
add eax, 4
add ecx, 4
test dx, dx
jne 0x4049e0
xor eax, eax
jmp 0x404a0b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x404a25
xor ecx, ecx
movzx eax, word [esp + ecx + 0x50]
lea ecx, [ecx + 2]
mov word [ecx + 0x42c646], ax
test ax, ax
jne 0x404a11
push 0x42c648
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x404adc
xorps xmm0, xmm0
mov dword [esp + 0x1c], edi
lea eax, [esp + 0x14]
movlpd qword [esp + 0x38], xmm0
push eax
movlpd qword [esp + 0x44], xmm0
movlpd qword [esp + 0x4c], xmm0
mov dword [esp + 0x18], 0x3c
mov dword [esp + 0x1c], 0x400
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], 0x42c648
mov dword [esp + 0x2c], 0x425344
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], 5
mov dword [esp + 0x38], edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push 0xffffffffffffffff
push dword [esp + 0x50]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push dword [esp + 0x4c]
call esi
mov ecx, str.ITS_SB_App_Switch.exe
call fcn.00404b00
test eax, eax
jne 0x404abe
mov ecx, str.ITS_SB_App_SwitchNew.exe
call fcn.00404b00
test eax, eax
je 0x404adc
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
test eax, eax
mov ecx, 1
cmovne edi, ecx
mov ecx, dword [esp + 0x25c]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00404bab
mov esp, ebp
pop ebp
ret