Function at 0x401000
Capabilities:
Create process on windows
Extract resource via kernel32 functions
Get common file path

Disassembly:
sub esp, 0x378
push ebx
push esi
push edi
xor esi, esi
mov dword [esp + 0x10], esi
push ebp
push 0x21
push str.Install
push str.Install_Casablanca_Screensaver__
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 1
je 0x401032
mov eax, 1
jmp 0x4012e6
lea eax, [esp + 0x11c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp + 0x11c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [esp + eax + 0x11b], 0x5c
je 0x401070
lea eax, [esp + 0x11c]
push 0x40611c
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ebx, dword [esp + 0x38c]
push 0x406114
push 0xa
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
lea ecx, [esp + 0x18]
push 0x406068
mov dword [esp + 0x14], eax
lea eax, [esp + 0x120]
push eax
push str._s_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x28]
add esp, 0x10
push 0x406108
push ecx
call fcn.00401520
add esp, 8
test eax, eax
je 0x401117
push eax
call fcn.00401300
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x224]
add esp, 4
push eax
push str.File_:___s__already_exists____n_nOverwrite_this_file__
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x22c]
add esp, 0xc
push 0x34
push str.Install
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
je 0x401117
mov esi, 1
test esi, esi
jne 0x40117c
lea eax, [esp + 0x18]
push 0x4060cc
push eax
call fcn.00401520
add esp, 8
mov esi, eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push 1
push eax
mov eax, dword [esp + 0x1c]
push eax
call fcn.00401370
add esp, 0x10
cmp eax, 1
push esi
je 0x401174
call fcn.00401300
add esp, 4
push 0x10
push str.Install
push str.Write_error
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
jmp 0x4012e6
call fcn.00401300
add esp, 4
push ebp
call dword [sym.imp.KERNEL32.dll_FreeResource]
push 0x406114
push 0xb
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
mov ebp, eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
lea ecx, [esp + 0x18]
push str.Casablanca.scr
mov dword [esp + 0x14], eax
lea eax, [esp + 0x120]
push eax
push str._s_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x28]
add esp, 0x10
push 0x406108
push ecx
call fcn.00401520
add esp, 8
test eax, eax
je 0x401226
push eax
call fcn.00401300
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x224]
add esp, 4
push eax
push str.File_:___s__already_exists____n_nOverwrite_this_file__
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x22c]
add esp, 0xc
push 0x34
push str.Install
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
je 0x401226
mov dword [esp + 0x14], 1
cmp dword [esp + 0x14], 0
jne 0x4012c9
lea eax, [esp + 0x18]
push 0x4060cc
push eax
call fcn.00401520
add esp, 8
mov edi, eax
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push 1
push eax
mov eax, dword [esp + 0x1c]
push eax
call fcn.00401370
add esp, 0x10
cmp eax, 1
push edi
je 0x401287
call fcn.00401300
add esp, 4
push 0x10
push str.Install
push str.Write_error
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
jmp 0x4012e6
call fcn.00401300
lea eax, [esp + 0x120]
lea ecx, [esp + 0x1c]
add esp, 4
push str.Casablanca.scr
push eax
push str.desk.cpl_InstallScreenSaver__s_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x28]
add esp, 0x10
push 5
push 0
push ecx
push str.rundll32.exe
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x4012dd
push 0x30
push str.Install
push str.Install_aborted
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x378
ret 0x10