Function at 0x401f9c
Capabilities:
Check if file exists
Create directory
Extract resource via kernel32 functions
Get file attributes
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3d8]
sub esp, 0x44c
mov eax, dword [0x41c0a0]
xor eax, ebp
mov dword [ebp + 0x3d4], eax
mov eax, dword [ebp + 0x3e0]
push ebx
push esi
push edi
mov esi, 0xff
xor ebx, ebx
push esi
mov dword [ebp - 0x74], eax
lea eax, [ebp + 0x195]
push ebx
push eax
mov edi, ecx
mov byte [ebp + 0x194], bl
call fcn.00403aa0
lea eax, [ebp + 0x194]
push edi
push eax
call fcn.00405860
push dword [ebp - 0x74]
lea eax, [ebp + 0x194]
push eax
call fcn.00405870
lea eax, [ebp + 0x194]
push 0x418438
push eax
call fcn.00405870
push esi
lea eax, [ebp - 0x6b]
push ebx
push eax
mov byte [ebp - 0x6c], bl
call fcn.00403aa0
lea eax, [ebp + 0x194]
push eax
lea eax, [ebp - 0x6c]
push eax
call fcn.00405860
lea eax, [ebp - 0x6c]
push str.prefs.js
push eax
call fcn.00405870
add esp, 0x40
push esi
lea eax, [ebp + 0x95]
push ebx
push eax
mov byte [ebp + 0x94], bl
call fcn.00403aa0
lea eax, [ebp + 0x194]
push eax
lea eax, [ebp + 0x94]
push eax
call fcn.00405860
lea eax, [ebp + 0x94]
push str.compatibility.ini
push eax
call fcn.00405870
push esi
lea eax, [ebp + 0x295]
push ebx
push eax
mov byte [ebp + 0x294], bl
call fcn.00403aa0
lea eax, [ebp + 0x194]
push eax
lea eax, [ebp + 0x294]
push eax
call fcn.00405860
lea eax, [ebp + 0x294]
push str.searchplugins
push eax
call fcn.00405870
add esp, 0x38
mov byte [ebp - 0x6d], bl
mov byte [ebp - 0x6e], bl
mov byte [ebp - 0x6f], bl
mov byte [ebp - 0x70], bl
cmp byte [ebp + 0x3e8], bl
je 0x402582
lea eax, [ebp + 0x94]
push 0x418794
push eax
call fcn.00405aaf
mov esi, eax
pop ecx
pop ecx
cmp esi, ebx
je 0x402582
jmp 0x402143
lea eax, [ebp + 0x394]
push eax
call fcn.00405960
pop ecx
cmp eax, 0xe
jb 0x402143
lea eax, [ebp + 0x394]
push str.LastVersion2
push eax
mov byte [ebp + 0x3a1], bl
call fcn.004057d0
pop ecx
pop ecx
test eax, eax
je 0x40215b
lea eax, [ebp + 0x394]
push str.LastVersion1
push eax
call fcn.004057d0
pop ecx
pop ecx
test eax, eax
je 0x402161
lea eax, [ebp + 0x394]
push str.LastVersion3
push eax
call fcn.004057d0
pop ecx
pop ecx
test eax, eax
je 0x402167
push esi
lea eax, [ebp + 0x394]
push 0x40
push eax
call fcn.00405ac6
add esp, 0xc
test eax, eax
jne 0x4020e6
jmp 0x40216b
mov byte [ebp - 0x6e], 1
jmp 0x40216b
mov byte [ebp - 0x6f], 1
jmp 0x40216b
mov byte [ebp - 0x70], 1
push esi
call fcn.00405c85
pop ecx
cmp byte [ebp - 0x6f], bl
jne 0x402185
cmp byte [ebp - 0x6e], bl
jne 0x402185
cmp byte [ebp - 0x70], bl
je 0x402582
lea eax, [ebp + 0x294]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40219b
test al, 0x10
jmp 0x4021ab
push ebx
lea eax, [ebp + 0x294]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x402582
cmp byte [ebp - 0x6e], bl
je 0x4022c1
lea eax, [ebp + 0x294]
push str.BingSearch.xml
push eax
call fcn.00405870
lea eax, [ebp + 0x294]
push 0x4187d8
push eax
call fcn.00405aaf
mov esi, eax
add esp, 0x10
cmp esi, ebx
je 0x402582
push str._SearchPlugin_xmlns_http:__www.mozilla.org_2006_browser_search____n
push esi
call fcn.00405d01
push str._____ShortName_Bing_Search__ShortName__n
push esi
call fcn.00405d01
push str._____Description_Bing_Search__Description__n
push esi
call fcn.00405d01
push str._____InputEncoding_ISO_8859_1__InputEncoding__n
push esi
call fcn.00405d01
push str._____Image_width_16__height_16__data:image_x_icon_base64_AAABAAEAEBAAAAEAIABoBAAAFgAAACgAAAAQAAAAIAAAAAEAIAAAAAAAAAAAABMLAAATCwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPLSsP_nrXD_35JA_9SQP_fkkD_35JA_etcP_vyaD_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA7LQ_9d2EP_UbQD_1G0A_9RtAP_UbQD_1nYP_9RtAP_UbQD_1G0A_9d2EP_qtoD_AAAAAAAAAAAAAAAA5KRg_9RtAP_UbQD_2X8f_7In__89e_____________89e__7sif_9l_H__UbQD_1G0A_9SQP8AAAAA6raA_9RtAP_UbQD_3Igv__z17_______xOj__4rS__K0v__teP_____________4ZpP_9RtAP_UbQD_561w_9l_IP_UbQD_1G0A__ns3_______itL__xWm__8Vpv__Fab__xWm__97zP________z17__UbQD_1G0A_9RtAP_UbQD_1G0A_9RtAP___________08__8Vpv__Fab__xWm__8Vpv__T7z_____________3pE__9RtAP_UbQD_1G0A_9RtAP_UbQD_ezf______n3f__Fab__xWm__8Vpv__Fab__5jY_________PXv_9RtAP_UbQD_13YQ_9RtAP_UbQD_1G0A_9yIL__89e_______9Pu__K0v__itL__9Pu_________PXv_9yIL__UbQD_1G0A_q2gP_UbQD_1G0A_9RtAP_UbQD_1nYP_y_j__57N_____________57N__7sif_9l_H__UbQD_1G0A_SkYP8AAAAA1G0A_9RtAP_ZfyD_2X8g_9RtAP_UbQD_1G0A_9RtAP_UbQD_1G0A_9RtAP_UbQD_2X8g__JoP8AAAAAAAAAANRtAP_UbQD_35JA_wAAAAD35ND_6raA_GbUP_fkkD_35JA_GbUP_qtoD_9NvA_wAAAAAAAAAAAAAAAAAAAADUbQD_1G0A_9SQP8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA1G0A_9RtAP_fkkD_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANRtAP_UbQD_35JA_wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA__9TAPAPcwDAA2UAgAEuAAAAUAAAAC4AAABhAAAAZQAAAAAAAAEAAAADAAAQDwAAH_8AAB__AAAf_wAA__8AAA__os:Image__n
push esi
call fcn.00405d01
push str._____Url_type_text_html__method_GET__template_http:__bing.com.au_search___n
push esi
call fcn.00405d01
push str._________Param_name_q__value_searchTerms____n
push esi
call fcn.00405d01
push str._________Param_name_mkt__value_
push esi
call fcn.00405d01
add esp, 0x40
push str.en_au
push esi
call fcn.00405d01
mov edi, str._____n
push edi
push esi
call fcn.00405d01
push str._________Param_name_FORM__value_
push esi
call fcn.00405d01
push str.MIMW01
push esi
call fcn.00405d01
push edi
push esi
call fcn.00405d01
push str.______Url__n
push esi
call fcn.00405d01
push str._____SearchForm_
push esi
call fcn.00405d01
push str.http:__www.bing.com.au_
push esi
call fcn.00405d01
add esp, 0x40
push str.__SearchForm__n
push esi
call fcn.00405d01
push str.__SearchPlugin_
push esi
call fcn.00405d01
push esi
call fcn.00405c85
mov byte [ebp - 0x6d], 1
jmp 0x40257f
cmp byte [ebp - 0x70], bl
je 0x4023df
lea eax, [ebp + 0x294]
push str.BingSearch.xml
push eax
call fcn.00405870
lea eax, [ebp + 0x294]
push 0x4187d8
push eax
call fcn.00405aaf
mov esi, eax
add esp, 0x10
cmp esi, ebx
je 0x402582
push str._SearchPlugin_xmlns_http:__www.mozilla.org_2006_browser_search___xmlns:os_http:__a9.com___spec_opensearch_1.1____n
push esi
call fcn.00405d01
push str._____os:ShortName_Bing_Search__os:ShortName__n
push esi
call fcn.00405d01
push str._____os:Description_Bing_Search__os:Description__n
push esi
call fcn.00405d01
push str._____os:InputEncoding_ISO_8859_1__os:InputEncoding__n
push esi
call fcn.00405d01
push str._____os:Image_width_16__height_16__data:image_x_icon_base64_AAABAAEAEBAAAAEAIABoBAAAFgAAACgAAAAQAAAAIAAAAAEAIAAAAAAAAAAAABMLAAATCwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPLSsP_nrXD_35JA_9SQP_fkkD_35JA_etcP_vyaD_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA7LQ_9d2EP_UbQD_1G0A_9RtAP_UbQD_1nYP_9RtAP_UbQD_1G0A_9d2EP_qtoD_AAAAAAAAAAAAAAAA5KRg_9RtAP_UbQD_2X8f_7In__89e_____________89e__7sif_9l_H__UbQD_1G0A_9SQP8AAAAA6raA_9RtAP_UbQD_3Igv__z17_______xOj__4rS__K0v__teP_____________4ZpP_9RtAP_UbQD_561w_9l_IP_UbQD_1G0A__ns3_______itL__xWm__8Vpv__Fab__xWm__97zP________z17__UbQD_1G0A_9RtAP_UbQD_1G0A_9RtAP___________08__8Vpv__Fab__xWm__8Vpv__T7z_____________3pE__9RtAP_UbQD_1G0A_9RtAP_UbQD_ezf______n3f__Fab__xWm__8Vpv__Fab__5jY_________PXv_9RtAP_UbQD_13YQ_9RtAP_UbQD_1G0A_9yIL__89e_______9Pu__K0v__itL__9Pu_________PXv_9yIL__UbQD_1G0A_q2gP_UbQD_1G0A_9RtAP_UbQD_1nYP_y_j__57N_____________57N__7sif_9l_H__UbQD_1G0A_SkYP8AAAAA1G0A_9RtAP_ZfyD_2X8g_9RtAP_UbQD_1G0A_9RtAP_UbQD_1G0A_9RtAP_UbQD_2X8g__JoP8AAAAAAAAAANRtAP_UbQD_35JA_wAAAAD35ND_6raA_GbUP_fkkD_35JA_GbUP_qtoD_9NvA_wAAAAAAAAAAAAAAAAAAAADUbQD_1G0A_9SQP8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA1G0A_9RtAP_fkkD_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANRtAP_UbQD_35JA_wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA__9TAPAPcwDAA2UAgAEuAAAAUAAAAC4AAABhAAAAZQAAAAAAAAEAAAADAAAQDwAAH_8AAB__AAAf_wAA__8AAA__os:Image__n
push esi
call fcn.00405d01
push str._____os:Url_type_text_html__method_GET__template_http:__bing.com.au_search___n
push esi
call fcn.00405d01
push str._________os:Param_name_q__value_searchTerms____n
push esi
call fcn.00405d01
push str._________os:Param_name_mkt__value_
push esi
call fcn.00405d01
add esp, 0x40
push str.en_au
push esi
call fcn.00405d01
mov edi, str._____n
push edi
push esi
call fcn.00405d01
push str._________os:Param_name_FORM__value_
push esi
call fcn.00405d01
push str.MIMW01
push esi
call fcn.00405d01
push edi
push esi
call fcn.00405d01
push str.______os:Url__n
push esi
call fcn.00405d01
push str._____os:Url_type_application_x_suggestionsjson__method_GET__template_http:__api.bing.com_osjson.aspx_querysearchTermsamp_languagelanguageamp_formOSDJAS_____n
push esi
call fcn.00405d01
push str._____os:SearchForm_
push esi
call fcn.00405d01
add esp, 0x40
push str.http:__www.bing.com.au_
push esi
call fcn.00405d01
push str.__os:SearchForm__n
push esi
call fcn.00405d01
push str.__SearchPlugin_
push esi
call fcn.00405d01
push esi
call fcn.00405c85
add esp, 0x1c
mov byte [ebp - 0x6d], 1
jmp 0x402582
cmp byte [ebp - 0x6f], bl
je 0x402582
lea eax, [ebp + 0x294]
push str.BingSearch.src
push eax
call fcn.00405870
lea eax, [ebp + 0x294]
push 0x4187d8
push eax
call fcn.00405aaf
mov esi, eax
add esp, 0x10
cmp esi, ebx
je 0x402582
push str._SEARCH__n
push esi
call fcn.00405d01
push str.____version___1.0__n
push esi
call fcn.00405d01
push str.____name_Bing_Search__n
push esi
call fcn.00405d01
push str.____description_Bing_Search__n
push esi
call fcn.00405d01
push str.____method_GET__n
push esi
call fcn.00405d01
push str.____action_http:__bing.com.au_search__n
push esi
call fcn.00405d01
push str.____searchform_
push esi
call fcn.00405d01
push str.http:__www.bing.com.au_
push esi
call fcn.00405d01
add esp, 0x40
push 0x4199e0
push esi
call fcn.00405d01
push str.____queryCharset_ISO_8859_1__n
push esi
call fcn.00405d01
push 0x419a04
push esi
call fcn.00405d01
push str._____input_name_q__user__n
push esi
call fcn.00405d01
push str._____input_name_mkt__value_
push esi
call fcn.00405d01
push str.en_au
push esi
call fcn.00405d01
mov edi, 0x419a44
push edi
push esi
call fcn.00405d01
push str._____input_name_form__value_
push esi
call fcn.00405d01
add esp, 0x40
push str.MIMW01
push esi
call fcn.00405d01
push edi
push esi
call fcn.00405d01
push str.__SEARCH_
push esi
call fcn.00405d01
push esi
call fcn.00405c85
add esp, 0x1c
push 0x419a74
push 0x8d
push ebx
mov byte [ebp - 0x6d], 1
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
cmp esi, ebx
je 0x402582
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
je 0x402582
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x74], eax
cmp eax, ebx
je 0x402582
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
lea eax, [ebp + 0x294]
push eax
call fcn.00405960
lea eax, [ebp + eax + 0x294]
mov byte [eax - 1], 0x67
mov byte [eax - 2], 0x6e
mov byte [eax - 3], 0x70
lea eax, [ebp + 0x294]
mov dword [esp], 0x419a78
push eax
call fcn.00405aaf
mov esi, eax
pop ecx
pop ecx
cmp esi, ebx
je 0x402582
push esi
push edi
push 1
push dword [ebp - 0x74]
call fcn.00405f7f
push esi
call fcn.00405c85
add esp, 0x14
lea eax, [ebp - 0x6c]
push 0x419a7c
push eax
call fcn.00405aaf
mov esi, eax
pop ecx
pop ecx
cmp esi, ebx
je 0x402623
cmp byte [ebp + 0x3e4], bl
je 0x4025c8
push str.user_pref__browser.startup.homepage____
push esi
call fcn.00405d01
push str.http:__ninemsn.com.au_ocidB144MSN16A15E178G
push esi
call fcn.00405d01
push str.____n
push esi
call fcn.00405d01
add esp, 0x18
cmp byte [ebp + 0x3e8], bl
je 0x40261c
push str.user_pref__keyword.URL____http:__bing.com.au_search_mkt
push esi
call fcn.00405d01
push str.en_au
push esi
call fcn.00405d01
push str.FORM
push esi
call fcn.00405d01
push str.MIMW01
push esi
call fcn.00405d01
push str.q____n
push esi
call fcn.00405d01
add esp, 0x28
cmp byte [ebp - 0x6d], bl
je 0x40261c
push str.user_pref__browser.search.selectedEngine____Bing_Search____n
push esi
call fcn.00405d01
pop ecx
pop ecx
push esi
call fcn.00405c85
pop ecx
mov ecx, dword [ebp + 0x3d4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403a8a
add ebp, 0x3d8
leave
ret