Function at 0x41daf5
Capabilities:
Extract resource via kernel32 functions
Get common file path
Set current directory
Write file on windows

Disassembly:
push ebp
sub esp, 0x104
lea ebp, [esp - 4]
mov eax, dword [0x59b364]
xor eax, ebp
mov dword [ebp + 0x104], eax
push 0x64
mov eax, 0x5400b5
call fcn.005139e7
xor edi, edi
mov dword [ebp - 0x10], ecx
cmp dword [ecx + 0x24], edi
je 0x41db2a
mov al, 1
jmp 0x41dd24
mov dword [ebp - 0x1c], edi
call fcn.005002e0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x38]
push eax
call fcn.0043ab86
pop ecx
push edi
push eax
lea ecx, [ebp - 0x54]
mov dword [ebp - 4], edi
call fcn.0040984d
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x54]
push eax
mov byte [ebp - 4], 1
call fcn.0041d615
pop ecx
pop ecx
mov bl, al
neg bl
push edi
sbb bl, bl
push 1
lea ecx, [ebp - 0x54]
inc bl
mov byte [ebp - 4], 0
call fcn.0040970e
or dword [ebp - 4], 0xffffffff
push edi
push 1
lea ecx, [ebp - 0x38]
call fcn.00402a5d
test bl, bl
je 0x41db90
xor al, al
jmp 0x41dd24
push 0x73
lea eax, [ebp - 0x38]
pop esi
push eax
call fcn.0043af63
pop ecx
cmp dword [eax + 0x18], 0x10
mov dword [ebp - 4], 2
jb 0x41dbaf
mov eax, dword [eax + 4]
jmp 0x41dbb2
add eax, 4
push eax
call fcn.00513c45
pop ecx
cmp eax, 0x16
push edi
setge bl
or dword [ebp - 4], 0xffffffff
push 1
lea ecx, [ebp - 0x38]
call fcn.00402a5d
test bl, bl
je 0x41dbd5
push 0x74
pop esi
push 0x55527c
push esi
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebx, eax
cmp ebx, edi
je 0x41dd19
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
cmp esi, edi
je 0x41dd19
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
cmp eax, edi
jbe 0x41dd19
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
cmp esi, edi
je 0x41dd19
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x38]
push eax
call fcn.0041da2d
cmp dword [eax + 0x18], 0x10
mov dword [ebp - 4], 3
jb 0x41dc40
mov eax, dword [eax + 4]
jmp 0x41dc43
add eax, 4
push 0x556620
push eax
call fcn.00515310
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
push edi
push 1
lea ecx, [ebp - 0x38]
mov ebx, eax
call fcn.00402a5d
cmp ebx, edi
je 0x41dd19
push ebx
push 1
push dword [ebp - 0x14]
push esi
call fcn.005147be
push ebx
call fcn.00514a79
mov esi, 0x104
push esi
lea eax, [ebp]
push edi
push eax
call fcn.00513c50
add esp, 0x20
lea eax, [ebp]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov esi, dword [ebp - 0x10]
lea eax, [ebp]
push eax
lea ecx, [esi + 0x28]
call fcn.00402a3c
lea eax, [ebp - 0x38]
push eax
call fcn.0043ae38
pop ecx
cmp dword [eax + 0x18], 0x10
mov dword [ebp - 4], 4
jb 0x41dcc4
mov eax, dword [eax + 4]
jmp 0x41dcc7
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
or dword [ebp - 4], 0xffffffff
push edi
push 1
lea ecx, [ebp - 0x38]
call fcn.00402a5d
lea eax, [ebp - 0x70]
push eax
mov ecx, esi
call fcn.0041da2d
cmp dword [eax + 0x18], 0x10
mov dword [ebp - 4], 5
jb 0x41dcfa
mov eax, dword [eax + 4]
jmp 0x41dcfd
add eax, 4
push 8
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
or dword [ebp - 4], 0xffffffff
push edi
push 1
lea ecx, [ebp - 0x70]
mov dword [esi + 0x24], eax
call fcn.00402a5d
mov ecx, dword [ebp - 0x10]
xor eax, eax
cmp dword [ecx + 0x24], edi
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x104]
xor ecx, ebp
call fcn.005139d8
add ebp, 0x108
leave
ret