Function at 0x402800
Capabilities:
Check os version
Create directory
Delete file
Extract resource via kernel32 functions
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa44
mov eax, dword [0x410058]
mov dword [esp + 0xa40], eax
xor eax, eax
push ebx
push esi
push edi
mov byte [esp + 0x1a0], 0
mov ecx, 0x40
lea edi, [esp + 0x1a1]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x838], 0
mov ecx, 0x40
lea edi, [esp + 0x839]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x730], 0
mov ecx, 0x40
lea edi, [esp + 0x731]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x3b0], 0
mov ecx, 0x40
lea edi, [esp + 0x3b1]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x2a8], 0
mov ecx, 0x40
lea edi, [esp + 0x2a9]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 0x10]
lea edx, [esp + 0x1a0]
mov dword [esp + 0x1c], 0
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4028b6
mov ebx, dword [ebp + 8]
mov esi, dword [sym.imp.USER32.dll_LoadStringA]
push 0x64
lea eax, [esp + 0x34]
push eax
push 1
push ebx
call esi
push 0x64
lea ecx, [esp + 0x4bc]
push ecx
push 2
push ebx
call esi
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push 0x40d4e4
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x840]
push str._s__s
push eax
call esi
add esp, 0x10
lea ecx, [esp + 0x1a0]
push ecx
lea ecx, [esp + 0x1c]
call fcn.00402090
lea edx, [esp + 0x1a0]
push edx
lea ecx, [esp + 0x14]
call fcn.00402090
lea ecx, [esp + 0x18]
call fcn.00401170
mov edi, dword [esp + 0x18]
push edi
call dword [sym.imp.USER32.dll_CharLowerA]
mov eax, dword [edi - 8]
test eax, eax
jge 0x40294b
or edi, 0xffffffff
jmp 0x4029d3
push str._noalert
push edi
call fcn.0040316d
add esp, 8
test eax, eax
jne 0x402962
or edi, 0xffffffff
jmp 0x4029d3
sub eax, edi
mov edi, eax
js 0x4029d3
mov eax, dword [esp + 0x10]
mov esi, dword [eax - 8]
cmp edi, esi
mov ebx, 8
jge 0x4029b4
lea eax, [edi + 8]
cmp eax, esi
jle 0x402983
mov ebx, esi
sub ebx, edi
lea ecx, [esp + 0x10]
call fcn.00401170
mov eax, dword [esp + 0x10]
mov ecx, esi
sub ecx, edi
sub ecx, ebx
inc ecx
push ecx
lea edx, [edi + ebx]
add edx, eax
push edx
add eax, edi
push eax
call fcn.00403a90
mov ecx, dword [esp + 0x1c]
add esp, 0xc
sub esi, ebx
mov dword [ecx - 8], esi
mov eax, ecx
lea edx, [esp + 0x1a0]
sub edx, eax
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4029c0
mov ebx, dword [ebp + 8]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea edx, [esp + 0x98]
push edx
mov dword [esp + 0x9c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x9c], 6
jb 0x402a9b
test edi, edi
jge 0x402a9b
call fcn.00401f80
mov byte [esp + 0x17], al
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
mov cl, byte [esp + 0x17]
test eax, eax
setne al
test cl, cl
jne 0x402a7d
test al, al
jne 0x402a9b
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x9c]
push 0x40d448
push ecx
call fcn.00403dd2
add esp, 0xc
push 0
push 0x40d42c
lea edx, [esp + 0xa0]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x10]
call fcn.00401240
lea ecx, [esp + 0x18]
call fcn.00401240
or eax, 0xffffffff
mov ecx, dword [esp + 0xa4c]
call fcn.004032fb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
test al, al
je 0x402a9b
push 0
push 0x401fc0
push 0
push 0x8a
push ebx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
cmp eax, 1
jne 0x402a53
lea eax, [esp + 0x730]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea ecx, [esp + 0x734]
push ecx
lea edx, [esp + 0x3b8]
push str._s_08x
push edx
call esi
add esp, 0x10
push 0
lea eax, [esp + 0x3b4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov byte [esp + 0x520], 0
xor eax, eax
mov ecx, 0x40
lea edi, [esp + 0x521]
rep stosd dword es:[edi], eax
push 0x104
lea ecx, [esp + 0x524]
stosw word es:[edi], ax
push ecx
push 0
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor edx, edx
mov dword [esp + 0x25], edx
push 0x105
lea eax, [esp + 0x944]
mov dword [esp + 0x2d], edx
push eax
mov byte [esp + 0x2c], 0
mov byte [esp + 0x35], dl
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 3
lea ecx, [esp + 0x944]
push ecx
lea edx, [esp + 0x2c]
push edx
call fcn.004030da
lea eax, [esp + 0x30]
push eax
call fcn.00401e80
lea ecx, [esp + 0x530]
push ecx
call fcn.00401a70
lea edx, [esp + 0x534]
push edx
lea eax, [esp + 0x3c8]
push eax
lea ecx, [esp + 0x2c4]
push str._s_s
push ecx
call esi
add esp, 0x24
push str.APP_SETUP
push 0x89
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x402c0f
test edi, edi
je 0x402c0f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
lea edx, [esp + 0x2c0]
push edx
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
test esi, esi
je 0x402d7f
cmp esi, 0xffffffff
je 0x402d7f
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [esp + 0x20]
push eax
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x1a0]
push eax
lea ecx, [esp + 0x2ac]
push ecx
call fcn.004019e0
lea edx, [esp + 0x2b0]
mov ebx, eax
push edx
lea eax, [esp + 0x3bc]
push eax
call fcn.00401880
add esp, 0x10
test ebx, ebx
jne 0x402d1a
xor eax, eax
mov byte [esp + 0x628], bl
mov ecx, 0x40
lea edi, [esp + 0x629]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [esp + 0x98], bl
xor eax, eax
mov ecx, 0x40
lea edi, [esp + 0x99]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x98]
stosw word es:[edi], ax
push ecx
push 0x23
stosb byte es:[edi], al
call fcn.00401f10
lea eax, [esp + 0xa0]
add esp, 8
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402c96
sub eax, edx
lea edx, [esp + 0x30]
mov dword [esp + 0x20], eax
lea ecx, [esp + 0x628]
push edx
lea eax, [esp + 0x734]
je 0x402cbf
lea eax, [esp + 0x9c]
push eax
push str._s_s.ini
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
lea edx, [esp + 0x40]
add esp, 0x10
push edx
call fcn.004025d0
lea eax, [esp + 0x34]
push eax
call fcn.004018e0
lea ecx, [esp + 0x4c0]
push ecx
lea edx, [esp + 0x3c]
push edx
call fcn.00401ab0
lea eax, [esp + 0x40]
push eax
call fcn.00401c10
lea ecx, [esp + 0x44]
push ecx
call fcn.00401d70
add esp, 0x18
lea edx, [esp + 0x628]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 0x10]
mov edx, dword [0x410044]
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x402d44
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x402d44
push esi
call fcn.00403a67
add esp, 4
mov eax, dword [esp + 0x18]
mov ecx, dword [0x410044]
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x402d68
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x402d68
push esi
call fcn.00403a67
add esp, 4
mov eax, ebx
mov ecx, dword [esp + 0xa4c]
call fcn.004032fb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0
lea ecx, [esp + 0x83c]
push ecx
push 0x40d3e4
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea edx, [esp + 0x2a8]
push edx
lea eax, [esp + 0x3b4]
push eax
call fcn.00401880
mov eax, dword [esp + 0x18]
mov edx, dword [0x410044]
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea ecx, [eax - 0xc]
add esp, 8
cmp ecx, edx
je 0x402dd8
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x402dd8
push esi
call fcn.00403a67
add esp, 4
mov eax, dword [esp + 0x18]
mov ecx, dword [0x410044]
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x402dfc
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x402dfc
push esi
call fcn.00403a67
add esp, 4
mov ecx, dword [esp + 0xa4c]
or eax, 0xffffffff
call fcn.004032fb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10