Function at 0x4b8d20
Capabilities:
Check if file exists
Delete file
Extract resource via kernel32 functions
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55c4f3
mov eax, dword fs:[0]
push eax
sub esp, 0x4a0
mov eax, dword [0x5c30d8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x4a4], esi
mov eax, dword [0x5cf900]
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
test eax, eax
jne 0x4b8d9a
push 0x238
call fcn.004bc94c
add esp, 4
mov dword [ebp - 0x4a0], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x4b8d8c
mov ecx, eax
call fcn.004a0ce0
jmp 0x4b8d8e
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x5cf900], eax
mov ecx, eax
call fcn.004a3150
mov edx, eax
mov dword [ebp - 0x398], 7
xor eax, eax
mov dword [ebp - 0x39c], 0
mov word [ebp - 0x3ac], ax
cmp word [edx], ax
jne 0x4b8dc9
xor ecx, ecx
jmp 0x4b8de5
mov ecx, edx
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4b8dd0
sub ecx, esi
mov esi, dword [ebp - 0x4a4]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x3ac]
call fcn.00499940
xor eax, eax
mov dword [ebp - 4], 1
mov dword [ebp - 0x380], 7
mov dword [ebp - 0x384], 0
mov word [ebp - 0x394], ax
cmp word [ebx], ax
jne 0x4b8e1f
xor ecx, ecx
jmp 0x4b8e33
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4b8e24
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [ebp - 0x394]
call fcn.00499940
xor eax, eax
mov byte [ebp - 4], 2
push 0xffffffffffffffff
push eax
mov word [ebp - 0x364], ax
lea ecx, [ebp - 0x364]
lea eax, [ebp - 0x3ac]
mov dword [ebp - 0x350], 7
push eax
mov dword [ebp - 0x354], 0
call fcn.00499820
xor eax, eax
mov byte [ebp - 4], 3
push 0xffffffffffffffff
push eax
mov word [ebp - 0x34c], ax
lea ecx, [ebp - 0x34c]
lea eax, [ebp - 0x394]
mov dword [ebp - 0x338], 7
push eax
mov dword [ebp - 0x33c], 0
call fcn.00499820
lea eax, [ebp - 0x364]
mov byte [ebp - 4], 4
push eax
call fcn.0050287f
lea eax, [ebp - 0x34c]
push eax
call fcn.0050287f
cmp dword [ebp - 0x338], 8
lea ecx, [ebp - 0x34c]
push dword [ebp - 0x33c]
cmovae ecx, dword [ebp - 0x34c]
lea eax, [ebp - 0x364]
cmp dword [ebp - 0x350], 8
push ecx
cmovae eax, dword [ebp - 0x364]
push dword [ebp - 0x354]
push eax
call fcn.004a5650
add esp, 0x18
test eax, eax
je 0x4b8f31
cmp dword [ebp - 0x398], 8
lea eax, [ebp - 0x3ac]
cmovae eax, dword [ebp - 0x3ac]
sub esp, 0x18
mov ecx, esp
push eax
call fcn.004a0c80
call fcn.00502949
add esp, 0x18
mov ecx, esi
call fcn.004b99c0
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00507800
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x218]
push eax
call fcn.00500c3a
add esp, 4
push str.ZZZZ
push str.7zData
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x4b983f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push edi
mov dword [ebp - 0x4a0], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0x1869f
push 0x2710
mov dword [ebp - 0x4ac], eax
call fcn.00501d89
cdq
push edx
push eax
lea eax, [ebp - 0x43c]
push eax
call fcn.005021ba
add esp, 0x14
lea edi, [ebp - 0x218]
mov byte [ebp - 4], 5
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4b8fe0
mov ecx, 7
mov esi, str.PuddingDesktop
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [ebp - 0x218]
add edi, 0xfffffffe
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x4b9003
cmp dword [ebp - 0x428], 8
lea edx, [ebp - 0x43c]
mov eax, dword [0x564390]
cmovae edx, dword [ebp - 0x43c]
mov dword [edi], eax
mov esi, edx
nop dword [eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4b9030
lea edi, [ebp - 0x218]
sub edx, esi
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4b9046
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x218]
add ecx, 0xfffffffe
nop dword [eax]
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x4b9070
mov eax, dword [0x564394]
mov dword [ecx], eax
mov eax, dword [str.zData.7z]
mov dword [ecx + 4], eax
mov eax, dword [0x56439c]
mov dword [ecx + 8], eax
mov eax, dword [0x5643a0]
mov dword [ecx + 0xc], eax
mov eax, dword [0x5643a4]
mov dword [ecx + 0x10], eax
mov ax, word [0x5643a8]
mov word [ecx + 0x14], ax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4b90cd
lea eax, [ebp - 0x218]
push eax
call fcn.00500eb9
add esp, 4
push 0
push 0x80
push 1
push 0
push 1
push 0x40000000
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4b9120
push 0
lea eax, [ebp - 0x4a4]
mov dword [ebp - 0x4a4], 0
push eax
push dword [ebp - 0x4ac]
push dword [ebp - 0x4a0]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x104
lea eax, [ebp - 0x31c]
push 0
push eax
call fcn.00507800
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.0050280b
mov eax, dword [0x5cf900]
add esp, 0x14
test eax, eax
jne 0x4b9181
push 0x238
call fcn.004bc94c
add esp, 4
mov dword [ebp - 0x4a0], eax
mov byte [ebp - 4], 6
test eax, eax
je 0x4b9176
mov ecx, eax
call fcn.004a0ce0
jmp 0x4b9178
xor eax, eax
mov byte [ebp - 4], 5
mov dword [0x5cf900], eax
mov ecx, eax
call fcn.004a4a90
mov eax, dword [0x5cf900]
test eax, eax
jne 0x4b91c0
push 0x238
call fcn.004bc94c
add esp, 4
mov dword [ebp - 0x4a0], eax
mov byte [ebp - 4], 7
test eax, eax
je 0x4b91b5
mov ecx, eax
call fcn.004a0ce0
jmp 0x4b91b7
xor eax, eax
mov byte [ebp - 4], 5
mov dword [0x5cf900], eax
mov ecx, eax
call fcn.004a12d0
cmp dword [ebp - 0x380], 8
lea ecx, [ebp - 0x4a8]
push ecx
push fcn.004b9930
lea ecx, [ebp - 0x31c]
mov dword [ebp - 0x4a8], 0
lea eax, [ebp - 0x394]
cmovae eax, dword [ebp - 0x394]
push ecx
push eax
call fcn.0049a1a0
add esp, 0x10
mov dword [ebp - 0x368], 7
xor eax, eax
mov dword [ebp - 0x36c], 0
lea ecx, [ebp - 0x37c]
mov word [ebp - 0x37c], ax
push eax
push 0x560c80
call fcn.00499940
xor eax, eax
mov byte [ebp - 4], 8
push eax
push 0x560c80
lea ecx, [ebp - 0x424]
mov dword [ebp - 0x410], 7
mov dword [ebp - 0x414], 0
mov word [ebp - 0x424], ax
call fcn.00499940
xor eax, eax
mov byte [ebp - 4], 9
push eax
push 0x560c80
lea ecx, [ebp - 0x334]
mov dword [ebp - 0x320], 7
mov dword [ebp - 0x324], 0
mov word [ebp - 0x334], ax
call fcn.00499940
push ebx
lea ecx, [ebp - 0x484]
mov byte [ebp - 4], 0xa
call fcn.004a0c80
push ebx
lea ecx, [ebp - 0x46c]
mov byte [ebp - 4], 0xb
call fcn.004a0c80
push ebx
lea ecx, [ebp - 0x454]
mov byte [ebp - 4], 0xc
call fcn.004a0c80
push ebx
lea ecx, [ebp - 0x49c]
mov byte [ebp - 4], 0xd
call fcn.004a0c80
push ebx
lea ecx, [ebp - 0x40c]
mov byte [ebp - 4], 0xe
call fcn.004a0c80
push ebx
lea ecx, [ebp - 0x3f4]
mov byte [ebp - 4], 0xf
call fcn.004a0c80
push ebx
lea ecx, [ebp - 0x3dc]
mov byte [ebp - 4], 0x10
call fcn.004a0c80
push 0xa
mov byte [ebp - 4], 0x11
push str.PDTool.exe
lea ecx, [ebp - 0x484]
call fcn.004a5a50
push 0xd
push str.PDDesktop.exe
lea ecx, [ebp - 0x46c]
call fcn.004a5a50
push 0xa
push str.PDUtty.exe
lea ecx, [ebp - 0x454]
call fcn.004a5a50
mov eax, dword [0x5cf900]
test eax, eax
jne 0x4b9375
push 0x238
call fcn.004bc94c
add esp, 4
mov dword [ebp - 0x4a0], eax
mov byte [ebp - 4], 0x12
test eax, eax
je 0x4b936a
mov ecx, eax
call fcn.004a0ce0
jmp 0x4b936c
xor eax, eax
mov byte [ebp - 4], 0x11
mov dword [0x5cf900], eax
mov ecx, eax
call fcn.004a3180
mov edi, eax
mov eax, dword [0x5cf900]
test eax, eax
jne 0x4b93b6
push 0x238
call fcn.004bc94c
add esp, 4
mov dword [ebp - 0x4a0], eax
mov byte [ebp - 4], 0x13
test eax, eax
je 0x4b93ab
mov ecx, eax
call fcn.004a0ce0
jmp 0x4b93ad
xor eax, eax
mov byte [ebp - 4], 0x11
mov dword [0x5cf900], eax
mov ecx, eax
call fcn.004a3160
mov esi, eax
lea ecx, [ebp - 0x3c4]
push esi
call fcn.004a0c80
push 2
push 0
push 0x5643e0
lea ecx, [ebp - 0x3c4]
mov byte [ebp - 4], 0x14
call fcn.004a5ea0
mov dword [ebp - 0x4ac], eax
mov eax, dword [0x5cf900]
test eax, eax
jne 0x4b9421
push 0x238
call fcn.004bc94c
add esp, 4
mov dword [ebp - 0x4a0], eax
mov byte [ebp - 4], 0x15
test eax, eax
je 0x4b9416
mov ecx, eax
call fcn.004a0ce0
jmp 0x4b9418
xor eax, eax
mov byte [ebp - 4], 0x14
mov dword [0x5cf900], eax
mov ecx, eax
call fcn.004dfdb0
test eax, eax
mov ebx, 1
mov eax, 0
cmovne eax, ebx
mov dword [ebp - 0x4a0], eax
mov eax, dword [0x5cf900]
test eax, eax
jne 0x4b9475
push 0x238
call fcn.004bc94c
add esp, 4
mov dword [ebp - 0x4a4], eax
mov byte [ebp - 4], 0x16
test eax, eax
je 0x4b946a
mov ecx, eax
call fcn.004a0ce0
jmp 0x4b946c
xor eax, eax
mov byte [ebp - 4], 0x14
mov dword [0x5cf900], eax
mov ecx, eax
call fcn.004d4a40
mov edx, dword [ebp + 0xc]
lea ecx, [ebp - 0x424]
neg eax
mov dword [ebp - 0x4a4], ebx
push 0x14
sbb eax, eax
neg eax
test edx, edx
mov edx, ebx
cmove edx, dword [ebp - 0x4a0]
mov dword [ebp - 0x4a4], edx
mov edx, dword [ebp + 0xc]
test edx, edx
push str.InstallSpreadOperate
cmove ebx, eax
call fcn.00499940
mov ecx, edi
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4b94c0
sub ecx, edx
sar ecx, 1
push 0xe
lea ecx, [ebp - 0x334]
je 0x4b953d
push str.__OldClientID
call fcn.00499940
cmp word [edi], 0
jne 0x4b94ed
xor ecx, ecx
jmp 0x4b9501
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4b94f2
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x334]
call fcn.004a5a50
push 0xf
push str.___NewClientID
lea ecx, [ebp - 0x334]
call fcn.004a5a50
cmp word [esi], 0
jne 0x4b952a
xor ecx, ecx
jmp 0x4b9565
mov ecx, esi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4b9530
jmp 0x4b9561
push str.__NewClientID
call fcn.004a5a50
cmp word [esi], 0
jne 0x4b9551
xor ecx, ecx
jmp 0x4b9565
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4b9556
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x334]
call fcn.004a5a50
cmp dword [ebp - 0x4ac], 0xffffffff
je 0x4b958d
push 0x16
push str.___InstallMoniter_true
lea ecx, [ebp - 0x334]
call fcn.004a5a50
lea ecx, [ebp - 0x334]
test ebx, ebx
je 0x4b95a0
push 0x16
push str.___InstallService_true
jmp 0x4b95a7
push 0x17
push str.___InstallService_false
call fcn.004a5a50
cmp dword [ebp - 0x4a4], 0
lea ecx, [ebp - 0x334]
je 0x4b95c4
push 0x18
push str.___InstallStartMenu_true
jmp 0x4b95cb
push 0x19
push str.___InstallStartMenu_false
call fcn.004a5a50
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x4b95e9
push 0x16
push str.___InstallSilent_false
lea ecx, [ebp - 0x334]
call fcn.004a5a50
push 1
push 0x563324
lea ecx, [ebp - 0x37c]
call fcn.00499940
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x454]
push eax
lea ecx, [ebp - 0x37c]
call fcn.004a5940
push 2
push 0x563328
lea ecx, [ebp - 0x37c]
call fcn.004a5a50
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x424]
push eax
lea ecx, [ebp - 0x37c]
call fcn.004a5940
push 1
push 0x56459c
lea ecx, [ebp - 0x37c]
call fcn.004a5a50
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x334]
push eax
lea ecx, [ebp - 0x37c]
call fcn.004a5940
cmp dword [ebp - 0x368], 8
lea ecx, [ebp - 0x37c]
mov edx, 0x3a98
mov eax, 0x2710
cmovae ecx, dword [ebp - 0x37c]
test esi, esi
cmovne eax, edx
push eax
push 1
push ecx
call fcn.00500e2b
mov esi, dword [ebp - 0x4a8]
mov edi, 0x64
mov ecx, edi
mov eax, 0x55555556
sub ecx, esi
imul ecx
push edi
mov eax, edx
shr eax, 0x1f
add eax, edx
add esi, eax
push esi
mov dword [ebp - 0x4a8], esi
call fcn.004b9930
mov ecx, dword [ebp - 0x4a8]
mov eax, 0x55555556
sub edi, ecx
imul edi
push 0x64
mov eax, edx
shr eax, 0x1f
add eax, edx
add ecx, eax
push ecx
mov dword [ebp - 0x4a8], ecx
call fcn.004b9930
add esp, 0x1c
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x64
push 0x64
call fcn.004b9930
mov eax, dword [ebp - 0x3b0]
add esp, 8
cmp eax, 8
jb 0x4b9719
inc eax
lea ecx, [ebp - 0x3c4]
push eax
push dword [ebp - 0x3c4]
call fcn.00499ac0
xor eax, eax
mov dword [ebp - 0x3b0], 7
mov word [ebp - 0x3c4], ax
mov eax, dword [ebp - 0x3c8]
mov dword [ebp - 0x3b4], 0
cmp eax, 8
jb 0x4b9754
inc eax
lea ecx, [ebp - 0x3dc]
push eax
push dword [ebp - 0x3dc]
call fcn.00499ac0
xor eax, eax
mov dword [ebp - 0x3c8], 7
mov word [ebp - 0x3dc], ax
mov eax, dword [ebp - 0x3e0]
mov dword [ebp - 0x3cc], 0
cmp eax, 8
jb 0x4b978f
inc eax
lea ecx, [ebp - 0x3f4]
push eax
push dword [ebp - 0x3f4]
call fcn.00499ac0
xor eax, eax
mov dword [ebp - 0x3e0], 7
mov word [ebp - 0x3f4], ax
mov eax, dword [ebp - 0x3f8]
mov dword [ebp - 0x3e4], 0
cmp eax, 8
jb 0x4b97ca
inc eax
lea ecx, [ebp - 0x40c]
push eax
push dword [ebp - 0x40c]
call fcn.00499ac0
xor eax, eax
mov dword [ebp - 0x3f8], 7
lea ecx, [ebp - 0x49c]
mov dword [ebp - 0x3fc], 0
mov word [ebp - 0x40c], ax
call fcn.004a0f40
lea ecx, [ebp - 0x454]
call fcn.004a0f40
lea ecx, [ebp - 0x46c]
call fcn.004a0f40
lea ecx, [ebp - 0x484]
call fcn.004a0f40
lea ecx, [ebp - 0x334]
call fcn.004a0f40
lea ecx, [ebp - 0x424]
call fcn.004a0f40
lea ecx, [ebp - 0x37c]
call fcn.004a0f40
lea ecx, [ebp - 0x43c]
call fcn.004a0f40
mov eax, dword [ebp - 0x338]
cmp eax, 8
jb 0x4b985d
inc eax
lea ecx, [ebp - 0x34c]
push eax
push dword [ebp - 0x34c]
call fcn.00499ac0
xor eax, eax
mov dword [ebp - 0x338], 7
mov word [ebp - 0x34c], ax
mov eax, dword [ebp - 0x350]
mov dword [ebp - 0x33c], 0
cmp eax, 8
jb 0x4b9898
inc eax
lea ecx, [ebp - 0x364]
push eax
push dword [ebp - 0x364]
call fcn.00499ac0
xor eax, eax
mov dword [ebp - 0x350], 7
mov word [ebp - 0x364], ax
mov eax, dword [ebp - 0x380]
mov dword [ebp - 0x354], 0
cmp eax, 8
jb 0x4b98d3
inc eax
lea ecx, [ebp - 0x394]
push eax
push dword [ebp - 0x394]
call fcn.00499ac0
xor eax, eax
mov dword [ebp - 0x380], 7
mov word [ebp - 0x394], ax
mov eax, dword [ebp - 0x398]
mov dword [ebp - 0x384], 0
cmp eax, 8
jb 0x4b990e
inc eax
lea ecx, [ebp - 0x3ac]
push eax
push dword [ebp - 0x3ac]
call fcn.00499ac0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004bcc20
mov esp, ebp
pop ebp
ret 0xc