Function at 0x11014b30
Capabilities:
Delete file
Extract resource via kernel32 functions
Get session user name
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x13b8
call fcn.11027e70
mov eax, dword [0x11064c1c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x1350]
call fcn.11022180
lea ecx, [ebp - 0x1350]
mov dword [ebp - fcn.1100e530], vtable.CMSIDllEx.0
call fcn.110221d0
test eax, eax
je 0x11014bad
mov dword [ebp - 0x12f8], 0x643
call fcn.1100ab20
test eax, eax
jne 0x11014bcd
lea eax, [ebp - 0x12f8]
push eax
lea ecx, [ebp - 0x84]
push ecx
mov dword [ebp - 0x12f8], 0x40
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push str.MSICloseCICAgentHooks___not_systemm__user_s_n
call fcn.1100bc80
add esp, 4
lea ecx, [ebp - 0x1350]
call fcn.110221b0
mov eax, 0x643
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.110278cd
mov esp, ebp
pop ebp
ret 4
push ebx
push esi
push edi
push str.MSICloseCICAgentHooks_n
call fcn.1100bc80
add esp, 4
push str.psapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x13b8], edi
call fcn.11003750
xor ecx, ecx
xor ebx, ebx
mov eax, 0x7d00
mov edx, 4
mul edx
seto cl
mov dword [ebp - 0x1328], ebx
mov dword [ebp - 0x1324], ebx
mov dword [ebp - 0x1320], ebx
neg ecx
or ecx, eax
push ecx
call fcn.1101d040
add esp, 4
push str.EnumProcesses
mov esi, eax
push edi
mov dword [ebp - 0x12fc], esi
mov dword [ebp - 0x1308], ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x11014c83
lea ecx, [ebp - 0x1308]
push ecx
push 0x1f400
push esi
call eax
test eax, eax
je 0x1101507b
mov eax, dword [ebp - 0x1308]
shr eax, 2
xor ecx, ecx
mov dword [ebp - 0x1304], eax
mov dword [ebp - 0x12f0], ecx
test eax, eax
jle 0x11014d8e
mov ebx, dword [ebp - 0x30]
jmp 0x11014c96
push 0x78
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1101507b
mov esi, dword [ebp - 0x12fc]
mov edi, dword [esi + ecx*4]
cmp edi, 4
jbe 0x11014d79
mov dword [ebp - 0x1300], 0
test ebx, ebx
jne 0x11014cc5
mov edx, dword [ebp - 0x68]
push str.ProcessIdToSessionId
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
je 0x11014cd1
lea eax, [ebp - 0x1300]
push eax
push edi
call ebx
jmp 0x11014cd9
push 0x78
call dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x11014d73
lea edx, [ebp - 0x12f4]
push edx
lea eax, [ebp - 0x494]
xor ecx, ecx
push eax
push ecx
push esi
mov word [ebp - 0x494], cx
mov dword [ebp - 0x12f4], 0x104
call dword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
test eax, eax
je 0x11014d6c
lea ecx, [ebp - 0x494]
push 0x5c
push ecx
call fcn.1102798d
add esp, 8
test eax, eax
je 0x11014d6c
add eax, 2
push 0x1105766c
push eax
call fcn.110282a8
add esp, 8
test eax, eax
jne 0x11014d6c
mov edx, dword [ebp - 0x1300]
lea eax, [ebp - 0x1310]
push eax
lea ecx, [ebp - 0x1328]
mov dword [ebp - 0x1310], edx
mov dword [ebp - 0x130c], edi
call fcn.11014ab0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1304]
mov ecx, dword [ebp - 0x12f0]
inc ecx
mov dword [ebp - 0x12f0], ecx
cmp ecx, eax
jl 0x11014c90
mov edx, dword [0x110675dc]
push 0x104
lea ecx, [ebp - 0x69c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
lea esp, [esp]
movzx ecx, word [ebp + eax - 0x69c]
mov word [ebp + eax - 0x28c], cx
add eax, 2
test cx, cx
jne 0x11014db0
lea eax, [ebp - 0x28c]
push 0x5c
push eax
mov edi, str.CloseHookApp64.exe
call fcn.1102798d
mov ecx, 2
sub ecx, edi
add esp, 8
add ecx, eax
jmp 0x11014df0
movzx eax, word [edi]
mov word [ecx + edi], ax
add edi, 2
test ax, ax
jne 0x11014df0
mov edx, dword [0x110675dc]
push str.EMBEDDED
push 0x68
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x11014ed9
mov eax, dword [0x110675dc]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x11014ed9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [0x110675dc]
push edi
push ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
test esi, esi
je 0x11014ed9
test ebx, ebx
je 0x11014ed9
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push 0
push 3
push 0
push 0
push SysReAllocString
lea edx, [ebp - 0x28c]
push edx
call edi
cmp eax, 0xffffffff
je 0x11014e87
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x11014e94
push str.CloseHookApp64.exe_does_not_exist_n
call fcn.1100bc80
add esp, 4
push 0
push 0
push 2
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x28c]
push eax
call edi
mov edi, eax
cmp edi, 0xffffffff
je 0x11014ed9
push 0
lea ecx, [ebp - 0x12f4]
push ecx
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.Written_CloseHookApp64.exe_from_resource_n
call fcn.1100bc80
add esp, 4
mov esi, dword [ebp - 0x1328]
mov dword [ebp - 0x12f0], esi
cmp esi, dword [ebp - 0x1324]
je 0x11015062
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [esi]
mov edx, dword [esi + 4]
push eax
push edx
mov dword [ebp - 0x12f4], eax
lea eax, [ebp - 0x12ec]
push str.Found_pid_d__session__d_n
push eax
call ebx
lea ecx, [ebp - 0x12ec]
push ecx
call fcn.1100bc80
push 0
call fcn.1100d390
mov edi, eax
add esp, 0x18
test edi, edi
je 0x1101504d
push 4
lea edx, [ebp - 0x12f4]
push edx
push 0xc
push edi
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
push eax
push str.SetTokenInformation_ret__d_n
call fcn.1100bc80
xor eax, eax
push 0x40
push eax
mov dword [ebp - 0x1318], eax
mov dword [ebp - 0x1314], eax
mov dword [ebp - 0x1310], eax
mov dword [ebp - 0x130c], eax
lea eax, [ebp - 0x1390]
push eax
call fcn.110278e0
lea ecx, [ebp - 0x28c]
push ecx
lea edx, [ebp - 0xaec]
push str.__s_
push edx
mov dword [ebp - 0x1394], 0x44
mov dword [ebp - 0x1368], 0x80
call ebx
add esp, 0x20
lea eax, [ebp - 0x1394]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
or eax, 0x4000000
push eax
push 0
lea ecx, [ebp - 0x1318]
push ecx
push 0
push 0
lea edx, [ebp - 0xaec]
push edx
push edi
call fcn.11001c10
mov esi, eax
push esi
lea eax, [ebp - 0xaec]
push eax
lea ecx, [ebp - 0x12ec]
push str.Exec__s_ret__d_n
push ecx
call ebx
lea edx, [ebp - 0x12ec]
push edx
call fcn.1100bc80
add esp, 0x34
test esi, esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
jne 0x11015044
mov eax, dword [ebp - 0x1314]
push eax
call esi
mov ecx, dword [ebp - 0x1318]
push 0xea60
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push str.waited_n
call fcn.1100bc80
mov edx, dword [ebp - 0x1318]
add esp, 4
push edx
call esi
mov dword [ebp - 0x12f8], 0
push edi
call esi
mov esi, dword [ebp - 0x12f0]
add esi, 8
mov dword [ebp - 0x12f0], esi
cmp esi, dword [ebp - 0x1324]
jne 0x11014ef7
lea eax, [ebp - 0x28c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, dword [ebp - 0x13b8]
mov ebx, dword [ebp - 0x1328]
mov ecx, dword [ebp - 0x12fc]
push ecx
call fcn.11027544
add esp, 4
test ebx, ebx
je 0x11015097
push ebx
call fcn.11027544
add esp, 4
mov eax, dword [ebp - 0x68]
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
test eax, eax
je 0x110150a7
push eax
call esi
test edi, edi
je 0x110150ae
push edi
call esi
lea ecx, [ebp - 0x1350]
call fcn.110221b0
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x12f8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.110278cd
mov esp, ebp
pop ebp
ret 4