Function at 0x1003d3ab
Capabilities:
Extract resource via kernel32 functions
Get disk size
Terminate process

Disassembly:
mov eax, 0x1005fc4b
call fcn.1005eaf8
sub esp, 0xd8
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
lea ecx, [ebp - 0x98]
push 3
pop edi
push edi
call fcn.1001ab0d
xor ebx, ebx
mov dword [ebp - 0x14], ebx
jmp 0x1003d3ea
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x98]
mov dword [eax + ecx*4], 0xb110c93b
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1003d3d7
mov dword [ebp - 0x14], ebx
jmp 0x1003d405
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xb4], 0xbb4ebb0c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jl 0x1003d3f4
mov eax, dword [ebp - 0x98]
lea ecx, [ebp - 0x98]
push 0xfffffffffffffff4
pop esi
mov dword [eax + 4], esi
call fcn.1001ab8f
mov dword [ebp - 0x30], 0x33a4
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], bl
je 0x1003d438
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], bl
je 0x1003d44b
push 0x1d5d
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
push edi
lea ecx, [ebp - 0x7c]
call fcn.1001ab0d
mov dword [ebp - 4], ebx
xor ecx, ecx
mov dword [ebp - 0x30], 6
inc ecx
mov dword [ebp - 0x28], 0xb7c7ce53
mov dword [ebp - 0x30], 0xfffffffd
push 9
pop eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x30], 0xd3c891c5
mov dword [ebp - 0x30], 0xfffffff6
mov dword [ebp - 0xb0], ecx
mov dword [ebp - 0xac], ecx
mov dword [ebp - 0xa8], ecx
mov dword [ebp - 0xa4], ecx
mov dword [ebp - 0x24], 0x7c1188e1
dec dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], 0x8876
mov dword [ebp - 0x20], 8
mov dword [ebp - 0x24], 0x63588c55
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x2c], 0xe0c23782
mov dword [ebp - 0x1c], 0x73d4c46
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x1c], ebx
jmp 0x1003d4ff
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x84], 0x88216928
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1003d4ee
imul eax, dword [ebp - 0x14], 0x4e58
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
add eax, 0x469209a4
je 0x1003d51c
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x2c]
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x2c], ecx
xor ecx, ecx
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x84], edx
mov eax, dword [ebp - 0x24]
cmp eax, edx
setle cl
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x24]
add eax, 7
imul ecx, eax
sub ecx, dword [ebp - 0x14]
sub ecx, 6
sub ecx, dword [ebp - 0x14]
neg ecx
sbb ecx, ecx
add ecx, 0xffffcf6a
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp - 0x24]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, 6
setge dl
xor ecx, ecx
add edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
cmp eax, edx
setl cl
xor edx, edx
sub ecx, 0x262
imul ecx, dword [ebp - 0x28]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setle dl
mov dword [ebp - 0x1c], edx
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1003d5d8
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x14], ebx
jmp 0x1003d5ed
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x7c]
mov dword [eax + ecx*4], 0xb110c93b
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1003d5dd
mov dword [ebp - 0x14], ebx
jmp 0x1003d605
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x54], 0xbb4ebb0c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jl 0x1003d5f7
mov eax, dword [ebp - 0x7c]
add eax, 4
mov dword [eax], esi
cmp dword [eax], 0x1c
jl 0x1003da63
mov dword [ebp - 0x20], 0x2b29949d
lea ecx, [ebp - 0x4c]
push edi
call fcn.1001ab0d
mov byte [ebp - 4], 1
mov dword [ebp - 0x28], 0x43da
cmp dword [ebp - 0x28], 0x454a
jle 0x1003d6a0
mov dword [ebp - 0x1c], ebx
mov edi, ebx
mov dword [ebp - 0x2c], 0x1d75
mov eax, ebx
mov dword [ebp - 0x24], ebx
mov esi, edi
mov dword [ebp - 0x14], ebx
mov ecx, eax
shl esi, cl
mov ecx, ebx
mov eax, esi
shl eax, cl
mov ecx, 0x106086b8
cdq
push edx
push eax
call fcn.1001a8dc
inc ebx
cmp ebx, 0x36d3
jl 0x1003d65a
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
push 0
pop ebx
cmp eax, 0x434e
jl 0x1003d651
mov esi, dword [ebp - 0x1c]
add edi, esi
dec dword [ebp - 0x2c]
jne 0x1003d64c
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x54f
jl 0x1003d643
push 3
pop edi
mov dword [ebp - 0x14], ebx
jmp 0x1003d6b5
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x4c]
mov dword [eax + ecx*4], 1
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1003d6a5
mov byte [ebp - 4], 2
cmp dword [ebp - 0x28], 0x433f
jge 0x1003d6d6
mov edx, 0x1000b990
mov ecx, 0x106086b8
call fcn.1001cde7
xor ecx, ecx
inc ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x14], ebx
jmp 0x1003d716
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x8c], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1003d705
mov dword [ebp - 0x14], ebx
jmp 0x1003d72f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x50], 0x6f37911b
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1003d721
mov eax, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x4c]
mov esi, dword [ebp - 0x4c]
cmp dword [eax], ecx
setl dl
neg edx
cmp edx, dword [esi + 8]
jge 0x1003d754
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp - 0x20]
cmp eax, 0x19a6fdd8
mov eax, dword [ebp - 0x8c]
setne cl
imul ecx, eax
xor eax, eax
cmp ecx, 0xd3650dfa
mov dword [ebp - 0x50], ecx
setne al
xor ecx, ecx
cmp eax, dword [esi + 8]
mov eax, dword [ebp - 0x4c]
setle cl
sub ecx, dword [eax + 4]
mov dword [ebp - 0x8c], ecx
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], bl
call fcn.1001ab8f
mov dword [ebp - 0x30], 0x7596
lea ecx, [ebp - 0x70]
push edi
call fcn.1001ab0d
mov byte [ebp - 4], 4
mov dword [ebp - 0x20], 0xfffffffd
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x14], ebx
jmp 0x1003d7d1
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x70]
mov dword [eax + ecx*4], 0x3342eb90
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1003d7c1
mov dword [ebp - 0x14], ebx
jmp 0x1003d7e9
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x3c], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1003d7db
mov dword [ebp - 0x20], 2
cmp dword [ebp - 0x20], ebx
jl 0x1003d8c3
mov dword [ebp - 0x14], 0xfffffffd
mov dword [ebp - 0x24], 5
mov dword [ebp - 0x1c], ebx
jmp 0x1003d820
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x40], 0x3196
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 1
jl 0x1003d812
mov dword [ebp - 0x14], ebx
jmp 0x1003d850
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
jne 0x1003da58
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1003d84d
push ebx
push 0x58a
call dword [sym.imp.USER32.dll_GetWindowInfo]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jle 0x1003d82b
mov eax, dword [ebp - 0x20]
xor edx, edx
mov ecx, dword [ebp - 0x70]
mov eax, dword [ecx + eax*4]
imul eax, dword [ecx + 4]
mov dword [ebp - 0x28], eax
mov esi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x38]
cmp eax, 1
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x38]
setle dl
imul ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x24]
setl cl
xor edx, edx
cmp ecx, 0xffffffff
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x70]
setne cl
add ecx, dword [eax + esi*4]
imul ecx, dword [eax + 8]
test ecx, ecx
jne 0x1003d8b1
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x14], ebx
dec dword [ebp - 0x20]
jns 0x1003d7ff
mov dword [ebp - 0x14], 0x60c7
cmp dword [ebp - 0x14], 0x6466
jle 0x1003d939
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], 0x6a9b
mov esi, dword [ebp - 0x24]
mov edi, ebx
mov eax, esi
lea ecx, [ebp - 0xcc]
xor eax, edi
cdq
push edx
push eax
call fcn.1000d6fa
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003d901
mov eax, dword [eax]
push eax
call fcn.10049b86
pop ecx
push ebx
push 1
lea ecx, [ebp - 0xcc]
call fcn.1001af5d
inc edi
cmp edi, 0x1b11
jl 0x1003d8e5
mov esi, dword [ebp - 0x2c]
add dword [ebp - 0x24], esi
dec dword [ebp - 0x28]
jne 0x1003d8e0
inc esi
mov dword [ebp - 0x2c], esi
cmp esi, 0x65e9
jl 0x1003d8d6
push 3
pop edi
mov dword [ebp - 0x20], 0x3c20
cmp dword [ebp - 0x20], 0x3e43
jle 0x1003d9f2
push 0x1dd0
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
mov edi, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x2c], ebx
mov eax, ebx
mov dword [ebp - 0x24], 0x6966
mov dword [ebp - 0x28], eax
mov esi, edi
mov dword [ebp - 0x58], ebx
mov ecx, eax
mov edi, ebx
sar esi, cl
mov ecx, edi
mov eax, esi
shl eax, cl
lea ecx, [ebp - 0xe4]
cdq
push edx
push eax
call fcn.1000d6fa
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003d995
mov eax, dword [eax]
push eax
call fcn.10049b86
pop ecx
push ebx
push 1
lea ecx, [ebp - 0xe4]
call fcn.1001af5d
inc edi
cmp edi, 0x2a15
jl 0x1003d977
mov eax, dword [ebp - 0x28]
mov esi, dword [ebp - 0x2c]
add eax, esi
dec dword [ebp - 0x24]
mov edi, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
jne 0x1003d96c
inc esi
mov dword [ebp - 0x2c], esi
cmp esi, 0x9f1
jl 0x1003d960
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x1d31
jl 0x1003d95d
push 0x1788
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
push 3
pop edi
mov byte [ebp - 0x15], bl
cmp dword [ebp - 0x20], 0x3bf3
jge 0x1003da09
push 0x1000ba5c
call fcn.10049b86
pop ecx
cmp byte [ebp - 0x15], 0
je 0x1003da26
push ebx
push ebx
push 0x26cb
push 0x21f0
push 0xaae
call dword [sym.imp.USER32.dll_ScrollWindow]
cmp dword [ebp - 0x14], 0x5e88
jge 0x1003da3a
push 0x1000ba08
call fcn.10049b86
pop ecx
lea ecx, [ebp - 0x70]
mov dword [ebp - 4], ebx
call fcn.1001ab8f
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x7c]
add eax, 4
inc dword [eax]
jmp 0x1003d613
push 0x169e
call dword [sym.imp.KERNEL32.dll_ExitProcess]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7c]
call fcn.1001ab8f
push edi
lea ecx, [ebp - 0x64]
call fcn.1001ab0d
mov dword [ebp - 0x20], 0xfffffff7
mov dword [ebp - 0x14], ebx
jmp 0x1003da94
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x64]
mov dword [eax + ecx*4], 0xc93b
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1003da84
mov dword [ebp - 0x14], ebx
jmp 0x1003daaf
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa0], 0xed3c15d
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1003da9e
mov dword [ebp - 0x20], ebx
jmp 0x1003daf1
mov dword [ebp - 0x1c], ebx
jmp 0x1003dacd
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x34], 0xbb4ebb0c
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 1
jl 0x1003dabf
mov dword [ebp - 0x34], 0xefc07e17
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1003daee
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jle 0x1003daba
mov edx, dword [ebp - 0x64]
xor ecx, ecx
mov eax, dword [edx + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp dword [edx + 4], eax
mov eax, dword [ebp - 0x64]
sete cl
xor edx, edx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x64]
setne dl
neg edx
mov dword [ebp - 0xa0], edx
call fcn.1001ab8f
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret