Function at 0x6faf40
Capabilities:
Encode data using xor
Extract resource via kernel32 functions
Terminate process

Disassembly:
push 0x8d4
mov eax, 0x7ae54b
call fcn.00772fd1
mov ebx, ecx
mov dword [ebp - 0x8d4], ebx
call fcn.006ec2c0
push 0xfffffffffffffff0
mov ecx, ebx
call fcn.006f98a5
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0xff3fffff
mov ecx, ebx
or eax, 0x6000000
push eax
push 0xfffffffffffffff0
call fcn.006f98a5
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
lea eax, [ebp - 0x470]
mov ecx, ebx
push eax
call fcn.006f98a5
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0x464]
mov ecx, ebx
sub eax, dword [ebp - 0x46c]
push 0x20
push eax
mov eax, dword [ebp - 0x468]
sub eax, dword [ebp - 0x470]
push eax
push dword [ebp - 0x46c]
push dword [ebp - 0x470]
push 0
call fcn.006f98a5
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
xor eax, eax
mov dword [ebp - 0x8cc], eax
mov dword [ebp - 0x8c8], eax
mov dword [ebp - 0x8c4], eax
push 0x3e
pop ecx
mov esi, str.ZZnawTycvT2F8QOKi7JELYwUPlztQf1DKjhRIesAfPeJV7dqSxQWdxfN4zNqJWO3uy2J1wsswiqroLmpnHqVXqFqBUASvrvEb3dUbmeEuxhsR6UAnUQqTctaiyv8IF1ZqdMo6P2N5GmkS7H9giUxgu73QwI2YqsB6xprRb6SChAx617HmQnoeTBzVkpVFrzrlN3suxYQG7OlcHRDPvFBbgTs5PWmQjVDsMgpRkGMYAq70kqjiZlLJvY6
mov dword [ebp - 4], eax
lea edi, [ebp - 0x10c]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x4a0]
movsb byte es:[edi], byte [esi]
call fcn.00405a50
lea eax, [ebp - 0x4a0]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x8cc]
call fcn.004082f0
push 0
push 1
lea ecx, [ebp - 0x4a0]
mov byte [ebp - 4], 0
call fcn.004096c0
push dword [ebx + 4]
lea ecx, [ebx + 0x38]
call fcn.006f5606
lea eax, [ebx + 0x30]
push eax
lea ecx, [ebx + 0x38]
call fcn.006f47ae
xor eax, eax
mov dword [ebp - 0x8c0], eax
mov dword [ebp - 0x8bc], eax
mov dword [ebp - 0x8b8], eax
push 0x61
pop ecx
mov esi, str.mCpbksy9lUayXky7qgyjLHQ8F3GAW6A7sHD6awlukifPpJx9FFmOnY2mdyuciQ3wZlaOy8agqnPH1WvmLGF5LDuO6HZWTsofqu6FJ0CgW1I7bvZcqGhz2QrS6hW4dKndUWRMZg1KJ6KQt6QvjCWyhV8WkrMe1wDjcyWPYVfaRo50lEhEX1By6BD8BZuUOBmvHXMIAyMotUvKA1XyyPXA2aQSVOCmNZzp5rtbCwrbzLesmVfeKTqQBki1Bk1lTGNV3bKIk2A60Pv4eIxcWyuUoYLn8Fm1SPZ2W2aowFnPwmk2WqS0MCMUJXPinwfbvaBrI4gbwQvgUNTOxsVEj86YMJLPffDbL1NGu2q78riI207pxZWOQH0A1iaKe6tkIOG5NtN
mov byte [ebp - 4], 2
lea edi, [ebp - 0x290]
lea eax, [ebp - 0x290]
rep movsd dword es:[edi], dword [esi]
push eax
lea ecx, [ebp - 0x4b8]
call fcn.00405a50
lea eax, [ebp - 0x4b8]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x8c0]
call fcn.004082f0
push 0
push 1
lea ecx, [ebp - 0x4b8]
mov byte [ebp - 4], 2
call fcn.004096c0
lea ecx, [ebp - 0x69c]
call fcn.007030e7
mov byte [ebp - 4], 4
call fcn.006f5438
mov ecx, eax
call fcn.006f34ca
test al, al
je 0x6fb136
lea eax, [ebp - 0x554]
push eax
call fcn.006f51eb
pop ecx
mov eax, dword [ebx]
lea ecx, [ebp - 0x720]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 5
call dword [eax + 0x24]
mov ecx, eax
mov byte [ebp - 4], 6
call fcn.00605d60
push eax
lea ecx, [ebp - 0x554]
call fcn.006f2fbb
lea ecx, [ebp - 0x720]
mov byte [ebp - 4], 5
call fcn.006f2ec7
lea ecx, [ebp - 0x554]
call fcn.00605d60
push eax
call fcn.006f8d35
pop ecx
lea ecx, [ebp - 0x554]
mov byte [ebp - 4], 4
call fcn.006f2ec7
call fcn.00402330
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x30]
dec eax
sub eax, 1
je 0x6fb275
dec eax
sub eax, 1
jne 0x6fb2a3
mov eax, dword [ebx]
mov ecx, ebx
push str.ZIPRES
call dword [eax + 0x38]
push eax
call fcn.006f5429
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
mov dword [ebp - 0x8b4], esi
test esi, esi
je 0x6fb3f7
push esi
call fcn.006f5429
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x8b0], eax
test eax, eax
jne 0x6fb1a2
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x6fb3f7
call fcn.00402330
push esi
call fcn.006f5429
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x6fb3f7
push edi
call fcn.006e70fd
mov dword [0x8d01e0], eax
pop ecx
test eax, eax
je 0x6fb1ea
push edi
push dword [ebp - 0x8b0]
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push dword [0x8d01e0]
call fcn.0074f6a0
add esp, 0xc
push 0x7bab50
lea ecx, [ebp - 0x488]
call fcn.00405a50
mov eax, dword [ebp - 0x478]
xor esi, esi
and dword [ebp - 0x8b0], esi
mov byte [ebp - 4], 8
mov dword [ebp - 0x8d0], eax
test edi, edi
je 0x6fb24a
mov ebx, dword [ebp - 0x8b0]
push esi
lea ecx, [ebp - 0x488]
call fcn.00414480
mov ecx, dword [0x8d01e0]
mov al, byte [eax]
xor byte [ebx + ecx], al
inc esi
xor eax, eax
cmp esi, dword [ebp - 0x8d0]
cmovge esi, eax
inc ebx
cmp ebx, edi
jb 0x6fb21c
mov ebx, dword [ebp - 0x8d4]
push dword [ebp - 0x8b4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
push edi
push dword [0x8d01e0]
call fcn.006f8d7e
pop ecx
pop ecx
push 0
push 1
lea ecx, [ebp - 0x488]
call fcn.004096c0
jmp 0x6fb2a3
mov eax, dword [ebx]
lea ecx, [ebp - 0x7a4]
push ecx
mov ecx, ebx
call dword [eax + 0x34]
push 1
mov ecx, eax
mov byte [ebp - 4], 7
call fcn.00605d60
push eax
call fcn.006f8de0
pop ecx
pop ecx
lea ecx, [ebp - 0x7a4]
call fcn.006f2ec7
xor eax, eax
mov dword [ebp - 0x8e0], eax
mov dword [ebp - 0x8dc], eax
mov dword [ebp - 0x8d8], eax
push 0x73
pop ecx
mov esi, str.JeKVNasmG6vhnnmQEoNKlUsuQYfRF4w3La10rosTwRnq6jA9mZZHiw2oAiP8U28rqazuhzXSmOgv8Vn3zeitWpTaQEmZV4ne6tP27fHGkARuGUVmYs5f9Bd7GV47tQnsFkaWhZhqegjIMyzDXZurhj6LLfpbQP5PEY3rS1mnW9Pg6pBH4au6Jvt7W5Z10kVmREz2k2cmG3H3QCa3fOhFRZUjRIvwAvLy6Ukh7cY9pplWeHND6U9yHtBNtgVdaCXK5731vC91HcvZnNqsxN0PaLtaXS3n6i9wKqxrfxt9OUd54aShbZwTMEIxK9u2fn0vuPxPXrA3QCrDJTBJtvoKtkYnOpCxabSVtJpQB7zG0nCzLRZ5YYuVVpLxCvtXNVLGIZnHkC5TOwEmJtwB3UWKi61dhev8pSG2PEyy7rzxEX9zLYGtzoakbPdUqZ0mHyBmhdqR6F7nBFKP
mov byte [ebp - 4], 9
lea edi, [ebp - 0x460]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x460]
push eax
lea ecx, [ebp - 0x4d0]
movsb byte es:[edi], byte [esi]
call fcn.00405a50
lea eax, [ebp - 0x4d0]
mov byte [ebp - 4], 0xa
push eax
lea ecx, [ebp - 0x8e0]
call fcn.004082f0
xor edi, edi
mov byte [ebp - 4], 9
push edi
push 1
lea ecx, [ebp - 0x4d0]
call fcn.004096c0
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x30]
cmp eax, 3
mov eax, dword [ebx]
jne 0x6fb364
lea ecx, [ebp - 0x828]
push ecx
mov ecx, ebx
call dword [eax + 0x28]
mov ecx, eax
mov byte [ebp - 4], 0xb
call fcn.00605d60
push eax
call fcn.00753669
pop ecx
lea ecx, [ebp - 0x828]
movzx esi, ax
mov byte [ebp - 4], 9
call fcn.006f2ec7
push edi
lea edi, [ebx + 0x38]
push edi
lea eax, [ebx + 0x34]
push eax
push 0x86c178
push esi
lea ecx, [ebp - 0x69c]
call fcn.00703c46
mov esi, eax
jmp 0x6fb3a7
lea ecx, [ebp - 0x8ac]
push ecx
mov ecx, ebx
lea esi, [ebx + 0x34]
call dword [eax + 0x28]
push edi
lea edi, [ebx + 0x38]
mov byte [ebp - 4], 0xc
push edi
push esi
push 0
mov ecx, eax
call fcn.00605d60
push ecx
mov ecx, esp
mov dword [ecx], eax
lea ecx, [ebp - 0x69c]
call fcn.00703c46
lea ecx, [ebp - 0x8ac]
mov byte [ebp - 4], 9
mov esi, eax
call fcn.006f2ec7
test esi, esi
jne 0x6fb3c6
push 0x10
push str.Duilib
push 0x86c190
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.006efc1a
push esi
mov ecx, edi
call fcn.006f486f
lea eax, [ebx + 0x2c]
mov ecx, edi
push eax
call fcn.006f46d7
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov ecx, edi
call fcn.006f5712
lea ecx, [ebp - 0x8e0]
call fcn.006ec102
lea ecx, [ebp - 0x69c]
call fcn.007022b1
lea ecx, [ebp - 0x8c0]
call fcn.006ec102
lea ecx, [ebp - 0x8cc]
call fcn.006ec102
xor eax, eax
call fcn.00772f7b
ret 0x10