Function at 0x100914b
Capabilities:
Delete file
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push 0x140
mov eax, 0x1030f38
call fcn.0100a184
xor esi, esi
push esi
push esi
mov eax, 0xdeadbeef
push eax
push eax
call fcn.0100d1ad
call fcn.0100e73b
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
push 0x1001760
call fcn.0100e475
pop ecx
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x124], eax
cmp eax, esi
jne 0x10091bf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x10091a9
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
push esi
push 0x1001740
call fcn.0100e475
pop ecx
pop ecx
mov eax, esi
jmp 0x100967f
push 0x104
lea ecx, [ebp - 0x118]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10091f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x10091ea
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
push esi
push 0x1001720
jmp 0x10091b1
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push eax
push 8
lea eax, [ebp - 0x118]
push eax
call fcn.0100e08b
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x120], eax
cmp eax, esi
jne 0x100924f
call ebx
cmp eax, esi
mov edi, 0xffff
mov esi, 0x80070000
jle 0x100922d
and eax, edi
or eax, esi
push eax
push 0x10016f8
call fcn.0100e475
mov eax, dword [ebp - 0x124]
and dword [ebp - 0x140], 0
pop ecx
pop ecx
mov dword [ebp - 0x120], eax
jmp 0x1009263
mov dword [ebp - 0x140], 1
mov edi, 0xffff
mov esi, 0x80070000
push 0x30d40
push dword [ebp - 0x120]
call fcn.01008c0d
pop ecx
pop ecx
push 0xa
push 0x65
push dword [ebp - 0x124]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x11c], eax
test eax, eax
jne 0x10092bf
call ebx
test eax, eax
jle 0x1009299
and eax, edi
or eax, esi
mov esi, eax
push esi
push 0x10016c8
call fcn.0100e475
push esi
push 0x30d42
push dword [ebp - 0x120]
call fcn.01008c0d
add esp, 0x14
jmp 0x10091b8
push dword [ebp - 0x11c]
push dword [ebp - 0x124]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x138], eax
test eax, eax
jne 0x10092ef
call ebx
test eax, eax
jle 0x10092e5
and eax, edi
or eax, esi
mov esi, eax
push esi
push 0x1001694
jmp 0x10092a1
push dword [ebp - 0x11c]
push dword [ebp - 0x124]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x1009319
call ebx
test eax, eax
jle 0x100930f
and eax, edi
or eax, esi
mov esi, eax
push esi
push 0x1001664
jmp 0x10092a1
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x11c], eax
test eax, eax
jne 0x1009341
call ebx
test eax, eax
jle 0x1009334
and eax, edi
or eax, esi
mov esi, eax
push esi
push 0x1001634
jmp 0x10092a1
and dword [ebp - 0x12c], 0
push 0x10386c0
lea ecx, [ebp - 0x124]
mov byte [ebp - 4], 1
call fcn.01008da9
mov byte [ebp - 4], 2
call fcn.0100eddd
lea ecx, [ebp - 0x12c]
push ecx
mov ecx, eax
call fcn.0100ef8c
test eax, eax
jne 0x1009685
mov eax, dword [ebp - 0x12c]
test eax, eax
je 0x1009389
mov eax, dword [eax]
jmp 0x100938b
xor eax, eax
push eax
lea ecx, [ebp - 0x124]
call fcn.01009125
push 0x100161c
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x128]
push eax
call fcn.010090c9
push dword [ebp - 0x128]
mov byte [ebp - 4], 3
push 0x1001600
call fcn.0100e475
pop ecx
pop ecx
push 0
push 0x80
push 2
push 0
push 7
push 0x40000000
push dword [ebp - 0x128]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x13c], eax
cmp eax, 0xffffffff
jne 0x100944d
call ebx
test eax, eax
jle 0x10093f8
and eax, edi
or eax, esi
mov esi, eax
push esi
push 0x10015d4
call fcn.0100e475
push esi
push 0x30d44
push dword [ebp - 0x120]
call fcn.01008c0d
add esp, 0x14
mov ecx, dword [ebp - 0x128]
add ecx, 0xfffffff0
call fcn.01008cd5
mov ecx, dword [ebp - 0x124]
add ecx, 0xfffffff0
call fcn.01008cd5
mov ecx, dword [ebp - 0x12c]
test ecx, ecx
je 0x10091b8
call fcn.01008f06
jmp 0x10091b8
push 0
lea eax, [ebp - 0x144]
push eax
push dword [ebp - 0x138]
push dword [ebp - 0x11c]
push dword [ebp - 0x13c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x148], eax
call ebx
test eax, eax
jle 0x100947e
and eax, edi
or eax, esi
push dword [ebp - 0x13c]
mov dword [ebp - 0x11c], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x148], 0
jne 0x10094f6
push dword [ebp - 0x11c]
push 0x10015a8
call fcn.0100e475
push dword [ebp - 0x11c]
push 0x30d44
push dword [ebp - 0x120]
call fcn.01008c0d
mov ecx, dword [ebp - 0x128]
add esp, 0x14
add ecx, 0xfffffff0
call fcn.01008cd5
mov ecx, dword [ebp - 0x124]
add ecx, 0xfffffff0
call fcn.01008cd5
mov ecx, dword [ebp - 0x12c]
test ecx, ecx
je 0x1009679
call fcn.01008f06
jmp 0x1009679
mov eax, dword [ebp - 0x138]
cmp dword [ebp - 0x144], eax
je 0x100952c
push 0x1001560
call fcn.0100e475
mov esi, 0x80004005
push esi
push 0x30d44
push dword [ebp - 0x120]
call fcn.01008c0d
add esp, 0x10
jmp 0x1009419
lea ecx, [ebp - 0x134]
call fcn.0100eb05
lea ecx, [ebp - 0x134]
mov byte [ebp - 4], 4
call fcn.0100ea06
mov dword [ebp - 0x11c], eax
test eax, eax
jne 0x100956d
push dword [ebp - 0x124]
push 0x1001520
call fcn.0100e475
push dword [ebp - 0x124]
push 0x30d41
jmp 0x1009588
push dword [ebp - 0x11c]
push 0x10014ec
call fcn.0100e475
push dword [ebp - 0x11c]
push 0x30d46
push dword [ebp - 0x120]
call fcn.01008c0d
add esp, 0x14
push dword [ebp - 0x128]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1009607
call ebx
test eax, eax
jle 0x10095b0
and eax, edi
or eax, esi
mov esi, eax
push esi
push dword [ebp - 0x128]
push 0x10014c8
call fcn.0100e475
push esi
push dword [ebp - 0x128]
push 0x30d45
push dword [ebp - 0x120]
call fcn.01008c0d
add esp, 0x1c
lea ecx, [ebp - 0x130]
call fcn.01008f95
mov ecx, dword [ebp - 0x134]
test ecx, ecx
je 0x1009419
call fcn.01008f06
and dword [ebp - 0x134], 0
jmp 0x1009419
lea ecx, [ebp - 0x130]
call fcn.01008f95
mov ecx, dword [ebp - 0x134]
test ecx, ecx
je 0x1009628
call fcn.01008f06
and dword [ebp - 0x134], 0
mov ecx, dword [ebp - 0x128]
add ecx, 0xfffffff0
call fcn.01008cd5
mov ecx, dword [ebp - 0x124]
add ecx, 0xfffffff0
call fcn.01008cd5
mov ecx, dword [ebp - 0x12c]
test ecx, ecx
je 0x100965a
call fcn.01008f06
and dword [ebp - 0x12c], 0
cmp dword [ebp - 0x140], 0
je 0x100966e
push dword [ebp - 0x120]
call fcn.0100d75e
call dword [sym.imp.ole32.dll_CoUninitialize]
call fcn.0100e3a7
mov eax, dword [ebp - 0x11c]
call fcn.0100a1ef
ret
push 0x10014a8
call fcn.0100e475
mov dword [esp], 0x30d43
push dword [ebp - 0x120]
call fcn.01008c0d
pop ecx
pop ecx
mov ecx, dword [ebp - 0x124]
add ecx, 0xfffffff0
call fcn.01008cd5
mov ecx, dword [ebp - 0x12c]
test ecx, ecx
je 0x10096c0
call fcn.01008f06
xor eax, eax
jmp 0x100967f