Function at 0x10001694
Capabilities:
Check for software breakpoints
Extract resource via kernel32 functions
Terminate process
Write file on windows

Disassembly:
push 2
push ecx
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
add esp, 0xfffffce0
push ebx
push esi
push edi
mov edi, 0x1005348c
mov ebx, dword [ebp + 0xc]
push 0x2349
push 0x68
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_FindResourceA
mov esi, eax
test esi, esi
jne 0x100016d3
mov eax, dword [ebp + 0x14]
push eax
call fcn.10001430
pop ecx
test eax, eax
jne 0x1000171f
xor eax, eax
jmp 0x100019d6
push esi
mov edx, dword [ebp + 8]
push edx
call sub.KERNEL32.DLL_LoadResource
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100016ed
xor eax, eax
jmp 0x100019d6
je 0x100016f2
jne 0x100016f2
jmp 0x1000167e
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.DLL_LockResource
mov dword [0x1004f378], eax
cmp dword [0x1004f378], 0
jne 0x10001710
xor eax, eax
jmp 0x100019d6
push esi
mov edx, dword [ebp + 8]
push edx
call sub.KERNEL32.DLL_SizeofResource
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
push 0x1c8
mov eax, dword [ebp + 0x14]
mov edx, dword [eax]
sub edx, 0x1c8
add edx, dword [0x1004f378]
push edx
push ebx
call fcn.10005b64
add esp, 0xc
mov ecx, sub.KERNEL32.DLL_CreateFileA
mov dword [ebp - 8], ecx
mov esi, dword [ebp - 8]
mov al, byte [esi]
cmp al, 0xcc
je 0x100017c5
mov eax, 0x1000ecf4
mov dword [ebp - 0xc], eax
mov esi, dword [ebp - 0xc]
mov al, byte [esi]
cmp al, 0xcc
je 0x100017c5
mov edx, sub.KERNEL32.DLL_CreateFileA
mov dword [ebp - 0x10], edx
mov esi, dword [ebp - 0x10]
mov al, byte [esi]
cmp al, 0xcc
je 0x100017c5
mov ecx, sub.KERNEL32.DLL_FindResourceA
mov dword [ebp - 0x14], ecx
mov esi, dword [ebp - 0x14]
mov al, byte [esi]
cmp al, 0xcc
je 0x100017c5
mov eax, sub.KERNEL32.DLL_LoadResource
mov dword [ebp - 0x18], eax
mov esi, dword [ebp - 0x18]
mov al, byte [esi]
cmp al, 0xcc
je 0x100017c5
push edi
lea edi, [ebp - 0x21c]
mov esi, 0x1004f38e
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop edi
lea eax, [ebp - 0x21c]
push 0x124
push eax
lea edx, [ebx + 0xa4]
push 0x64
push edx
call fcn.10003e20
add esp, 0x10
xor esi, esi
push 0x1c8
push ebx
lea eax, [ebp - 0x1fc]
push eax
call fcn.10005b64
add esp, 0xc
push 0x1c8
lea edx, [ebp - 0x1fc]
push edx
push ebx
call fcn.10005b64
add esp, 0xc
push 0xffffffffffffffff
mov ecx, dword [edi]
push ecx
call sub.KERNEL32.DLL_WaitForSingleObject
lea eax, [ebp - 0x320]
push eax
mov edx, dword [ebx + 0x1c0]
push edx
mov ecx, dword [ebx + 0x1c4]
push ecx
push esi
call fcn.1000d2c8
test eax, eax
je 0x10001868
push 0
push 1
mov eax, dword [edi]
push eax
call sub.KERNEL32.DLL_ReleaseSemaphore
mov edx, dword [ebx + 0x1bc]
push edx
lea ecx, [ebx + 0xa4]
push ecx
add ebx, 0xb8
push ebx
push 0
call sub.USER32.DLL_MessageBoxA
call sub.KERNEL32.DLL_GetCurrentProcessId
push eax
push 0
push 1
call sub.KERNEL32.DLL_OpenProcess
mov ebx, eax
push 0
push ebx
call sub.KERNEL32.DLL_TerminateProcess
push ebx
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
jmp 0x100019d6
push 0
push 1
mov edx, dword [edi]
push edx
call sub.KERNEL32.DLL_ReleaseSemaphore
lea ecx, [ebp - 0x320]
lea eax, [ebx + 0x98]
push ecx
push 0xc
push eax
call fcn.10003d68
add esp, 0xc
test eax, eax
jne 0x10001897
xor eax, eax
jmp 0x100019d6
lea edx, [ebp - 0x320]
push edx
push 0x98
push ebx
call fcn.10003d68
add esp, 0xc
test eax, eax
jne 0x100018b7
xor eax, eax
jmp 0x100019d6
mov edx, dword [ebx + 0x98]
lea ecx, [ebp - 0x24]
push edx
push 0x1004f48c
push ecx
call sub.USER32.DLL_wsprintfA
add esp, 0xc
mov eax, dword [ebx + 0x9c]
push eax
push 0x1004f48f
lea edx, [ebp - 0x30]
push edx
call sub.USER32.DLL_wsprintfA
add esp, 0xc
lea ecx, [ebp - 0x320]
lea eax, [ebp - 0x30]
lea edx, [ebp - 0x24]
push ecx
push 0
push eax
push edx
xor ecx, ecx
xor eax, eax
mov cl, byte [ebx + 0xa1]
push ecx
mov al, byte [ebx + 0xa2]
push eax
call fcn.10002de0
add esp, 0x18
test eax, eax
jne 0x1000191c
inc esi
jmp 0x100017dc
cmp byte [ebx + 9], 0
je 0x1000193c
lea edx, [ebp - 0x320]
push edx
push ebx
call fcn.100013a4
add esp, 8
test eax, eax
jne 0x1000193c
inc esi
jmp 0x100017dc
push 0xffffffffffffffff
mov ecx, dword [edi]
push ecx
call sub.KERNEL32.DLL_WaitForSingleObject
lea eax, [ebp - 0x320]
lea edx, [ebp - 0x30]
push eax
push edx
lea ecx, [ebp - 0x24]
lea eax, [ebp - 0x31]
push ecx
push 0
push eax
call fcn.1000d210
test eax, eax
jne 0x10001987
push 0
push 1
mov edx, dword [edi]
push edx
call sub.KERNEL32.DLL_ReleaseSemaphore
lea ecx, [ebp - 0x320]
push ecx
mov eax, dword [ebp + 0x10]
push eax
call sub.KERNEL32.DLL_lstrcpyA
mov eax, 1
jmp 0x100019d6
push 0
push 1
mov edx, dword [edi]
push edx
call sub.KERNEL32.DLL_ReleaseSemaphore
inc esi
jmp 0x100017dc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret